File name:

winzip24-home.exe

Full analysis: https://app.any.run/tasks/951e816a-bb5e-41bc-bebe-34f4afa708fd
Verdict: Malicious activity
Analysis date: December 04, 2019, 15:17:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9F70879C80C310CC4720BD1EB4FBF68D

SHA1:

E365FC6F44DFBE829BE8FE494B73EF458CB8504C

SHA256:

B59DB592B924E963C21DA8709417AC0504F6158CFCB12FE5536F4A0E0D57D7FB

SSDEEP:

24576:uZbDbHvHRCG+YF8JmiyeVnnZNXMICDmJ10puzj:6HvHn+YF8JmiyeVnnZNcIdJ+puzj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • winzip24-home.exe (PID: 2620)

    • Creates files in the program directory

      • winzip24-home.exe (PID: 3868)

    • Reads internet explorer settings

      • winzip24-home.exe (PID: 3868)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:08:15 14:48:12+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 519168
InitializedDataSize: 196096
UninitializedDataSize: -
EntryPoint: 0x4ece0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 24.0.13543.0
ProductVersionNumber: 24.0.13543.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.13543.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2019 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.13543.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Aug-2019 12:48:12
Detected languages:
  • English - United States
CompanyName: WinZip Computing
FileDescription: WinZipStub Installer
FileVersion: 24.0.13543.0
InternalName: WinZipStubInstaller.exe
LegalCopyright: (c) 2015-2019 Corel Corporation All rights reserved.
ProductName: WinZipStub
ProductVersion: 24.0.13543.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 15-Aug-2019 12:48:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0007EB3C
0x0007EC00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61195
.rdata
0x00080000
0x0002005A
0x00020200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.97357
.data
0x000A1000
0x00003BCC
0x00002E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.69667
.gfids
0x000A5000
0x000007CC
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.97267
.tls
0x000A6000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x000A7000
0x00004E58
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.53812
.reloc
0x000AC000
0x000065F4
0x00006600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62785

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.16947
2013
UNKNOWN
English - United States
RT_MANIFEST
101
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
RPCRT4.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winzip24-home.exe winzip24-home.exe winzip24-home.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1024"C:\Users\admin\AppData\Local\Temp\winzip24-home.exe" C:\Users\admin\AppData\Local\Temp\winzip24-home.exe—explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZipStub Installer
Exit code:
3221226540
Version:
24.0.13543.0
Modules
Images
c:\users\admin\appdata\local\temp\winzip24-home.exe
c:\systemroot\system32\ntdll.dll
2620"C:\Users\admin\AppData\Local\Temp\winzip24-home.exe" C:\Users\admin\AppData\Local\Temp\winzip24-home.exe
explorer.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
24.0.13543.0
Modules
Images
c:\users\admin\appdata\local\temp\winzip24-home.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
3868 run=1 shortcut="C:\Users\admin\AppData\Local\Temp\winzip24-home.exe"C:\Users\admin\AppData\Local\Temp\38e109\winzip24-home.exe
winzip24-home.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZipStub Installer
Exit code:
0
Version:
24.0.13543.0
Modules
Images
c:\users\admin\appdata\local\temp\38e109\winzip24-home.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
Total events
77
Read events
67
Write events
10
Delete events
0

Modification events

(PID) Process:(3868) winzip24-home.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:install_language
Value:
English
(PID) Process:(3868) winzip24-home.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3868) winzip24-home.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3868) winzip24-home.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:status
Value:
0
(PID) Process:(3868) winzip24-home.exeKey:HKEY_CURRENT_USER\Software\Corel\stubframework\WNZP\24
Operation:writeName:channel
Value:
nkln24-home
Executable files
1
Suspicious files
1
Text files
50
Unknown types
0

Dropped files

PID
Process
Filename
Type
3868winzip24-home.exeC:\ProgramData\UniqueId\databinary
MD5:—
SHA256:—
2620winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e109\winzip24-home.exeexecutable
MD5:—
SHA256:—
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\img\close-hover.pngimage
MD5:CDEDAD55D5AF2695E648D9D84ADFE854
SHA256:39D20DD0DB593B35E7807A68DFE22A566192FB8EF8675F4B9171A377E4391AB7
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\img\button-normal.pngimage
MD5:7C7DBDEE45987EADA0D0DC0D126B4239
SHA256:0A649E9E86D9379792B44DC80D9C9C9A7F134DA4DA03F7B422C51CDCF7849A5C
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\img\button-hover.pngimage
MD5:7D3A382C149EE7588958281A816918BF
SHA256:97E35A7F7DC87983E8D1DDAA120BBA9D81BFE3AE4A6F99301A4749224CFBDD02
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\img\centerImg.pngimage
MD5:F1F71117A2C77649963C8B4CCF4B5CF8
SHA256:44C4E7A6E7293B855830F94496D7ADDC6916BFE62E36AC8142CDA1919745950E
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\js\common.jstext
MD5:—
SHA256:—
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\css\common.csstext
MD5:59D687B8DFA4E3169F5D15BF6F835AD3
SHA256:B6B15AC44F1E07FBB46CBAE0BD2B34293BAA5766DD8263E4AC58993CD9F71304
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\common\css\jquery-ui.csstext
MD5:1CE4EB3E5153F4C9B93A3CFDF3EF2E77
SHA256:95F4C300D84EEDD0C43A30A1B6F0DFBBF7B8C47725511981E4CFE12DFAEB0E93
3868winzip24-home.exeC:\Users\admin\AppData\Local\Temp\38e2ce\config\config.jstext
MD5:B83AC079CFDF3EC94A9449F532B01DC5
SHA256:1B935AEB2D5694BAD98F525AF8E471091A20817273CFCDBF17DC5E857B0DE530
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3868
winzip24-home.exe
POST
200
18.236.15.144:80
http://i.installportal.com/v1/logAnalytics
US
xml
204 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3868
winzip24-home.exe
18.236.15.144:80
i.installportal.com
—
US
malicious

DNS requests

Domain
IP
Reputation
i.installportal.com
  • 18.236.15.144
  • 54.68.21.135
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winzip24-home.exe