download:

/files/dbfmanager.msi

Full analysis: https://app.any.run/tasks/fa5736ba-2eb2-477c-9e28-f195a10339c8
Verdict: Malicious activity
Analysis date: May 14, 2024, 13:50:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: DBF Manager Installer, Author: Astersoft Co., Keywords: dbf, dbf manager, dbf viewer, dbf editor, database, Comments: This installer database contains the logic and data required to install DBF Manager., Template: Intel;0, Revision Number: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}, Create Time/Date: Thu Mar 21 15:59:50 2024, Last Saved Time/Date: Thu Mar 21 15:59:50 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

3A4D074B6940D865C4BDC3C4A1CE5261

SHA1:

4943B94F4FA9EF9572C48B75F47C766FF271D17E

SHA256:

8CEB316C8E1EAE5774AAE7A534C7F971D62533A0162F922719510BC3C3F2B791

SSDEEP:

98304:MRIppn5taeedwicvqKgQQ72CYu2R78EBm8zv+wt+BRgIJNcET/c81uvrK9unZfVk:/Ao3RiKAlbm5TwIPFk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3976)
      • msiexec.exe (PID: 4012)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4012)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4060)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Checks supported languages

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4012)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4012)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4012)

    • Manual execution by a user

      • DBFManager.exe (PID: 1132)

    • Reads Environment values

      • DBFManager.exe (PID: 1132)

    • Reads Microsoft Office registry keys

      • DBFManager.exe (PID: 1132)

    • Reads product name

      • DBFManager.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: DBF Manager Installer
Author: Astersoft Co.
Keywords: dbf, dbf manager, dbf viewer, dbf editor, database
Comments: This installer database contains the logic and data required to install DBF Manager.
Template: Intel;0
RevisionNumber: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}
CreateDate: 2024:03:21 15:59:50
ModifyDate: 2024:03:21 15:59:50
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs dbfmanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\Program Files\DBF Manager\DBFManager.exe" C:\Program Files\DBF Manager\DBFManager.exe—explorer.exe
User:
admin
Company:
Astersoft Co.
Integrity Level:
MEDIUM
Description:
DBF file manager
Version:
3.12.321.0
Modules
Images
c:\program files\dbf manager\dbfmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\winmm.dll
3976"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\dbfmanager.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4012C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4060C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 615
Read events
5 357
Write events
246
Delete events
12

Modification events

(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000026F1C9BE05A6DA01AC0F0000D40F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000008053CCBE05A6DA01AC0F0000F0020000E8030000010000000000000000000000299CF54F18D3A5418AB21FB869BEFE3F0000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000F0070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E80F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000FC070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E40F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
40000000000000008E7AD3BE05A6DA01DC0F0000E40F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
15
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4012msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{4ff59c29-d318-41a5-8ab2-1fb869befe3f}_OnDiskSnapshotProp —
MD5:—
SHA256:—
4012msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b5.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b8.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\Program Files\DBF Manager\license.txttext
MD5:DD63DD65752613FB5322256BFC3C451D
SHA256:AA6EA8691049A075838B2B684506AD9A0D385DECE9E826246D170E7D318D1373
4012msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DBF Manager\DBF Manager Help.lnklnk
MD5:95E69F7238F2B82A598FD62DA206FE96
SHA256:B9A2F6753347158213A5C38740D0C130E1CD39CD2148EA86A438D267688E814D
4012msiexec.exeC:\Windows\Installer\1074b6.ipibinary
MD5:77673E2BF196D2D4ABC5FD0739F9E93A
SHA256:C04E67DE1508D6BB5A76E2B761B05B4296BCCE61F12190064E185FD35C83C981
4012msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFEF92E7C340E023DA.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
4012msiexec.exeC:\Program Files\DBF Manager\File_id.diztext
MD5:75475E465B4800AF3B5B8EA36222BC81
SHA256:DA20745F9264D9349AA38B9FABD8EB6914ECA364FA6456DB8995388824A04606
4012msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:951CB0841C554EC39C8DB9D609449509
SHA256:0F6AA1645E73E40AFA2A0A46BD2B66B380B1379E8261D2E46BD17E1D0E3B4351
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/files/dbfmanager.msi