File name:

winzip25.exe

Full analysis: https://app.any.run/tasks/79f01649-5dee-48ac-bbf8-aaa786b7739a
Verdict: Malicious activity
Analysis date: September 09, 2020, 06:09:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5E0E54AFCC216977F48B0B2507D51F15

SHA1:

81119134F165F1597A9AB8331F8591E9DAB2763D

SHA256:

2A9102DF4D65B347682728D24844B630778DA9F9DDB3B93B2B8797355562D8F9

SSDEEP:

24576:SFIGyG7w8RXGI449oMijCEBMw7lBw4c4Kw0XWj:kwAGI449oMijCEBMwPQ4KZXWj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • winzip25.exe (PID: 3024)

    • Loads dropped or rewritten executable

      • winzip32.exe (PID: 3604)
      • WzCABCacheSyncHelper32.exe (PID: 3948)
      • svchost.exe (PID: 852)
      • csrss.exe (PID: 392)
      • adxregistrator.exe (PID: 1348)
      • adxregistrator.exe (PID: 3092)

    • Application was dropped or rewritten from another process

      • CloseFAH.exe (PID: 3552)
      • WzCABCacheSyncHelper32.exe (PID: 3948)
      • adxregistrator.exe (PID: 1348)
      • adxregistrator.exe (PID: 3092)
      • WzPreloader.exe (PID: 1244)
      • WzPreviewer32.exe (PID: 3648)
      • WzBGTComServer32.exe (PID: 2148)
      • WZUpdateNotifier.exe (PID: 2484)
      • WzBGTools32.exe (PID: 272)

    • Writes to a start menu file

      • msiexec.exe (PID: 3220)

  • SUSPICIOUS

    • Starts itself from another location

      • winzip25.exe (PID: 2488)

    • Creates files in the program directory

      • winzip25.exe (PID: 3024)
      • winzip32.exe (PID: 3604)

    • Executable content was dropped or overwritten

      • winzip25.exe (PID: 2488)
      • msiexec.exe (PID: 3220)

    • Changes IE settings (feature browser emulation)

      • msiexec.exe (PID: 3220)

    • Adds / modifies Windows certificates

      • winzip25.exe (PID: 3024)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3220)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 3220)
      • winzip32.exe (PID: 3604)

    • Reads Internet Cache Settings

      • winzip25.exe (PID: 3024)

    • Reads internet explorer settings

      • winzip25.exe (PID: 3024)

    • Creates files in the user directory

      • winzip32.exe (PID: 3604)

    • Creates a software uninstall entry

      • winzip32.exe (PID: 3604)

    • Creates COM task schedule object

      • winzip32.exe (PID: 3604)
      • adxregistrator.exe (PID: 1348)
      • adxregistrator.exe (PID: 3092)

    • Loads DLL from Mozilla Firefox

      • csrss.exe (PID: 392)

    • Creates files in the Windows directory

      • svchost.exe (PID: 852)

  • INFO

    • Reads settings of System Certificates

      • winzip25.exe (PID: 3024)
      • msiexec.exe (PID: 3220)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 3220)
      • winzip25.exe (PID: 3024)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3220)

    • Searches for installed software

      • msiexec.exe (PID: 3220)

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 3220)

    • Reads Microsoft Office registry keys

      • adxregistrator.exe (PID: 1348)
      • adxregistrator.exe (PID: 3092)

    • Creates files in the program directory

      • msiexec.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:15 04:53:43+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 519680
InitializedDataSize: 196096
UninitializedDataSize: -
EntryPoint: 0x4edfc
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 24.0.14135.0
ProductVersionNumber: 24.0.14135.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.14135.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2020 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.14135.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-May-2020 02:53:43
Detected languages:
  • English - United States
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.14135.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2020 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.14135.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 15-May-2020 02:53:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0007EC7C
0x0007EE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61086
.rdata
0x00080000
0x00020082
0x00020200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.97489
.data
0x000A1000
0x00003BCC
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.70095
.gfids
0x000A5000
0x000007CC
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.98215
.tls
0x000A6000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x000A7000
0x00004E58
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.53826
.reloc
0x000AC000
0x000065E4
0x00006600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62168

