File name:

HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.7z

Full analysis: https://app.any.run/tasks/87f95adc-6461-4be4-a820-0d022d57e245
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 30, 2025, 11:51:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
python
noblis
ransomware
pyinstaller
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

6E3CACC99AF19AF212F78EDE1776D508

SHA1:

0EE65B84ACEFC16D88552A175FFD4B568E76598B

SHA256:

C60C15EB1878DA7B47494AC228D6FD6E098AE35BD4940D4B173BAAE6AB5B4D00

SSDEEP:

196608:KvnK078kI6VpbNxUfNw4dg+mlgpEk8kUD:KvK0IkICbUfC46+miikUD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Flonwd.exe (PID: 2236)

    • NOBLIS mutex has been found

      • Flonwd.exe (PID: 2236)

    • Modifies files in the Chrome extension folder

      • Flonwd.exe (PID: 2236)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)

    • Reads security settings of Internet Explorer

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • Process drops python dynamic module

      • Flonwd.exe (PID: 5548)

    • Process drops legitimate windows executable

      • Flonwd.exe (PID: 5548)

    • Application launched itself

      • Flonwd.exe (PID: 5548)

    • The process drops C-runtime libraries

      • Flonwd.exe (PID: 5548)

    • The process creates files with name similar to system file names

      • Flonwd.exe (PID: 2236)

    • Loads Python modules

      • Flonwd.exe (PID: 2236)

  • INFO

    • Checks supported languages

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)

    • Create files in a temporary directory

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • notepad.exe (PID: 6676)
      • notepad.exe (PID: 6228)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4040)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 2236)

    • Reads the computer name

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)
      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)

    • Process checks computer location settings

      • HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe (PID: 2088)

    • The sample compiled with english language support

      • Flonwd.exe (PID: 5548)

    • PyInstaller has been detected (YARA)

      • Flonwd.exe (PID: 5548)
      • Flonwd.exe (PID: 2236)

    • Creates files or folders in the user directory

      • Flonwd.exe (PID: 2236)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2020:07:02 20:18:24+00:00
ArchivedFileName: HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs heur-trojan-ransom.msil.encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe flonwd.exe #NOBLIS flonwd.exe notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2088"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.msil.encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2236"C:\Users\admin\AppData\Local\Temp\Flonwd.exe" C:\Users\admin\AppData\Local\Temp\Flonwd.exe
Flonwd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\flonwd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4040"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\87f95adc-6461-4be4-a820-0d022d57e245.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5548"C:\Users\admin\AppData\Local\Temp\Flonwd.exe" C:\Users\admin\AppData\Local\Temp\Flonwd.exe
HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\flonwd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5720"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6228"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\key.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6676"C:\WINDOWS\system32\notepad.exe" C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6872C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
5 808
Read events
5 712
Write events
93
Delete events
3

Modification events

(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\87f95adc-6461-4be4-a820-0d022d57e245.7z
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
112
Suspicious files
875
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4040.29736\HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exeexecutable
MD5:FD755CAE81D2B6D9B60C0EB0E5E42A56
SHA256:325953506271955C3DAA23C2DE161F5A4128DF3655609F48C77CC01CFF405C9F
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_aes.cp37-win32.pydexecutable
MD5:3C7983E5FAFD573059376B551E0E78E1
SHA256:ED1E902A4AABE0683A237608870381532448A5E64AAED54E2D43B7060AD1F7E3
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_cast.cp37-win32.pydexecutable
MD5:B6E4FE341F4234F6D37E0CE14DC8A935
SHA256:6E2B848F37DA69C4388EE664C0030C3E16772B5CF832A11294A98A7A71C837E3
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_chacha20.cp37-win32.pydexecutable
MD5:A2230C05500DC22659FF388473100B89
SHA256:07F9E50A0904235A4DA60187BE055E48DAFCCE1452AE49255BF165D42A1875A7
2088HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.exeC:\Users\admin\AppData\Local\Temp\Flonwd.exeexecutable
MD5:6CDA76A4E68D80F64C38C5B4DB9A6ED7
SHA256:DB598DD5699ED06433AA47C8A1D1DE9C61BAC3BFB82D3FC9E60286A8731A2F6A
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_aesni.cp37-win32.pydexecutable
MD5:C3F52EC26310948974C76B15095DDF1E
SHA256:FAF5A9C9C1F1715587201727911CE12DACDEA3C27AB6663B54B026195D5A7F89
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_blowfish.cp37-win32.pydexecutable
MD5:ED4ACC41B9016F7219972DF8DA7C3821
SHA256:A06B4FAC14C56F63E9FB6AADFB2B7F1ED18D4AF379B06543FA56A3598C01556E
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_arc2.cp37-win32.pydexecutable
MD5:C43087FE294299BC7B8098FCB1049014
SHA256:A87C21666B8C586B26135901D444C847FC8FF8C5636AF6E2F64A715F045D3B78
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_cfb.cp37-win32.pydexecutable
MD5:A5CBBAEC60B6B40043A0F902627041AC
SHA256:FD622DAD723A51A5DF47A092E9AC47E75A83322232CDCF8DDAAF41E88C9136DE
5548Flonwd.exeC:\Users\admin\AppData\Local\Temp\_MEI55482\Crypto\Cipher\_raw_ctr.cp37-win32.pydexecutable
MD5:1668F3391ABB2854202D0E4E7F435520
SHA256:AB293BAD8D9B6CAC6D0944F41C34BFE236DAE4CFDC259858489D4AF0A8E050E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3768
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3768
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3768
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3768
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.MSIL.Encoder.gen-325953506271955c3daa23c2de161f5a4128df3655609f48c77cc01cff405c9f.7z