| File name: | FluxPlayer_Setup_10.5.0.10507.exe |
| Full analysis: | https://app.any.run/tasks/dc98efe4-817d-454e-961e-74dcc9e2cdd3 |
| Verdict: | Malicious activity |
| Analysis date: | August 07, 2020, 23:29:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 4111FE3555466D69AC8468343974D6F8 |
| SHA1: | 765116BF6346F9C4BCAC6E26A47643A3859DA87B |
| SHA256: | 3621C6FAFA9B4F0B4937A7ABE835F3363A8CD2D51F5B84D3600C033017AF55CE |
| SSDEEP: | 393216:DiXPJ4zVWfttmWTWWUNcb/FrVDLhEZ4t7PFl:DifoWfHmtqfLhDpD |
MALICIOUS
Loads dropped or rewritten executable
- FluxPlayer_Setup_10.5.0.10507.exe (PID: 3304)
- FluxPlayer.exe (PID: 2592)
Application was dropped or rewritten from another process
- FluxPlayer.exe (PID: 2592)
SUSPICIOUS
Reads Internet Cache Settings
- FluxPlayer.exe (PID: 2592)
Executable content was dropped or overwritten
- FluxPlayer_Setup_10.5.0.10507.exe (PID: 3304)
Creates files in the user directory
- FluxPlayer_Setup_10.5.0.10507.exe (PID: 3304)
Creates a software uninstall entry
- FluxPlayer_Setup_10.5.0.10507.exe (PID: 3304)
Modifies the open verb of a shell class
- FluxPlayer_Setup_10.5.0.10507.exe (PID: 3304)
Reads internet explorer settings
- FluxPlayer.exe (PID: 2592)
Changes IE settings (feature browser emulation)
- FluxPlayer.exe (PID: 2592)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:12:16 01:50:50+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 25088 |
| InitializedDataSize: | 118784 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x3384 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 10.5.0.10507 |
| ProductVersionNumber: | 10.5.0.10507 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Portuguese (Brazilian) |
| CharacterSet: | Windows, Latin1 |
| FileDescription: | Flux Player Setup |
| FileVersion: | 10.5.0.10507 |
| LegalCopyright: | Copyright (c) 2011-2020 ACE GmbH |
| ProductName: | Flux Player |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 16-Dec-2019 00:50:50 |
| Detected languages: |
|
| FileDescription: | Flux Player Setup |
| FileVersion: | 10.5.0.10507 |
| LegalCopyright: | Copyright (c) 2011-2020 ACE GmbH |
| ProductName: | Flux Player |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000C8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 16-Dec-2019 00:50:50 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000060E4 | 0x00006200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.41884 |
.rdata | 0x00008000 | 0x0000123E | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.03406 |
.data | 0x0000A000 | 0x0001A838 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.21839 |
.ndata | 0x00025000 | 0x00013000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00038000 | 0x00058708 | 0x00058800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.98379 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.28666 | 1249 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.91685 | 67624 | UNKNOWN | English - United States | RT_ICON |
3 | 7.97586 | 59241 | UNKNOWN | English - United States | RT_ICON |
4 | 4.21286 | 38056 | UNKNOWN | English - United States | RT_ICON |
5 | 4.66701 | 16936 | UNKNOWN | English - United States | RT_ICON |
6 | 4.99046 | 9640 | UNKNOWN | English - United States | RT_ICON |
7 | 5.25006 | 6760 | UNKNOWN | English - United States | RT_ICON |
8 | 5.62956 | 4264 | UNKNOWN | English - United States | RT_ICON |
9 | 6.01136 | 2440 | UNKNOWN | English - United States | RT_ICON |
10 | 6.40359 | 1128 | UNKNOWN | English - United States | RT_ICON |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2592 | "C:\Users\admin\AppData\Local\Flux Player\Binaries\FluxPlayer.exe" | C:\Users\admin\AppData\Local\Flux Player\Binaries\FluxPlayer.exe | FluxPlayer_Setup_10.5.0.10507.exe | ||||||||||||
User: admin Company: ACE GmbH Integrity Level: MEDIUM Description: FluxPlayer Exit code: 0 Version: 10.5.0.10507 Modules
| |||||||||||||||
| 3304 | "C:\Users\admin\AppData\Local\Temp\FluxPlayer_Setup_10.5.0.10507.exe" | C:\Users\admin\AppData\Local\Temp\FluxPlayer_Setup_10.5.0.10507.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Flux Player Setup Exit code: 0 Version: 10.5.0.10507 Modules
| |||||||||||||||
Total events
