File name: | KeePass-2.40-Setup.exe |
Full analysis: | https://app.any.run/tasks/00368cf8-ceaf-4106-839e-93bc1ad39698 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2019, 16:09:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 351D9EF64047F792AEE0520FFD27A78A |
SHA1: | BE51F0C2E0C193AC212F63D31C7832138B02BDBD |
SHA256: | B166694232668792A8D5B63DD990711FE683B7899433DFF0B4C8796457035B36 |
SSDEEP: | 49152:fT0HRJj+XCmxootSBtvORFi52Z+EzEWILoTjD4FaHrImryx4qRM79bq0GJyFaa:L0Pj+VxuWq2Z3ImDZrInhW9bvGJyca |
.exe | | | Win32 Executable Delphi generic (45.2) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (20.9) |
.exe | | | Win32 Executable (generic) (14.3) |
.exe | | | Win16/32 Executable Delphi generic (6.6) |
.exe | | | Generic Win/DOS Executable (6.3) |
ProductVersion: | 2.40 |
---|---|
ProductName: | KeePass Password Safe |
LegalCopyright: | Copyright (c) 2003-2018 Dominik Reichl |
FileVersion: | 2.40.0.0 |
FileDescription: | KeePass Password Safe 2.40 Setup |
CompanyName: | Dominik Reichl |
Comments: | This installation was built with Inno Setup. |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 2.40.0.0 |
FileVersionNumber: | 2.40.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | 6 |
OSVersion: | 5 |
EntryPoint: | 0x1181c |
UninitializedDataSize: | - |
InitializedDataSize: | 53760 |
CodeSize: | 66560 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
TimeStamp: | 2018:06:14 15:27:46+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 14-Jun-2018 13:27:46 |
Detected languages: |
|
Comments: | This installation was built with Inno Setup. |
CompanyName: | Dominik Reichl |
FileDescription: | KeePass Password Safe 2.40 Setup |
FileVersion: | 2.40.0.0 |
LegalCopyright: | Copyright (c) 2003-2018 Dominik Reichl |
ProductName: | KeePass Password Safe |
ProductVersion: | 2.40 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 14-Jun-2018 13:27:46 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0000F25C | 0x0000F400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.37588 |
.itext | 0x00011000 | 0x00000FA4 | 0x00001000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.77877 |
.data | 0x00012000 | 0x00000C8C | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.30283 |
.bss | 0x00013000 | 0x000056BC | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00019000 | 0x00000E04 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.59781 |
.tls | 0x0001A000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x0001B000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.204488 |
.rsrc | 0x0001C000 | 0x0000B200 | 0x0000B200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.14464 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.13965 | 1580 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.47151 | 1384 | UNKNOWN | Dutch - Netherlands | RT_ICON |
3 | 3.91708 | 744 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4 | 3.91366 | 2216 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4091 | 2.56031 | 104 | UNKNOWN | UNKNOWN | RT_STRING |
4092 | 3.25287 | 212 | UNKNOWN | UNKNOWN | RT_STRING |
4093 | 3.26919 | 164 | UNKNOWN | UNKNOWN | RT_STRING |
4094 | 3.33268 | 684 | UNKNOWN | UNKNOWN | RT_STRING |
4095 | 3.34579 | 844 | UNKNOWN | UNKNOWN | RT_STRING |
4096 | 3.28057 | 660 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3096 | "C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe" | C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe | explorer.exe | |
User: admin Company: Dominik Reichl Integrity Level: MEDIUM Description: KeePass Password Safe 2.40 Setup Exit code: 0 Version: 2.40.0.0 | ||||
4084 | "C:\Users\admin\AppData\Local\Temp\is-UJEOL.tmp\KeePass-2.40-Setup.tmp" /SL5="$2011C,2799594,121344,C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-UJEOL.tmp\KeePass-2.40-Setup.tmp | — | KeePass-2.40-Setup.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
4032 | "C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe" /SPAWNWND=$20116 /NOTIFYWND=$2011C | C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe | KeePass-2.40-Setup.tmp | |
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: KeePass Password Safe 2.40 Setup Exit code: 0 Version: 2.40.0.0 | ||||
2612 | "C:\Users\admin\AppData\Local\Temp\is-NUC87.tmp\KeePass-2.40-Setup.tmp" /SL5="$3011E,2799594,121344,C:\Users\admin\AppData\Local\Temp\KeePass-2.40-Setup.exe" /SPAWNWND=$20116 /NOTIFYWND=$2011C | C:\Users\admin\AppData\Local\Temp\is-NUC87.tmp\KeePass-2.40-Setup.tmp | KeePass-2.40-Setup.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 | ||||
2224 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" net_check | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | — | KeePass-2.40-Setup.tmp |
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.40.0.0 | ||||
3896 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" preload_register | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | KeePass-2.40-Setup.tmp | |
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.40.0.0 | ||||
2880 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" ngen_install | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | — | KeePass-2.40-Setup.tmp |
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.40.0.0 | ||||
4008 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" uninstall "C:\Program Files\KeePass Password Safe 2\KeePass.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe | — | ShInstUtil.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Common Language Runtime native compiler Exit code: 4294967295 Version: 4.6.1055.0 built by: NETFXREL2 | ||||
3556 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files\KeePass Password Safe 2\KeePass.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe | — | ShInstUtil.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Common Language Runtime native compiler Exit code: 0 Version: 4.6.1055.0 built by: NETFXREL2 | ||||
2496 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 108 -InterruptEvent 0 -NGENProcess f8 -Pipe 104 -Comment "NGen Worker Process" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe | — | ngen.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: .NET Runtime Optimization Service Exit code: 0 Version: 4.6.1055.0 built by: NETFXREL2 |
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 340A000054CE9EFCFEA8D401 | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: 319A0EB23BF3A4CE8C508EC0B65E5F41F7105C7DCD10F171D4E8642723F4BF5C | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | RegFiles0000 |
Value: C:\Program Files\KeePass Password Safe 2\KeePass.exe | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | RegFilesHash |
Value: 394036489AD41935BC2042EA72B5B85CE7C76AC70322DACD845D976A57C17004 | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.kdbx |
Operation: | write | Name: | |
Value: kdbxfile | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kdbxfile |
Operation: | write | Name: | |
Value: KeePass Database | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kdbxfile |
Operation: | write | Name: | AlwaysShowExt |
Value: | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kdbxfile\DefaultIcon |
Operation: | write | Name: | |
Value: "C:\Program Files\KeePass Password Safe 2\KeePass.exe",0 | |||
(PID) Process: | (2612) KeePass-2.40-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kdbxfile\shell\open |
Operation: | write | Name: | |
Value: &Open with KeePass Password Safe |
PID | Process | Filename | Type | |
---|---|---|---|---|
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-B0K1O.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-EPDI7.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-C86IR.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-06AT7.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-9HCLB.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-8QQ34.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-61SI9.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-9FDHC.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-T11D2.tmp | — | |
MD5:— | SHA256:— | |||
2612 | KeePass-2.40-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-E77ON.tmp | — | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3832 | KeePass.exe | 134.119.143.231:443 | www.dominik-reichl.de | Host Europe GmbH | DE | unknown |
Domain | IP | Reputation |
---|---|---|
www.dominik-reichl.de |
| suspicious |