File name:

Bluefish-2.2.14beta-setup.exe.7z

Full analysis: https://app.any.run/tasks/73b9b841-83f9-45b9-9bd6-8f3885f5adab
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 10, 2023, 18:48:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

105E44356947A1C352C8120443E06A63

SHA1:

DE56729A3432159701710FA12483CA823C7E1644

SHA256:

207D6F99BF22463BF534BDF1B1B03365F51263111DB62C246D042E663D3999E1

SSDEEP:

98304:N55mjGKzXKWcxEhkeI33dn53Tzrdi8WeZLmb24ytrKNBzozFZWKwirl5o+8vCP5v:I/imlprMMw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • gtk2-runtime-2.24.8-2011-12-03-ash.exe (PID: 3640)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)

    • The process creates files with name similar to system file names

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)

    • Reads the Internet Settings

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)

    • Process requests binary or script from the Internet

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)

  • INFO

    • Create files in a temporary directory

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • gtk2-runtime-2.24.8-2011-12-03-ash.exe (PID: 3640)

    • Reads the computer name

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • gtk2-runtime-2.24.8-2011-12-03-ash.exe (PID: 3640)
      • wmpnscfg.exe (PID: 3864)
      • bluefish.exe (PID: 3724)

    • Checks supported languages

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • gtk2-runtime-2.24.8-2011-12-03-ash.exe (PID: 3640)
      • wmpnscfg.exe (PID: 3864)
      • bluefish.exe (PID: 3724)

    • Checks proxy server information

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)

    • Creates files in the program directory

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • gtk2-runtime-2.24.8-2011-12-03-ash.exe (PID: 3640)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3416)

    • Reads the machine GUID from the registry

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • wmpnscfg.exe (PID: 3864)

    • Creates files or folders in the user directory

      • Bluefish-2.2.14beta-setup.exe (PID: 3612)
      • bluefish.exe (PID: 3724)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3864)
      • bluefish.exe (PID: 3724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs bluefish-2.2.14beta-setup.exe no specs bluefish-2.2.14beta-setup.exe gtk2-runtime-2.24.8-2011-12-03-ash.exe no specs wmpnscfg.exe no specs bluefish.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bluefish-2.2.14beta-setup.exe.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3540"C:\Users\admin\AppData\Local\Temp\Rar$EXb3416.12293\Bluefish-2.2.14beta-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3416.12293\Bluefish-2.2.14beta-setup.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bluefish Installer
Exit code:
3221226540
Version:
2.2.14beta
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3416.12293\bluefish-2.2.14beta-setup.exe
c:\windows\system32\ntdll.dll
3612"C:\Users\admin\AppData\Local\Temp\Rar$EXb3416.12293\Bluefish-2.2.14beta-setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3416.12293\Bluefish-2.2.14beta-setup.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Bluefish Installer
Exit code:
0
Version:
2.2.14beta
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3416.12293\bluefish-2.2.14beta-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3640"C:\Users\admin\AppData\Local\Temp\gtk2-runtime-2.24.8-2011-12-03-ash.exe" /S /sideeffects=no /dllpath=root /D=C:\Program Files\BluefishC:\Users\admin\AppData\Local\Temp\gtk2-runtime-2.24.8-2011-12-03-ash.exe—Bluefish-2.2.14beta-setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\gtk2-runtime-2.24.8-2011-12-03-ash.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3724"C:\Program Files\Bluefish\bluefish.exe" -nC:\Program Files\Bluefish\bluefish.exe—explorer.exe
User:
admin
Company:
The Bluefish Developers
Integrity Level:
MEDIUM
Description:
Bluefish
Exit code:
0
Version:
2.2.14beta
Modules
Images
c:\program files\bluefish\bluefish.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3864"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
3 302
Read events
3 258
Write events
41
Delete events
3

Modification events

(PID) Process:(3416) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
61
Suspicious files
279
Text files
233
Unknown types
0

