download:

/files/dbfmanager.msi

Full analysis: https://app.any.run/tasks/fa5736ba-2eb2-477c-9e28-f195a10339c8
Verdict: Malicious activity
Analysis date: May 14, 2024, 13:50:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: DBF Manager Installer, Author: Astersoft Co., Keywords: dbf, dbf manager, dbf viewer, dbf editor, database, Comments: This installer database contains the logic and data required to install DBF Manager., Template: Intel;0, Revision Number: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}, Create Time/Date: Thu Mar 21 15:59:50 2024, Last Saved Time/Date: Thu Mar 21 15:59:50 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

3A4D074B6940D865C4BDC3C4A1CE5261

SHA1:

4943B94F4FA9EF9572C48B75F47C766FF271D17E

SHA256:

8CEB316C8E1EAE5774AAE7A534C7F971D62533A0162F922719510BC3C3F2B791

SSDEEP:

98304:MRIppn5taeedwicvqKgQQ72CYu2R78EBm8zv+wt+BRgIJNcET/c81uvrK9unZfVk:/Ao3RiKAlbm5TwIPFk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3976)
      • msiexec.exe (PID: 4012)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 4060)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4012)

  • INFO

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4012)

    • Checks supported languages

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Reads the computer name

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4012)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4012)

    • Manual execution by a user

      • DBFManager.exe (PID: 1132)

    • Reads Microsoft Office registry keys

      • DBFManager.exe (PID: 1132)

    • Reads Environment values

      • DBFManager.exe (PID: 1132)

    • Reads product name

      • DBFManager.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: DBF Manager Installer
Author: Astersoft Co.
Keywords: dbf, dbf manager, dbf viewer, dbf editor, database
Comments: This installer database contains the logic and data required to install DBF Manager.
Template: Intel;0
RevisionNumber: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}
CreateDate: 2024:03:21 15:59:50
ModifyDate: 2024:03:21 15:59:50
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs dbfmanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\Program Files\DBF Manager\DBFManager.exe" C:\Program Files\DBF Manager\DBFManager.exe—explorer.exe
User:
admin
Company:
Astersoft Co.
Integrity Level:
MEDIUM
Description:
DBF file manager
Version:
3.12.321.0
Modules
Images
c:\program files\dbf manager\dbfmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\winmm.dll
3976"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\dbfmanager.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4012C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4060C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 615
Read events
5 357
Write events
246
Delete events
12

Modification events

(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000026F1C9BE05A6DA01AC0F0000D40F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000008053CCBE05A6DA01AC0F0000F0020000E8030000010000000000000000000000299CF54F18D3A5418AB21FB869BEFE3F0000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000F0070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E80F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000FC070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E40F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
40000000000000008E7AD3BE05A6DA01DC0F0000E40F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
15
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4012msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{4ff59c29-d318-41a5-8ab2-1fb869befe3f}_OnDiskSnapshotProp —
MD5:—
SHA256:—
4012msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b5.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b8.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:951CB0841C554EC39C8DB9D609449509
SHA256:0F6AA1645E73E40AFA2A0A46BD2B66B380B1379E8261D2E46BD17E1D0E3B4351
4012msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF309739735B24204F.TMPbinary
MD5:E64C300B923B170CF50B1A06EDACC6DD
SHA256:9CE58DB8E489B28393EC9FA45A9F6EE4E23F81298833F788FFB1F24BAB4384C6
4012msiexec.exeC:\Program Files\DBF Manager\license.txttext
MD5:DD63DD65752613FB5322256BFC3C451D
SHA256:AA6EA8691049A075838B2B684506AD9A0D385DECE9E826246D170E7D318D1373
4012msiexec.exeC:\Windows\Installer\MSI7CA4.tmpbinary
MD5:31CB499AC0E3F88F93CA12DC95C8F899
SHA256:1C7AC0ADA2F5B14FE8E98729D4945D0CFBB7A8EEE95FA1688F2427860080E057
4012msiexec.exeC:\Windows\Installer\1074b6.ipibinary
MD5:77673E2BF196D2D4ABC5FD0739F9E93A
SHA256:C04E67DE1508D6BB5A76E2B761B05B4296BCCE61F12190064E185FD35C83C981
4012msiexec.exeC:\Program Files\DBF Manager\DBFManager.exeexecutable
MD5:99361A4D64D12B1FC514578418629890
SHA256:C8765C854B092D1737D7C33273CCB6BFAF56C6AE2FD5508EA4BBC11231C7452F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/files/dbfmanager.msi