| File name: | sfxcab.exe |
| Full analysis: | https://app.any.run/tasks/5cadb5b4-55c6-4678-88f3-3bec50345206 |
| Verdict: | Suspicious activity |
| Analysis date: | December 09, 2018, 12:25:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 0E2E8D8771939FF64061D8D66E212A3A |
| SHA1: | 2FCB285D0487257C7B9EF65ACA2E741AB89AD89A |
| SHA256: | 4544E69BCBE31403C237648E79BA13542E6F6376415D6EA629B7D6BDE254093B |
| SSDEEP: | 24576:QQ+wJjp6usvOfswwEp1Uk7tGt2TpPjMOHdHWOy+8svvPJwx3:QQNJj8u8bwb1Uftq1AwcO2svmJ |
MALICIOUS
Application was dropped or rewritten from another process
- update.exe (PID: 2536)
- update.exe (PID: 3708)
- update.exe (PID: 3564)
Loads dropped or rewritten executable
- update.exe (PID: 3708)
- update.exe (PID: 3564)
SUSPICIOUS
Executable content was dropped or overwritten
- sfxcab.exe (PID: 3156)
- sfxcab.exe (PID: 2288)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (82.5) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (7.3) |
| .exe | | | Win64 Executable (generic) (6.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (1.5) |
| .exe | | | Win32 Executable (generic) (1) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2005:02:24 20:44:38+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 7.1 |
| CodeSize: | 31232 |
| InitializedDataSize: | 72704 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x5972 |
| OSVersion: | 5.2 |
| ImageVersion: | 5.2 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.1.22.4 |
| ProductVersionNumber: | 6.1.22.4 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Self-Extracting Cabinet |
| FileVersion: | 6.1.0022.4 (SRV03_QFE.031113-0918) |
| InternalName: | SFXCAB.EXE |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | SFXCAB.EXE |
| ProductName: | Microsoft® Windows® Operating System |
| ProductVersion: | 6.1.0022.4 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 24-Feb-2005 19:44:38 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Microsoft Corporation |
| FileDescription: | Self-Extracting Cabinet |
| FileVersion: | 6.1.0022.4 (SRV03_QFE.031113-0918) |
| InternalName: | SFXCAB.EXE |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFilename: | SFXCAB.EXE |
| ProductName: | Microsoft® Windows® Operating System |
| ProductVersion: | 6.1.0022.4 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000C8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 24-Feb-2005 19:44:38 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x000078A0 | 0x00007A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.58341 |
.data | 0x0000A000 | 0x000110D4 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.513491 |
.rsrc | 0x0001C000 | 0x00000988 | 0x00121E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.99929 |
.udata | 0x0001E000 | 0x00010000 | 0x00010000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 3.53535 | 904 | UNKNOWN | English - United States | RT_VERSION |
100 | 3.0946 | 282 | UNKNOWN | English - United States | RT_DIALOG |
107 | 2.9591 | 224 | UNKNOWN | English - United States | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
msvcrt.dll |
ntdll.dll |
Total processes
41
Monitored processes
5
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2288 | "C:\Users\admin\Desktop\sfxcab.exe" | C:\Users\admin\Desktop\sfxcab.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Self-Extracting Cabinet Exit code: 1603 Version: 6.1.0022.4 (SRV03_QFE.031113-0918) Modules
| |||||||||||||||
| 2536 | c:\315be4067321fa5f011f\update\update.exe | c:\315be4067321fa5f011f\update\update.exe | — | sfxcab.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Service Pack Setup Exit code: 3221226540 Version: 6.3.0004.0 built by: dnsrv Modules
| |||||||||||||||
| 3156 | "C:\Users\admin\Desktop\sfxcab.exe" | C:\Users\admin\Desktop\sfxcab.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Self-Extracting Cabinet Exit code: 1603 Version: 6.1.0022.4 (SRV03_QFE.031113-0918) Modules
| |||||||||||||||
| 3564 | c:\0db4d90da969dbf95e301fa09fb0\update\update.exe | c:\0db4d90da969dbf95e301fa09fb0\update\update.exe | — | sfxcab.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Service Pack Setup Exit code: 1603 Version: 6.3.0004.0 built by: dnsrv Modules
| |||||||||||||||
| 3708 | c:\315be4067321fa5f011f\update\update.exe | c:\315be4067321fa5f011f\update\update.exe | sfxcab.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Service Pack Setup Exit code: 1603 Version: 6.3.0004.0 built by: dnsrv Modules
| |||||||||||||||
Total events
4
Read events
0
Write events
4
Delete events
0
Modification events
| (PID) Process: | (3708) update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup |
| Operation: | write | Name: | LogLevel |
Value: 536870912 | |||
| (PID) Process: | (3708) update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup |
| Operation: | write | Name: | LogLevel |
Value: 0 | |||
| (PID) Process: | (3564) update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup |
| Operation: | write | Name: | LogLevel |
Value: 536870912 | |||
| (PID) Process: | (3564) update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup |
| Operation: | write | Name: | LogLevel |
Value: 0 | |||
Executable files
20
Suspicious files
0
Text files
10
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\$shtdwn$.req | — | |
MD5:— | SHA256:— | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\photometadatahandler.dll | executable | |
MD5:D58D6FE515497A3F9C1FE258BB323017 | SHA256:274A8D21C952311E167F83C1813EECAB514DEB1A22FABF72F321C7A137013B88 | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\wmphoto.dll | executable | |
MD5:F9E1010AA77690B89D4B9906F48C7F2E | SHA256:62E55A5FE2A04939C181B772D082A29DEF47930D655ABFA734F92C5CDE72227D | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\spuninst.exe | executable | |
MD5:4E5AE8DAC927A370D44FE0BBD5DC1EDC | SHA256:5C84A01ED4511D618E3F6B876B4E14C051B4E57D03E3C50DC59D7BF718FEC587 | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\windowscodecsext.dll | executable | |
MD5:6EB28D7C107EBCDC41EDD7BC31F9943E | SHA256:66A419D913324A3A0ED713089310B9BF74D4D9FF33B1923DA4BA2638FCD7FB19 | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\update\wic.cat | cat | |
MD5:AEB7D8B9E0CA556624AB4A21128D798F | SHA256:FC426B0B2CE2BB8B5DE6333EB7AB681A0DEAC0E6DF04C4CDBD87FD1CB0F9D3FC | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\update\spcustom.dll | executable | |
MD5:955DCD6AE9D532EC281CF183F3DB15F6 | SHA256:EFDC46C9ED71FD24E5941ADA10FE853ACDA303D1B02DE053DA4A33CD467D44ED | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\spmsg.dll | executable | |
MD5:33E0C59138483D08A111B8B8CF94A18C | SHA256:F47EF0FD145335FF4579A16E1D603F7FCCFAC3D99B0BE11134E1DEC538485390 | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\update\update_winxp.inf | ini | |
MD5:FC4BD1453938F5A09D6BD42D354450A0 | SHA256:C4B0BF4FC3BCAF3D53A6C3E54DFACBD777C8EEB577215D1740E0F464CEE52327 | |||
| 3156 | sfxcab.exe | C:\315be4067321fa5f011f\update\update_srv2k3.inf | ini | |
MD5:E9E84BBE54A5CA1201F8D14D8E138A55 | SHA256:AD5F36562D8EF222AC97404ED9C2A6716389537831580608D3D1D65766A1B0F9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report