File name:

FileZilla_3.63.1_win64_sponsored2-setup.exe

Full analysis: https://app.any.run/tasks/a80706f2-6fb8-41fa-824e-d0b757765298
Verdict: Malicious activity
Analysis date: January 26, 2023, 16:12:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

E76D62E6424B09D4B0C465EBEFAC562B

SHA1:

D5E74A8B291CAABDF5A0ACC01DEB249E41F82438

SHA256:

83FBC36CBE82C1D0F622D2727929C7A9EC9200020DFB34297C957F6C89DC9458

SSDEEP:

196608:uykipgsyG7DrrkczVlTP7MR+vJsZ6fiOqScy4YftV6tKysiPch2NLWIs1J:uykm3froOTP7M8BswfiONV6AXCSIsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Loads dropped or rewritten executable

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Application launched itself

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)

    • Executable content was dropped or overwritten

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Searches for installed software

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)

    • Drops a file with too old compile date

      • uninstall.exe (PID: 2844)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)

    • Creates a software uninstall entry

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)

  • INFO

    • Checks supported languages

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • The process checks LSA protection

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Reads the computer name

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Create files in a temporary directory

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 1580)
      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
      • uninstall.exe (PID: 2844)

    • Dropped object may contain Bitcoin addresses

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)

    • Manual execution by a user

      • WINWORD.EXE (PID: 2744)

    • Creates files in the program directory

      • FileZilla_3.63.1_win64_sponsored2-setup.exe (PID: 3644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2020-Aug-01 02:44:18
Detected languages:
  • English - United States
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.63.1
LegalCopyright: Tim Kosse
OriginalFilename: FileZilla_3.63.1_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.63.1

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2020-Aug-01 02:44:18
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
25970
26112
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45392
.rdata
32768
5016
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13672
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.09681
.ndata
176128
286720
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
462848
41888
41984
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.57367

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.97032
18525
UNKNOWN
English - United States
RT_ICON
2
3.69314
9640
UNKNOWN
English - United States
RT_ICON
3
5.16834
3752
UNKNOWN
English - United States
RT_ICON
4
4.66044
2216
UNKNOWN
English - United States
RT_ICON
5
2.91531
1384
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.56193
288
UNKNOWN
English - United States
RT_DIALOG
104
2.70411
344
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_3.63.1_win64_sponsored2-setup.exe filezilla_3.63.1_win64_sponsored2-setup.exe uninstall.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1580"C:\Users\admin\AppData\Local\Temp\FileZilla_3.63.1_win64_sponsored2-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.63.1_win64_sponsored2-setup.exe
Explorer.EXE
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.63.1
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\filezilla_3.63.1_win64_sponsored2-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
2744"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\advancelimited.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2844"C:\Program Files\FileZilla FTP Client\uninstall.exe" /frominstall /keepstartmenudir _?=C:\Program Files\FileZilla FTP ClientC:\Program Files\FileZilla FTP Client\uninstall.exe
FileZilla_3.63.1_win64_sponsored2-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.51.0
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\filezilla ftp client\uninstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3644"C:\Users\admin\AppData\Local\Temp\FileZilla_3.63.1_win64_sponsored2-setup.exe" /UAC:60150 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_3.63.1_win64_sponsored2-setup.exe
FileZilla_3.63.1_win64_sponsored2-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.63.1
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_3.63.1_win64_sponsored2-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
10 778
Read events
9 266
Write events
1 194
Delete events
318

Modification events

(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}\InProcServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla 3\fzshellext
Operation:delete valueName:Enable
Value:
1
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla 3\fzshellext
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\FileZilla 3
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
102
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
103
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
104
(PID) Process:(2844) uninstall.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nssA7FB.tmp
Executable files
71
Suspicious files
230
Text files
1 372
Unknown types
32

Dropped files

PID
Process
Filename
Type
1580FileZilla_3.63.1_win64_sponsored2-setup.exeC:\Users\admin\AppData\Local\Temp\nslFED9.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nssA7AB.tmpbinary
MD5:6BC4A8D48B7247DDB3A81FB363E967B8
SHA256:6D601EBBFA6448DB2020162BFD871D78691EB87F5FA671207A41B954068DA2D9
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nssA7FB.tmpexecutable
MD5:BDF1B2DBB71DCA816359EB00ED4D71BF
SHA256:53A08C4A44C7275DE8B5DF6D726BE3D5C5F3475D09367E1EA571C148C005B76B
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nsiA7BC.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3644FileZilla_3.63.1_win64_sponsored2-setup.exeC:\Users\admin\AppData\Local\Temp\nsq4866.tmp\nsDialogs.dllexecutable
MD5:48F3E7860E1DE2B4E63EC744A5E9582A
SHA256:6BF9CCCD8A600F4D442EFE201E8C07B49605BA35F49A4B3AB22FA2641748E156
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nsiA7BC.tmp\UserInfo.dllexecutable
MD5:9EB662F3B5FBDA28BFFE020E0AB40519
SHA256:9AA388C7DE8E96885ADCB4325AF871B470AC50EDB60D4B0D876AD43F5332FFD1
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nsiA7BC.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2844uninstall.exeC:\Users\admin\AppData\Local\Temp\nsiA7BC.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
3644FileZilla_3.63.1_win64_sponsored2-setup.exeC:\Users\admin\AppData\Local\Temp\nsq4866.tmp\UserInfo.dllexecutable
MD5:98FF85B635D9114A9F6A0CD7B9B649D0
SHA256:933F93A30CE44DF96CBC4AC0B56A8B02EE01DA27E4EA665D1D846357A8FCA8DE
3644FileZilla_3.63.1_win64_sponsored2-setup.exeC:\Program Files\FileZilla FTP Client\AUTHORStext
MD5:6C0F745DF851F8C4D10E1789BFD19FF4
SHA256:45F98D3DD4A9C7CF58D302E00EBB69A411C120FC4160E04304780DB03DFC2265
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FileZilla_3.63.1_win64_sponsored2-setup.exe