analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FileZilla_3.28.0_win32-setup.exe

Full analysis: https://app.any.run/tasks/b8bb0dee-cc6a-4b06-a05b-1a1f8f5ada45
Verdict: Malicious activity
Analysis date: November 15, 2018, 14:57:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

65AD6DCA4B4207EC976B6E6BDC655ED4

SHA1:

B9804B2A6629EB953FDE9DDC1F1CD0BF0BB656C4

SHA256:

803B12F05A9F071518758893D5A33CF109923EE962F86EBAC22532D679320301

SSDEEP:

196608:1lwOR38eP3habG+y6kJtJKzZqtKlH2aGpkG/1Q1nVbHAZQr:1PRd16kWuS2aGrtQdEQr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • filezilla.exe (PID: 3472)
    • Loads dropped or rewritten executable

      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
      • FileZilla_3.28.0_win32-setup.exe (PID: 3352)
    • Changes the autorun value in the registry

      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FileZilla_3.28.0_win32-setup.exe (PID: 3352)
      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
    • Application launched itself

      • FileZilla_3.28.0_win32-setup.exe (PID: 3352)
    • Creates files in the program directory

      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
    • Creates files in the user directory

      • filezilla.exe (PID: 3472)
    • Creates a software uninstall entry

      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • FileZilla_3.28.0_win32-setup.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 22:50:48+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x344a
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.28.0.0
ProductVersionNumber: 3.28.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.28.0
LegalCopyright: Tim Kosse
OriginalFileName: FileZilla_3.28.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.28.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2016 21:50:48
Detected languages:
  • English - United States
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.28.0
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.28.0_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.28.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 11-Dec-2016 21:50:48
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000061F1
0x00006200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47707
.rdata
0x00008000
0x000013A4
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.163
.data
0x0000A000
0x00020338
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.97456
.ndata
0x0002B000
0x00039000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00064000
0x0000A3A0
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.57261

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2963
1059
UNKNOWN
English - United States
RT_MANIFEST
2
3.69314
9640
UNKNOWN
English - United States
RT_ICON
3
5.16834
3752
UNKNOWN
English - United States
RT_ICON
4
4.66044
2216
UNKNOWN
English - United States
RT_ICON
5
2.91531
1384
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.63186
76
UNKNOWN
English - United States
RT_GROUP_ICON
104
2.70411
344
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_3.28.0_win32-setup.exe filezilla_3.28.0_win32-setup.exe filezilla.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3352"C:\Users\admin\AppData\Local\Temp\FileZilla_3.28.0_win32-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.28.0_win32-setup.exe
explorer.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.28.0
3956"C:\Users\admin\AppData\Local\Temp\FileZilla_3.28.0_win32-setup.exe" /UAC:30136 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_3.28.0_win32-setup.exe
FileZilla_3.28.0_win32-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.28.0
3472"C:\Program Files\FileZilla FTP Client\filezilla.exe" C:\Program Files\FileZilla FTP Client\filezilla.exeexplorer.exe
User:
admin
Company:
FileZilla Project
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3, 28, 0, 0
Total events
1 073
Read events
1 037
Write events
36
Delete events
0

Modification events

(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla Client
Operation:writeName:
Value:
C:\Program Files\FileZilla FTP Client
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla Client
Operation:writeName:Version
Value:
3.28.0
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla Client
Operation:writeName:Package
Value:
1
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla Client
Operation:writeName:Updated
Value:
0
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:UninstallString
Value:
C:\Program Files\FileZilla FTP Client\uninstall.exe
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:InstallLocation
Value:
C:\Program Files\FileZilla FTP Client
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:DisplayName
Value:
FileZilla Client 3.28.0
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:DisplayIcon
Value:
C:\Program Files\FileZilla FTP Client\FileZilla.exe
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:DisplayVersion
Value:
3.28.0
(PID) Process:(3956) FileZilla_3.28.0_win32-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client
Operation:writeName:URLInfoAbout
Value:
https://filezilla-project.org/
Executable files
16
Suspicious files
0
Text files
693
Unknown types
63

Dropped files

PID
Process
Filename
Type
3956FileZilla_3.28.0_win32-setup.exeC:\Program Files\FileZilla FTP Client\NEWStext
MD5:0845688F7EECEE0C386C30E0EA53F1C8
SHA256:5A17115836B5BF0F4D9D667C1022F77476366572F058216126187F3B5A55BD05
3956FileZilla_3.28.0_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzputtygen.exeexecutable
MD5:BE74C7B1C7F8617A327F6BB1A9EFDCEC
SHA256:77234A7695E67E3808FA97CA99D98133164EFD50DCF2446D490C241B2F4FCF0D
3956FileZilla_3.28.0_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzsftp.exeexecutable
MD5:E79E202489FADC5E7B9C3E7FEE54A908
SHA256:6DB9F13A6C2F6D5A0F534ECF84F35DD193D0E892767367FF89C3713F816BE61D
3956FileZilla_3.28.0_win32-setup.exeC:\Program Files\FileZilla FTP Client\filezilla.exeexecutable
MD5:C36319931DE0DE5F11C00E521C7718CF
SHA256:D62C16E4B38229F41F5E749B4E1B7E9F31C952BBDB14B251A10992C7CD0F51DD
3956FileZilla_3.28.0_win32-setup.exeC:\Program Files\FileZilla FTP Client\fzstorj.exeexecutable
MD5:F17CF30721E9BC5F574FF98DCE5E46E2
SHA256:2BA5123A0D8BCE36E2721A1549532AEF20C1474EB91321035304E31CF5061879
3956FileZilla_3.28.0_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nswA200.tmp\nsDialogs.dllexecutable
MD5:42B064366F780C1F298FA3CB3AEAE260
SHA256:C13104552B8B553159F50F6E2CA45114493397A6FA4BF2CBB960C4A2BBD349AB
3956FileZilla_3.28.0_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nswA200.tmp\UserInfo.dllexecutable
MD5:1B446B36F5B4022D50FFDC0CF567B24A
SHA256:2862C7BC7F11715CEBDEA003564A0D70BF42B73451E2B672110E1392EC392922
3956FileZilla_3.28.0_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nswA200.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
3352FileZilla_3.28.0_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nsp9CB1.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
3956FileZilla_3.28.0_win32-setup.exeC:\Users\admin\AppData\Local\Temp\nswA200.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info