analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FileZilla_3.41.2_win32-setup.exe

Full analysis: https://app.any.run/tasks/61f294dc-b488-480f-86bd-496f41fab18a
Verdict: Malicious activity
Analysis date: April 25, 2019, 08:13:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7DBAF343FE6760E1C3D8780B0EB6DE2D

SHA1:

6E9F3924F786590AC7E5105A24A3383E40F3821B

SHA256:

7CD3F0E7DCDC432BE381B6B373393D38BBFFCC25BC1EF88FFA2C898348A833F6

SSDEEP:

196608:r4j/Lh/gK+Hz7Y/z7G8ckx1uFWKOZa1U0senZ0tY:ro4K+HwO8BCOQ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • uninstall.exe (PID: 3828)
      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
      • FileZilla_3.41.2_win32-setup.exe (PID: 2736)
    • Changes the autorun value in the registry

      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
  • SUSPICIOUS

    • Creates files in the program directory

      • uninstall.exe (PID: 3828)
      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
    • Executable content was dropped or overwritten

      • FileZilla_3.41.2_win32-setup.exe (PID: 2736)
      • uninstall.exe (PID: 3828)
      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
    • Application launched itself

      • FileZilla_3.41.2_win32-setup.exe (PID: 2736)
    • Creates a software uninstall entry

      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • FileZilla_3.41.2_win32-setup.exe (PID: 644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 22:50:48+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x344a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.41.2.0
ProductVersionNumber: 3.41.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.41.2
LegalCopyright: Tim Kosse
OriginalFileName: FileZilla_3.41.2_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.41.2

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2016 21:50:48
Detected languages:
  • English - United States
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.41.2
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.41.2_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.41.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 11-Dec-2016 21:50:48
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000061F1
0x00006200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47707
.rdata
0x00008000
0x000013A4
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.163
.data
0x0000A000
0x00020338
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.97456
.ndata
0x0002B000
0x00039000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00064000
0x0000A3A0
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.57287

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2963
1059
UNKNOWN
English - United States
RT_MANIFEST
2
3.69314
9640
UNKNOWN
English - United States
RT_ICON
3
5.16834
3752
UNKNOWN
English - United States
RT_ICON
4
4.66044
2216
UNKNOWN
English - United States
RT_ICON
5
2.91531
1384
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.63186
76
UNKNOWN
English - United States
RT_GROUP_ICON
104
2.70411
344
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start filezilla_3.41.2_win32-setup.exe filezilla_3.41.2_win32-setup.exe uninstall.exe

Process information

PID
CMD
Path
Indicators
Parent process
2736"C:\Users\admin\AppData\Local\Temp\FileZilla_3.41.2_win32-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.41.2_win32-setup.exe
explorer.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.41.2
644"C:\Users\admin\AppData\Local\Temp\FileZilla_3.41.2_win32-setup.exe" /UAC:50146 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_3.41.2_win32-setup.exe
FileZilla_3.41.2_win32-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.41.2
3828"C:\Program Files\FileZilla FTP Client\uninstall.exe" /frominstall /keepstartmenudir _?=C:\Program Files\FileZilla FTP ClientC:\Program Files\FileZilla FTP Client\uninstall.exe
FileZilla_3.41.2_win32-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.36.0
Total events
1 074
Read events
1 016
Write events
0
Delete events
0

Modification events

No data
Executable files
30
Suspicious files
0
Text files
691
Unknown types
63

Dropped files

PID
Process
Filename
Type
3828uninstall.exeC:\Users\admin\AppData\Local\Temp\nssAD65.tmp
MD5:
SHA256:
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzsftp.exeexecutable
MD5:B24E4338BC94F93258BD69414FE46A4F
SHA256:DF56BE518EB543A406EA60461C62C2C95B0368A83393146707EDA2EE49999CA2
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzputtygen.exeexecutable
MD5:DB6AAF091313D81335E3FE151AF3AA52
SHA256:8ECED76A72CC4792A079A56B21CC178B3211186166751549491A067794488E6A
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\NEWStext
MD5:0B73C1A18511EDE42F5E32CFE6EA9ABB
SHA256:B85B1E49C25B3249A0A7153D7835B35CC78F6FE839318D1C246E5967CA897E78
2736FileZilla_3.41.2_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nsh3A49.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\libnettle-6.dllexecutable
MD5:F757234A597CE7EE53B513C9D3202F3F
SHA256:FBC2D0CEEA13A6FD2F20B274614E3BD341B88505E25D2A45ED7C643C1EF88A40
3828uninstall.exeC:\Users\admin\AppData\Local\Temp\nshAD75.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
3828uninstall.exeC:\Users\admin\AppData\Local\Temp\nshAD75.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\filezilla.exeexecutable
MD5:5D5E3D408CCF2975A020CA47B408B648
SHA256:C167C4082F82C00F80CF9D87BF778B58E2A1906A41209DAFB6AD228AD8D21F98
644FileZilla_3.41.2_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzstorj.exeexecutable
MD5:AFDABAE188B37F61F5422ED4C8B84C83
SHA256:0482997768748C6FFD9B1E691601F728485FBD5E259DF5BFD7FF3B4AA8B1BED2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info