File name:

HiViewSetup1.4.exe

Full analysis: https://app.any.run/tasks/52239b17-1ad2-49ad-b137-8356810e4bee
Verdict: Malicious activity
Analysis date: March 06, 2023, 18:53:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

3FB28C4DAC49F669A11054D2CA25D771

SHA1:

7E44CD6F7CF08A7521F373B8CA9997820713C3E4

SHA256:

31B4ED0FCE0253C285080197F000E71BDDCDEF4A5914264620B095B11BFEA39F

SSDEEP:

6144:j9X0GHX2OgBYpAkLvbF8b6n1QhxPL2RdnVd7Ce+f7p0c68Gx9:t0IXgB2zLCbiI2nVd7CeUh6j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HiViewSetup1.4.exe (PID: 2392)

    • Loads dropped or rewritten executable

      • HiViewSetup1.4.exe (PID: 2392)

    • Application was dropped or rewritten from another process

      • HiView.exe (PID: 2984)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HiViewSetup1.4.exe (PID: 2392)

    • Creates a software uninstall entry

      • HiViewSetup1.4.exe (PID: 2392)

    • The process creates files with name similar to system file names

      • HiViewSetup1.4.exe (PID: 2392)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • HiViewSetup1.4.exe (PID: 2392)

  • INFO

    • Checks supported languages

      • HiViewSetup1.4.exe (PID: 2392)
      • HiView.exe (PID: 2984)

    • Reads the computer name

      • HiViewSetup1.4.exe (PID: 2392)
      • HiView.exe (PID: 2984)

    • The process checks LSA protection

      • HiViewSetup1.4.exe (PID: 2392)
      • HiView.exe (PID: 2984)

    • Drops a file that was compiled in debug mode

      • HiViewSetup1.4.exe (PID: 2392)

    • Create files in a temporary directory

      • HiViewSetup1.4.exe (PID: 2392)

    • Creates files or folders in the user directory

      • HiViewSetup1.4.exe (PID: 2392)

    • Creates files in the program directory

      • HiViewSetup1.4.exe (PID: 2392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3348
UninitializedDataSize: 1024
InitializedDataSize: 162816
CodeSize: 26112
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2020:08:01 02:44:50+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 01-Aug-2020 02:44:50
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 01-Aug-2020 02:44:50
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006457
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.43499
.rdata
0x00008000
0x00001380
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.261
.data
0x0000A000
0x00025538
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.13373
.ndata
0x00030000
0x00009000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00039000
0x00004260
0x00004400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.92246

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2901
1072
UNKNOWN
English - United States
RT_MANIFEST
2
5.9993
3752
UNKNOWN
English - United States
RT_ICON
3
6.24459
2216
UNKNOWN
English - United States
RT_ICON
4
5.01502
1384
UNKNOWN
English - United States
RT_ICON
5
6.16057
1128
UNKNOWN
English - United States
RT_ICON
6
3.34146
744
UNKNOWN
English - United States
RT_ICON
7
3.04232
296
UNKNOWN
English - United States
RT_ICON
103
2.6691
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start hiviewsetup1.4.exe hiview.exe hiviewsetup1.4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
860"C:\Users\admin\AppData\Local\Temp\HiViewSetup1.4.exe" C:\Users\admin\AppData\Local\Temp\HiViewSetup1.4.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\hiviewsetup1.4.exe
c:\windows\system32\ntdll.dll
2392"C:\Users\admin\AppData\Local\Temp\HiViewSetup1.4.exe" C:\Users\admin\AppData\Local\Temp\HiViewSetup1.4.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hiviewsetup1.4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2984"C:\Program Files\HiView\HiView.exe"C:\Program Files\HiView\HiView.exe
HiViewSetup1.4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\hiview\hiview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 612
Read events
1 596
Write events
16
Delete events
0

Modification events

(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HiView.exe
Operation:writeName:(default)
Value:
C:\Program Files\HiView\HiView.exe
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:DisplayName
Value:
HiView 1.4
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:UninstallString
Value:
C:\Program Files\HiView\uninst.exe
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:DisplayIcon
Value:
C:\Program Files\HiView\HiView.exe
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:DisplayVersion
Value:
1.4
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:URLInfoAbout
Value:
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:Publisher
Value:
${PRODUCT_PUBLISHER}
(PID) Process:(2392) HiViewSetup1.4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HiView
Operation:writeName:NSIS:Language
Value:
1033
Executable files
10
Suspicious files
0
Text files
24
Unknown types
6

Dropped files

PID
Process
Filename
Type
2392HiViewSetup1.4.exeC:\Program Files\HiView\Spanish.initext
MD5:54CEE1600F681EAF166CE1F4A6876CFA
SHA256:7FC2DA614A64F4B12905A8DADEBF7320AE5B2C2A43B09779559C0496BA19D288
2392HiViewSetup1.4.exeC:\Program Files\HiView\Chinese.initext
MD5:693E2BA04EEF00573640972E93221057
SHA256:D4AD3A7626DB4F6D500EEF7B7F77877EE7372F14045B8CE0DCF47249D1A830FD
2392HiViewSetup1.4.exeC:\Program Files\HiView\Italian.initext
MD5:24FAEE1039BB122E4BEAE0AAF7DCB010
SHA256:ECFAA18FA0131D977A9ECE8FBAD4E09D563F713719C4919D16B50463603D8E5D
2392HiViewSetup1.4.exeC:\Program Files\HiView\French.initext
MD5:2D254EC0163BCBBEDEA53499A8489576
SHA256:2F5055CABC01E64E0DB7B9234E3AB554AE908E75EAFCDC8F6BF091CC1E7BDA50
2392HiViewSetup1.4.exeC:\Program Files\HiView\uninst.exeexecutable
MD5:23EAE471F9B4D41F6FDC7235949AFCDF
SHA256:E1AC6C1E3D42755AA4C44CC843A7D242543107D7A9B6AF20F146E83100ECDB0A
2392HiViewSetup1.4.exeC:\Program Files\HiView\Portuguese.initext
MD5:5D031E51DC2173C33C0446C6F6173E8F
SHA256:3C49A54F3C2514B788C629D8AB9837C60BDC583F5E53A9F9D3C57F2A86F629A9
2392HiViewSetup1.4.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiView\Uninstall.lnklnk
MD5:6AC2A42DE1DC4C3A5F64DF28B4ED8DF1
SHA256:02C6DB557CD65B49B554BA06360E703561C7764EF5701411EAA627CA98D4B95D
2392HiViewSetup1.4.exeC:\Users\admin\AppData\Local\Temp\nsq19F9.tmp\InstallOptions.dllexecutable
MD5:5F35212D7E90EE622B10BE39B09BD270
SHA256:31944B93E44301974D9C6F810D2DA792E34A53DCACD619A08CB0385AC59E513D
2392HiViewSetup1.4.exeC:\Program Files\HiView\Russian.initext
MD5:ACF673290708A9C18863EC0EE67B180E
SHA256:D365BC5A707006250AB1CF347A6838ED8AAAD263F7085D63A5A67B25F14C8F8F
2392HiViewSetup1.4.exeC:\Program Files\HiView\Japanese.initext
MD5:33767E6ACE02D5F8AB88F54AC0BC288D
SHA256:512D2B0C4632B7A3BAD9DF12C9FC63587693AFFF15AE4F15DAFB36068F352B5F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
HiView.exe
114 entries read from C:\Program Files\HiView\English.ini
HiView.exe
114 entries read from C:\Program Files\HiView\English.ini
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HiViewSetup1.4.exe