download:

/files/dbfmanager.msi

Full analysis: https://app.any.run/tasks/fa5736ba-2eb2-477c-9e28-f195a10339c8
Verdict: Malicious activity
Analysis date: May 14, 2024, 13:50:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: DBF Manager Installer, Author: Astersoft Co., Keywords: dbf, dbf manager, dbf viewer, dbf editor, database, Comments: This installer database contains the logic and data required to install DBF Manager., Template: Intel;0, Revision Number: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}, Create Time/Date: Thu Mar 21 15:59:50 2024, Last Saved Time/Date: Thu Mar 21 15:59:50 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

3A4D074B6940D865C4BDC3C4A1CE5261

SHA1:

4943B94F4FA9EF9572C48B75F47C766FF271D17E

SHA256:

8CEB316C8E1EAE5774AAE7A534C7F971D62533A0162F922719510BC3C3F2B791

SSDEEP:

98304:MRIppn5taeedwicvqKgQQ72CYu2R78EBm8zv+wt+BRgIJNcET/c81uvrK9unZfVk:/Ao3RiKAlbm5TwIPFk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3976)
      • msiexec.exe (PID: 4012)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 4060)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4012)

  • INFO

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4012)

    • Reads the computer name

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4012)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4012)

    • Checks supported languages

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Create files in a temporary directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 4012)
      • DBFManager.exe (PID: 1132)

    • Manual execution by a user

      • DBFManager.exe (PID: 1132)

    • Reads Microsoft Office registry keys

      • DBFManager.exe (PID: 1132)

    • Reads Environment values

      • DBFManager.exe (PID: 1132)

    • Reads product name

      • DBFManager.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: DBF Manager Installer
Author: Astersoft Co.
Keywords: dbf, dbf manager, dbf viewer, dbf editor, database
Comments: This installer database contains the logic and data required to install DBF Manager.
Template: Intel;0
RevisionNumber: {2F910C44-FA20-47C3-A796-4D4ED6F894F5}
CreateDate: 2024:03:21 15:59:50
ModifyDate: 2024:03:21 15:59:50
Pages: 200
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs dbfmanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\Program Files\DBF Manager\DBFManager.exe" C:\Program Files\DBF Manager\DBFManager.exe—explorer.exe
User:
admin
Company:
Astersoft Co.
Integrity Level:
MEDIUM
Description:
DBF file manager
Version:
3.12.321.0
Modules
Images
c:\program files\dbf manager\dbfmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\winmm.dll
3976"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\dbfmanager.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4012C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4060C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 615
Read events
5 357
Write events
246
Delete events
12

Modification events

(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000003ED127BE05A6DA01AC0F0000D40F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000026F1C9BE05A6DA01AC0F0000D40F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4012) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000008053CCBE05A6DA01AC0F0000F0020000E8030000010000000000000000000000299CF54F18D3A5418AB21FB869BEFE3F0000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000F0070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E80F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000FC070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003418D1BE05A6DA01DC0F0000E40F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4060) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
40000000000000008E7AD3BE05A6DA01DC0F0000E40F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
15
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4012msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{4ff59c29-d318-41a5-8ab2-1fb869befe3f}_OnDiskSnapshotProp —
MD5:—
SHA256:—
4012msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b5.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\Windows\Installer\1074b8.msi —
MD5:—
SHA256:—
4012msiexec.exeC:\Program Files\DBF Manager\Readme.txttext
MD5:854D541EBE5F63275E3B08C492ABB80B
SHA256:581E4432B1D9E1A27E33DCD4AE3AB9CA965853C1D614E05E2D712AB463E25D82
4012msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DBF Manager\DBF Manager.lnklnk
MD5:0D37A0806028A875F59B3BDB4DEE948A
SHA256:9C499EE96881C0C0E039923D94E51D59D73BC08BC8D1234AB732EE277E2D7C9E
4012msiexec.exeC:\Program Files\DBF Manager\File_id.diztext
MD5:75475E465B4800AF3B5B8EA36222BC81
SHA256:DA20745F9264D9349AA38B9FABD8EB6914ECA364FA6456DB8995388824A04606
4012msiexec.exeC:\Program Files\DBF Manager\Homepage.urlurl
MD5:F979A0F9D535DA25B3D6C63B7668E874
SHA256:8EF46B94A89CB0A592411026993C646B4D1705A4A5E58E85A4FADB96DAD00889
4012msiexec.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DBF Manager\Homepage.lnklnk
MD5:C15A55E17324B1E497BE89A95A378EAB
SHA256:8432E6A46BD3ED95DA7471E1CEB449514C534F9F043F6E1F9D9CF536E4A2BE1B
4012msiexec.exeC:\Program Files\DBF Manager\dbfmanager.chmbinary
MD5:BACFDE1FA525FEFEA4F759C3AC15F1F2
SHA256:4254B1627EC034B0E875474DE26D6F4F8842BCFADB7CA9381D1DC8BB42AEA1D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/files/dbfmanager.msi