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.16947
2013
UNKNOWN
English - United States
RT_MANIFEST
101
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
RPCRT4.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start winzip25.exe winzip25.exe closefah.exe no specs wzpreviewer32.exe no specs wzpreloader.exe no specs winzip32.exe no specs wzcabcachesynchelper32.exe svchost.exe msiexec.exe csrss.exe no specs adxregistrator.exe no specs adxregistrator.exe no specs wzbgtcomserver32.exe no specs wzupdatenotifier.exe no specs wzbgtools32.exe no specs winzip25.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\WinZip\WzBGTools32.exe" /sC:\Program Files\WinZip\WzBGTools32.exe—msiexec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip Background Tool
Exit code:
0
Version:
25.0.14230.0
Modules
Images
c:\program files\winzip\wzbgtools32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
392%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe——
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\csrsrv.dll
c:\windows\system32\basesrv.dll
c:\windows\system32\winsrv.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
852C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\host.exe
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1244"C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe—msiexec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip Preloader
Exit code:
0
Version:
25.0.14230.0
Modules
Images
c:\program files\winzip\wzpreloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1348"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=user /GenerateLogFile=falseC:\Program Files\WinZip\adxregistrator.exe—MsiExec.exe
User:
admin
Company:
Add-in Express Ltd.
Integrity Level:
HIGH
Description:
Add-in Express .NET Registrator
Exit code:
0
Version:
9.4.4644.0
Modules
Images
c:\program files\winzip\adxregistrator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2148"C:\Program Files\WinZip\WzBGTComServer32.exe" /REGSERVERC:\Program Files\WinZip\WzBGTComServer32.exe—msiexec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip Background Tool
Exit code:
0
Version:
25.0.14230.0
Modules
Images
c:\program files\winzip\wzbgtcomserver32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2484"C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe—msiexec.exe
User:
admin
Company:
Corel Corporation
Integrity Level:
HIGH
Description:
WinZip Update Notifier
Exit code:
1
Version:
3,5,13039,0
Modules
Images
c:\program files\winzip\wzupdatenotifier.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2488"C:\Users\admin\AppData\Local\Temp\winzip25.exe" C:\Users\admin\AppData\Local\Temp\winzip25.exe
explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
24.0.14135.0
Modules
Images
c:\users\admin\appdata\local\temp\winzip25.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
3024 run=1 shortcut="C:\Users\admin\AppData\Local\Temp\winzip25.exe"C:\Users\admin\AppData\Local\Temp\e5e39\winzip25.exe
winzip25.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
24.0.14135.0
Modules
Images
c:\users\admin\appdata\local\temp\e5e39\winzip25.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
3092"C:\Program Files\WinZip\adxregistrator.exe" /install="C:\Program Files\WinZip\WinZipExpressForOffice.dll" /privileges=admin /GenerateLogFile=falseC:\Program Files\WinZip\adxregistrator.exe—MsiExec.exe
User:
SYSTEM
Company:
Add-in Express Ltd.
Integrity Level:
SYSTEM
Description:
Add-in Express .NET Registrator
Exit code:
0
Version:
9.4.4644.0
Modules
Images
c:\program files\winzip\adxregistrator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 508
Read events
792
Write events
1 703
Delete events
13

Modification events

(PID) Process:(852) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\WMI Writer
Operation:writeName:ObjectId
Value:
EB00000000000000
(PID) Process:(852) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\WMI Writer
Operation:writeName:ObjectLru
Value:
F903000000000000
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:install_language
Value:
English
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:status
Value:
0
(PID) Process:(3024) winzip25.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:channel
Value:
ppc_25
Executable files
206
Suspicious files
14
Text files
83
Unknown types
22

Dropped files

PID
Process
Filename
Type
3024winzip25.exeC:\ProgramData\UniqueId\databinary
MD5:—
SHA256:—
852svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\js\common.jstext
MD5:—
SHA256:—
2488winzip25.exeC:\Users\admin\AppData\Local\Temp\e5e39\winzip25.exeexecutable
MD5:—
SHA256:—
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\img\centerImg.pngimage
MD5:F1F71117A2C77649963C8B4CCF4B5CF8
SHA256:44C4E7A6E7293B855830F94496D7ADDC6916BFE62E36AC8142CDA1919745950E
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\img\button-hover.pngimage
MD5:7D3A382C149EE7588958281A816918BF
SHA256:97E35A7F7DC87983E8D1DDAA120BBA9D81BFE3AE4A6F99301A4749224CFBDD02
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\img\footerImg.pngimage
MD5:F766FA02DECAFCBDC7B54311436E5931
SHA256:D334FB1C34872899D08183154C14151D2D2A65E99F37C41B5B23E320FD340F94
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\img\headerImg.pngimage
MD5:EA07C82C382D670FCCAC91863B5EE0AD
SHA256:19416D915F430E0223E5F342487FC90E978F275104A15DC56238A9FC09381722
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\img\button-normal.pngimage
MD5:7C7DBDEE45987EADA0D0DC0D126B4239
SHA256:0A649E9E86D9379792B44DC80D9C9C9A7F134DA4DA03F7B422C51CDCF7849A5C
3024winzip25.exeC:\Users\admin\AppData\Local\Temp\e5fee\common\js\jquery-1.11.2.min.jstext
MD5:5790EAD7AD3BA27397AEDFA3D263B867
SHA256:2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
8
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3024
winzip25.exe
POST
200
54.148.116.202:80
http://www.installportal.com/v1/token
US
text
193 b
malicious
3024
winzip25.exe
POST
200
54.148.116.202:80
http://i.installportal.com/v1/logUserActivity
US
xml
186 b
malicious
3024
winzip25.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
3024
winzip25.exe
POST
200
54.148.116.202:80
http://www.installportal.com/v1/token
US
text
187 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3024
winzip25.exe
54.148.116.202:80
i.installportal.com
Amazon.com, Inc.
US
malicious
3024
winzip25.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3024
winzip25.exe
104.108.144.34:443
download.winzip.com
TOT Public Company Limited
US
malicious

DNS requests

Domain
IP
Reputation
i.installportal.com
  • 54.148.116.202
  • 34.214.206.145
unknown
www.installportal.com
  • 54.148.116.202
  • 34.214.206.145
unknown
download.winzip.com
  • 104.108.144.34
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winzip25.exe