File name:

Новая сжатая ZIP-папка.zip

Full analysis: https://app.any.run/tasks/39b44b86-fc92-43cd-bdf2-3dd7f17e97fc
Verdict: Malicious activity
Analysis date: June 14, 2021, 18:11:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9D980DB55B1714AFEA79D53501A67871

SHA1:

A2A9DE8FA3AB88FF341949F885F6E769698BEDCE

SHA256:

C6336E4592B340C29AA910C4443A942F3A4131C02802E1B058C4141918D965E6

SSDEEP:

196608:5nTRNydp2L7UOMYT89Fp6/Hl0fKKIDfnwcdSgK5kaYvOTCg:Fbydp2L7UOOe/GCKynwcdSJKjmn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Floxif.exe (PID: 932)

    • Application was dropped or rewritten from another process

      • HitmanPro.exe (PID: 2120)
      • Floxif.exe (PID: 932)

    • Loads dropped or rewritten executable

      • Floxif.exe (PID: 932)

    • Renames files like Ransomware

      • Floxif.exe (PID: 932)

  • SUSPICIOUS

    • Creates files in the program directory

      • Floxif.exe (PID: 932)
      • HitmanPro.exe (PID: 2120)

    • Executed as Windows Service

      • hmpsched.exe (PID: 2448)

    • Creates a directory in Program Files

      • HitmanPro.exe (PID: 2120)

    • Executable content was dropped or overwritten

      • Floxif.exe (PID: 932)

    • Drops a file with a compile date too recent

      • Floxif.exe (PID: 932)

    • Drops a file that was compiled in debug mode

      • Floxif.exe (PID: 932)

    • Creates a software uninstall entry

      • HitmanPro.exe (PID: 2120)

  • INFO

    • Manual execution by user

      • Floxif.exe (PID: 932)
      • HitmanPro.exe (PID: 2120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Floxif.exe
ZipUncompressedSize: 544909
ZipCompressedSize: 310067
ZipCRC: 0xb8b80a96
ZipModifyDate: 2021:06:14 21:05:00
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs hitmanpro.exe floxif.exe hmpsched.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
932"C:\Users\admin\Desktop\Floxif.exe" C:\Users\admin\Desktop\Floxif.exe
explorer.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗下载器
Exit code:
3221225477
Version:
6.7.0.0329
Modules
Images
c:\users\admin\desktop\floxif.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
1176"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Новая сжатая ZIP-папка.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2120"C:\Users\admin\Desktop\HitmanPro.exe" C:\Users\admin\Desktop\HitmanPro.exe
explorer.exe
User:
admin
Company:
SurfRight B.V.
Integrity Level:
HIGH
Description:
HitmanPro 3.8
Exit code:
0
Version:
3, 8, 23, 318
Modules
Images
c:\users\admin\desktop\hitmanpro.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448"C:\Program Files\HitmanPro\hmpsched.exe"C:\Program Files\HitmanPro\hmpsched.exe—services.exe
User:
SYSTEM
Company:
SurfRight B.V.
Integrity Level:
SYSTEM
Description:
HitmanPro Scheduler
Exit code:
0
Version:
3, 8, 23, 318
Total events
575
Read events
535
Write events
39
Delete events
1

Modification events

(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1176) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Новая сжатая ZIP-папка.zip
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
5
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1176.16512\Floxif.exe —
MD5:—
SHA256:—
1176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1176.16512\HitmanPro.exe —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\srvpost\libglib-2.0-0.dll.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\srvpost\intl.dll.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\srvpost\libgcc_s_sjlj-1.dll.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\srvpost\libssp-0.dll.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\srvpost\srvpost.exe.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp —
MD5:—
SHA256:—
932Floxif.exeC:\Program Files\Internet Explorer\ieproxy.dll.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
HitmanPro.exe
GET
200
87.249.108.117:80
http://cloud.hitmanpro.com/banner.aspx?lc=en&v=3.8.23.318&c=&lic=free
NL
text
132 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2120
HitmanPro.exe
185.105.204.28:80
files.surfright.nl
Astralus B.V.
NL
suspicious
—
—
87.249.108.117:80
cloud.hitmanpro.com
Virtu Secure Webservices B.V.
NL
suspicious

DNS requests

Domain
IP
Reputation
cloud.hitmanpro.com
  • 87.249.108.117
whitelisted
files.surfright.nl
  • 185.105.204.28
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Новая сжатая ZIP-папка.zip