Dropped files

PID
Process
Filename
Type
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3416.12293\Bluefish-2.2.14beta-setup.exeexecutable
MD5:59B15EE634A23A219DD89006549A7050
SHA256:45F271D3C5CBC6E98F6A5FD98AEBBF347ABB68100C367DEB4D3D756C444B22A3
3612Bluefish-2.2.14beta-setup.exeC:\Program Files\Bluefish\share\doc\bluefish\COPYINGtext
MD5:D32239BCB673463AB874E80D47FAE504
SHA256:8CEB4B9EE5ADEDDE47B31E975C1D90C73AD27B6B165A1DCD80C7C545EB65B903
3612Bluefish-2.2.14beta-setup.exeC:\Users\admin\AppData\Local\Temp\nscFC58.tmp\System.dllexecutable
MD5:B9F430F71C7144D8FF4AB94BE2785AA6
SHA256:B496E81A74CE871236ABCD096FB9A6B210B456BEBAA7464FA844B3241E51A655
3612Bluefish-2.2.14beta-setup.exeC:\Program Files\Bluefish\bluefish.exeexecutable
MD5:C76EA084F33B88E7E5FDC0C9CB9EF006
SHA256:9D2A359681B326C91ED8A42E6C7CD7FE7DEAE434D78CD07D7CFA6D5B4AF45C37
3612Bluefish-2.2.14beta-setup.exeC:\Users\admin\AppData\Local\Temp\nscFC58.tmp\nsDialogs.dllexecutable
MD5:7823FC560926DCD8741DE6F0B900083F
SHA256:CA869D6C6752AA4A8A6C874A694B543442992D7E854D0C48A1B60BCA01A8C8C6
3612Bluefish-2.2.14beta-setup.exeC:\Users\admin\AppData\Local\Temp\nscFC58.tmp\UserInfo.dllexecutable
MD5:351B802508EE5462CBF7F35454A9DCA6
SHA256:39275EE1767AAC3AE0929A3E67A84A921610B45D5CFFF3DB1641893504D5C78D
3612Bluefish-2.2.14beta-setup.exeC:\Users\admin\AppData\Local\Temp\nscFC58.tmp\LangDLL.dllexecutable
MD5:8E806EA2E205DC508A2FB5ADDA3419DB
SHA256:86A55734B8802051BBBD0E8C9C506D0CA985BC5C99113E99B309469046133937
3612Bluefish-2.2.14beta-setup.exeC:\Users\admin\AppData\Local\Temp\nscFC58.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3612Bluefish-2.2.14beta-setup.exeC:\Program Files\Bluefish\libenchant-1.dllexecutable
MD5:A90D9FF1402AEE6FECAA90DE423FCFE1
SHA256:C8FBADCFCD52EF46B437BA0EC5FC1F5D87A318D2A78B641DEB5C2988B3BC009A
3416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Bluefish-2.2.14beta-setup.exe\Bluefish-2.2.14beta-setup.exeexecutable
MD5:59B15EE634A23A219DD89006549A7050
SHA256:45F271D3C5CBC6E98F6A5FD98AEBBF347ABB68100C367DEB4D3D756C444B22A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
3
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3612
Bluefish-2.2.14beta-setup.exe
GET
302
204.68.111.105:80
http://downloads.sourceforge.net/project/gtk-win/GTK%2B%20Runtime%20Environment/GTK%2B%202.24/gtk2-runtime-2.24.8-2011-12-03-ash.exe
unknown
text
216 b
unknown
3612
Bluefish-2.2.14beta-setup.exe
GET
200
78.35.24.122:80
http://netcologne.dl.sourceforge.net/project/gtk-win/GTK%2B%20Runtime%20Environment/GTK%2B%202.24/gtk2-runtime-2.24.8-2011-12-03-ash.exe
unknown
executable
7.54 Mb
unknown
3612
Bluefish-2.2.14beta-setup.exe
GET
200
172.67.180.106:80
http://www.muleslow.net/files/aspell/lang/aspell6-en-7.1-0.tbz2
unknown
compressed
1.25 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3612
Bluefish-2.2.14beta-setup.exe
204.68.111.105:80
downloads.sourceforge.net
Cloudflare London, LLC
US
unknown
3612
Bluefish-2.2.14beta-setup.exe
78.35.24.122:80
netcologne.dl.sourceforge.net
NetCologne Gesellschaft fur Telekommunikation mbH
DE
unknown
3612
Bluefish-2.2.14beta-setup.exe
172.67.180.106:80
www.muleslow.net
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
downloads.sourceforge.net
  • 204.68.111.105
whitelisted
netcologne.dl.sourceforge.net
  • 78.35.24.122
unknown
www.muleslow.net
  • 172.67.180.106
  • 104.21.18.53
malicious

Threats

PID
Process
Class
Message
3612
Bluefish-2.2.14beta-setup.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3612
Bluefish-2.2.14beta-setup.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3612
Bluefish-2.2.14beta-setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3612
Bluefish-2.2.14beta-setup.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bluefish-2.2.14beta-setup.exe.7z