File name:

FlashFXP.5.4.0.Build.3970.zip

Full analysis: https://app.any.run/tasks/bb8e429c-9d21-42af-a67c-5869c5fcd9e8
Verdict: Malicious activity
Analysis date: February 17, 2024, 12:21:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

1EA66C5182E7162E64932DA6839534FD

SHA1:

11CD98CC6F54DF66BD84D551BA0F6D70B228F690

SHA256:

732ED851D5E1871017AD2A1903362B4F9B4C7CB35DF36AEEF29C5FE2AF9D51BA

SSDEEP:

98304:0OE44jmfQPZ+SmhsKKHuTWyg/FeUGCoJ21+j2CblStlCHyyBz8Nvy7o/9AolFFwm:3La4lTH0h3G3I/UWJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • FlashFXP.5.4.0.Build.3970.exe (PID: 2304)
      • WinRAR.exe (PID: 3240)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3240)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • The process drops C-runtime libraries

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Process drops legitimate windows executable

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Drops 7-zip archiver for unpacking

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the Windows owner or organization settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Checks Windows Trust Settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the Internet Settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads settings of System Certificates

      • FlashFXP5_Setup.exe (PID: 116)

    • Adds/modifies Windows certificates

      • FlashFXP5_Setup.exe (PID: 116)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3240)

    • Checks supported languages

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • Manual execution by a user

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 2304)

    • Creates files in the program directory

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Reads the computer name

      • FlashFXP5_Setup.exe (PID: 116)

    • Creates files or folders in the user directory

      • FlashFXP5_Setup.exe (PID: 116)

    • Create files in a temporary directory

      • FlashFXP5_Setup.exe (PID: 116)

    • Checks proxy server information

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the machine GUID from the registry

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the software policy settings

      • FlashFXP5_Setup.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:07:27 00:17:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: FlashFXP.5.4.0.Build.3970/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe flashfxp.5.4.0.build.3970.exe flashfxp.5.4.0.build.3970.exe flashfxp5_setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
116.\FlashFXP5_Setup.exe /m="C:\Users\admin\Desktop\FLASHF~1.397\FLASHF~1.397\FLASHF~1.EXE" /k=""C:\ProgramData\mia9C6A.tmp\FlashFXP5_Setup.exe
FlashFXP.5.4.0.Build.3970.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
HIGH
Description:
FlashFXP Installation
Exit code:
0
Version:
5.4.0.3970
Modules
Images
c:\programdata\mia9c6a.tmp\flashfxp5_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2304"C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe" C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe
explorer.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
MEDIUM
Description:
FlashFXP Installation
Exit code:
3221226540
Version:
5.4.0.3970
Modules
Images
c:\users\admin\desktop\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970.exe
c:\windows\system32\ntdll.dll
3092"C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe" C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe
explorer.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
HIGH
Description:
FlashFXP Installation
Exit code:
0
Version:
5.4.0.3970
Modules
Images
c:\users\admin\desktop\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3240"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FlashFXP.5.4.0.Build.3970.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
10 807
Read events
10 741
Write events
54
Delete events
12

Modification events

(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3240) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\FlashFXP.5.4.0.Build.3970.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
24
Suspicious files
20
Text files
44
Unknown types
2

Dropped files

PID
Process
Filename
Type
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exeexecutable
MD5:8CD4B351244B15C40194185B2C804154
SHA256:631AE7074649A665D62AC6FC940D203EFF715C88B4B57EE46865286607909231
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\KeyGen\FFF.NFOtext
MD5:EC5CB51A4B46BC62D6CC75A32DC23851
SHA256:AC10EF5DAEF3F2D581B328B9050228335EE7CBE18D34F8552E41A4C0D077E030
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\Readme.txttext
MD5:666D606831FF1D25584B7E773C396B92
SHA256:8700E068102CDCE988CE02DE81665F76F459779FE50DBF09EFEE051158233C2F
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\567099BD\68B78533\libeay32.dllexecutable
MD5:EC378CBB7E8A2BCF317A2280AF3ED16A
SHA256:17989AD9AC232405870502A4F81C66F8D845729960D2A056E112C884B53A69E9
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\mDown.dll\mDownExec.dllexecutable
MD5:5995C017D5F8880B204D74529D9EDDFC
SHA256:4E5879E61101419D6DC2C235F094C4708F13E61D81EAB1C49B300D400C7449BC
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\AF05CD28\68B78533\libcrypto-1_1.dllexecutable
MD5:9FD7C07BE92476F8E925F51E03CCE20C
SHA256:57E1E17D63EFC7B46D051D0267F8A01B52B9A649684BCF9C2809E18F98F7A473
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\1E667D\D4E11C2F\Arabic.dlfini
MD5:9EEACD963D23A3F25573D40DDB9434B8
SHA256:7F214721446FAE34A1EB080453A62C8D20775342AC76E5AAC11FCE8CC5C3E610
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\F67723E8\68B78533\ssleay32.dllexecutable
MD5:72569C5F0360F4CD6AFEA02444E67EE4
SHA256:272B6B3D5155614ED87FBD1F20267CFD2286D57230F7ED25835A4DE076E13D67
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\mIDEFunc.dll\mEXEFunc.dllexecutable
MD5:B94F4B9790F50FE13961F2ADDE9FD23B
SHA256:EB6C4A273B5C7A19172A90DF5271BBD3B91FB425E8182E3FC63934255E1680F2
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\mia.libexecutable
MD5:6433337CCEBE784F043848124B1DB49D
SHA256:6C77E3A74EB284C44A540D792B9F7CD0F809ED49050984BD7160276158790B84
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
FlashFXP5_Setup.exe
GET
304
23.32.238.195:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?782ac2fdb72cf1b4
unknown
—
—
unknown
116
FlashFXP5_Setup.exe
GET
200
23.32.238.195:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a65c765d39622c71
unknown
compressed
65.2 Kb
unknown
116
FlashFXP5_Setup.exe
GET
200
23.192.153.142:80
http://x2.c.lencr.org/
unknown
binary
299 b
unknown
116
FlashFXP5_Setup.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
116
FlashFXP5_Setup.exe
172.67.133.170:443
app.flashfxp.com
CLOUDFLARENET
US
unknown
116
FlashFXP5_Setup.exe
23.32.238.195:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
116
FlashFXP5_Setup.exe
23.192.153.142:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown

DNS requests

Domain
IP
Reputation
app.flashfxp.com
  • 172.67.133.170
  • 104.21.5.173
unknown
ctldl.windowsupdate.com
  • 23.32.238.195
  • 23.32.238.240
  • 23.32.238.176
  • 23.32.238.201
  • 23.32.238.226
  • 23.32.238.169
  • 23.32.238.179
  • 23.32.238.218
  • 23.32.238.192
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
x2.c.lencr.org
  • 23.192.153.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FlashFXP.5.4.0.Build.3970.zip