File name:

FlashFXP.5.4.0.Build.3970.zip

Full analysis: https://app.any.run/tasks/bb8e429c-9d21-42af-a67c-5869c5fcd9e8
Verdict: Malicious activity
Analysis date: February 17, 2024, 12:21:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

1EA66C5182E7162E64932DA6839534FD

SHA1:

11CD98CC6F54DF66BD84D551BA0F6D70B228F690

SHA256:

732ED851D5E1871017AD2A1903362B4F9B4C7CB35DF36AEEF29C5FE2AF9D51BA

SSDEEP:

98304:0OE44jmfQPZ+SmhsKKHuTWyg/FeUGCoJ21+j2CblStlCHyyBz8Nvy7o/9AolFFwm:3La4lTH0h3G3I/UWJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3240)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3240)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 2304)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • The process drops C-runtime libraries

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Process drops legitimate windows executable

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Drops 7-zip archiver for unpacking

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the Windows owner or organization settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • FlashFXP5_Setup.exe (PID: 116)

    • Checks Windows Trust Settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads settings of System Certificates

      • FlashFXP5_Setup.exe (PID: 116)

    • Adds/modifies Windows certificates

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the Internet Settings

      • FlashFXP5_Setup.exe (PID: 116)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3240)

    • Manual execution by a user

      • FlashFXP.5.4.0.Build.3970.exe (PID: 2304)
      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Checks supported languages

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)
      • FlashFXP5_Setup.exe (PID: 116)

    • Creates files in the program directory

      • FlashFXP.5.4.0.Build.3970.exe (PID: 3092)

    • Creates files or folders in the user directory

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the computer name

      • FlashFXP5_Setup.exe (PID: 116)

    • Create files in a temporary directory

      • FlashFXP5_Setup.exe (PID: 116)

    • Checks proxy server information

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the software policy settings

      • FlashFXP5_Setup.exe (PID: 116)

    • Reads the machine GUID from the registry

      • FlashFXP5_Setup.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:07:27 00:17:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: FlashFXP.5.4.0.Build.3970/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe flashfxp.5.4.0.build.3970.exe flashfxp.5.4.0.build.3970.exe flashfxp5_setup.exe

Process information

PID
CMD
Path
Indicators
Parent process
116.\FlashFXP5_Setup.exe /m="C:\Users\admin\Desktop\FLASHF~1.397\FLASHF~1.397\FLASHF~1.EXE" /k=""C:\ProgramData\mia9C6A.tmp\FlashFXP5_Setup.exe
FlashFXP.5.4.0.Build.3970.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
HIGH
Description:
FlashFXP Installation
Exit code:
0
Version:
5.4.0.3970
Modules
Images
c:\programdata\mia9c6a.tmp\flashfxp5_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2304"C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe" C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe
explorer.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
MEDIUM
Description:
FlashFXP Installation
Exit code:
3221226540
Version:
5.4.0.3970
Modules
Images
c:\users\admin\desktop\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970.exe
c:\windows\system32\ntdll.dll
3092"C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe" C:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exe
explorer.exe
User:
admin
Company:
OpenSight Software LLC
Integrity Level:
HIGH
Description:
FlashFXP Installation
Exit code:
0
Version:
5.4.0.3970
Modules
Images
c:\users\admin\desktop\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970\flashfxp.5.4.0.build.3970.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3240"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FlashFXP.5.4.0.Build.3970.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
10 807
Read events
10 741
Write events
54
Delete events
12

Modification events

(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3240) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\FlashFXP.5.4.0.Build.3970.zip
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
24
Suspicious files
20
Text files
44
Unknown types
2

Dropped files

PID
Process
Filename
Type
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\1E667D\D4E11C2F\Arabic.dlfini
MD5:9EEACD963D23A3F25573D40DDB9434B8
SHA256:7F214721446FAE34A1EB080453A62C8D20775342AC76E5AAC11FCE8CC5C3E610
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\KeyGen\Keygen.exeexecutable
MD5:25D30D13C66368C6E264631CD4D9F665
SHA256:3B0110B7FDD79ED3821FB96E7F8EAAC27DB893272D46EDAA3A8DD0F24B8E45D8
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\mia.libexecutable
MD5:6433337CCEBE784F043848124B1DB49D
SHA256:6C77E3A74EB284C44A540D792B9F7CD0F809ED49050984BD7160276158790B84
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\KeyGen\FFF.NFOtext
MD5:EC5CB51A4B46BC62D6CC75A32DC23851
SHA256:AC10EF5DAEF3F2D581B328B9050228335EE7CBE18D34F8552E41A4C0D077E030
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970.exeexecutable
MD5:8CD4B351244B15C40194185B2C804154
SHA256:631AE7074649A665D62AC6FC940D203EFF715C88B4B57EE46865286607909231
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\FlashFXP5_Setup.exeexecutable
MD5:F7071E5890CA24E4A70BD464864F73C5
SHA256:F853F133A483FDA5066D376C84AC589D20A7748D4BDBCC3C7F4D1666CFF15F3C
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\Readme.txttext
MD5:666D606831FF1D25584B7E773C396B92
SHA256:8700E068102CDCE988CE02DE81665F76F459779FE50DBF09EFEE051158233C2F
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\950043D6\68B78533\Sites.datini
MD5:1560183730415DA22317E2CED9E3E987
SHA256:2CFBD182FB7CE2BA1F64AF21A7C576C7CC51B12677A7D38661E06A9F390A414C
3240WinRAR.exeC:\Users\admin\Desktop\FlashFXP.5.4.0.Build.3970\FlashFXP.5.4.0.Build.3970\Patch\patch.exeexecutable
MD5:3FB257D56FA1BB87E01792B9BB342DF4
SHA256:9F14B237218E7A422ED1FF6BD1805F03ABF3E0B81AE83CF7C238799DCA6D1F2C
3092FlashFXP.5.4.0.Build.3970.exeC:\ProgramData\mia9C6A.tmp\data\OFFLINE\F5F53788\68B78533\IEFlash.dllexecutable
MD5:8A7F6277412DE46264D66AB7364D0DE8
SHA256:B52C800421C9CEB29816B29D76A69F71B5439BCFC442875AA94A1F1B19DFEFEE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
FlashFXP5_Setup.exe
GET
200
23.32.238.195:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a65c765d39622c71
unknown
compressed
65.2 Kb
unknown
116
FlashFXP5_Setup.exe
GET
304
23.32.238.195:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?782ac2fdb72cf1b4
unknown
—
—
unknown
116
FlashFXP5_Setup.exe
GET
200
23.192.153.142:80
http://x2.c.lencr.org/
unknown
binary
299 b
unknown
116
FlashFXP5_Setup.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
116
FlashFXP5_Setup.exe
172.67.133.170:443
app.flashfxp.com
CLOUDFLARENET
US
unknown
116
FlashFXP5_Setup.exe
23.32.238.195:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
116
FlashFXP5_Setup.exe
23.192.153.142:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown

DNS requests

Domain
IP
Reputation
app.flashfxp.com
  • 172.67.133.170
  • 104.21.5.173
unknown
ctldl.windowsupdate.com
  • 23.32.238.195
  • 23.32.238.240
  • 23.32.238.176
  • 23.32.238.201
  • 23.32.238.226
  • 23.32.238.169
  • 23.32.238.179
  • 23.32.238.218
  • 23.32.238.192
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
x2.c.lencr.org
  • 23.192.153.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FlashFXP.5.4.0.Build.3970.zip