467
Read events
422
Write events
45
Delete events
0
Modification events
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.fluxt |
| Operation: | write | Name: | PerceivedType |
Value: Audio | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.fluxt |
| Operation: | write | Name: | Runtime |
Value: 7 | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Extensions\.fluxt |
| Operation: | write | Name: | Permissions |
Value: 15 | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\Media Type\Extensions\.fluxt |
| Operation: | write | Name: | Source Filter |
Value: {5F7F7825-3381-4C3A-8B88-6B69A5E21BA1} | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\.fluxdvd |
| Operation: | write | Name: | (default) |
Value: FluxPlayerMediaFile | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\.fluxaudio |
| Operation: | write | Name: | (default) |
Value: FluxPlayerMediaFile | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\.fluxpackage |
| Operation: | write | Name: | (default) |
Value: FluxPlayerMediaFile | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\.fluxhd |
| Operation: | write | Name: | (default) |
Value: FluxPlayerMediaFile | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\FluxPlayerMediaFile |
| Operation: | write | Name: | (default) |
Value: Flux Media File | |||
| (PID) Process: | (3304) FluxPlayer_Setup_10.5.0.10507.exe | Key: | HKEY_CLASSES_ROOT\FluxPlayerMediaFile\DefaultIcon |
| Operation: | write | Name: | (default) |
Value: C:\Users\admin\AppData\Local\Flux Player\Binaries\FluxPlayer.exe,1 | |||
Executable files
33
Suspicious files
7
Text files
12
Unknown types
31
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Temp\nsc296A.tmp\modern-wizard.bmp | image | |
MD5:CBE40FD2B1EC96DAEDC65DA172D90022 | SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\AudioSink.ax | executable | |
MD5:09DF11B0EE21C0FE07AEB7A11DA1CE34 | SHA256:313AEF76056E3A7DCDD22221D459507586090A0E9C8B0017EC4D12593BAC0EBA | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\avcdec.ax | executable | |
MD5:7C89FDB6F6D8F1A690939B455F36C218 | SHA256:8F9C0676216DAE9CC7C1DAD564D44FE1FF7BD31ED4C0A764C90A9301825502D5 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\XCTBurn.dll | executable | |
MD5:064E200AD3A326842075094CA5D6821D | SHA256:E2C413C671FAED0A3AA0BDFFC5CDC702F2892A9EEDF4D9572690EFA0194C04EC | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Temp\nsc296A.tmp\nsDialogs.dll | executable | |
MD5:6E64E5D5F9498058A300B26B8741D9D5 | SHA256:8D4B1C275FD1CD0782A265080B56D1AEC8D1C93EDCA5EF3B050D1D20D7B61F33 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\AVCTCD.ax | executable | |
MD5:7DFBF40BCCD25BF7BEC2E62470AA21E7 | SHA256:6ABA236B3B9B33BB354FA4049BE44D1429CA08E9B6B4E763FD5C8FAAAF9AA294 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\XCTSecureBurn.dll | executable | |
MD5:1DEA2366F0ABA867091B2015DFE1C3F8 | SHA256:09EA90285A890FF1013E6E37C519FD05B502050C125FA5F073043FB86534ADB4 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\ISOCreator.dll | executable | |
MD5:4CBF795CE76A3A0B30D44AFB6C849604 | SHA256:42EB875F504861BB0234187765317869DDC4F198364136AD356BF3BE6D5FDFCE | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\XEBDeviceInfo.dll | executable | |
MD5:7B2DD9545E14CAC551DA4F83D57AEDE0 | SHA256:D54F3735B608CD852A106406DE895442B13C8D1B7CCACD9E78800B2305F5CA65 | |||
| 3304 | FluxPlayer_Setup_10.5.0.10507.exe | C:\Users\admin\AppData\Local\Flux Player\Binaries\XEB\AC3Synth.ax | executable | |
MD5:008CAC94FF0F8E433EE8C78AC25E643C | SHA256:08C8CF7C8E89DB324997924F3BC1A04538BC455D47C9B60089750179BE30964D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2592 | FluxPlayer.exe | GET | 200 | 2.16.107.80:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | unknown | der | 1.37 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2592 | FluxPlayer.exe | 2.16.107.80:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | — | suspicious |
2592 | FluxPlayer.exe | 188.40.176.163:443 | admin.flickrocket.com | Hetzner Online GmbH | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
admin.flickrocket.com |
| unknown |
isrg.trustid.ocsp.identrust.com |
| whitelisted |