File name:

MoffFreeCalcSetup.exe

Full analysis: https://app.any.run/tasks/5e10624b-3162-4fef-a7a0-d6e8f3fb58ce
Verdict: Malicious activity
Analysis date: January 23, 2024, 20:28:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive
MD5:

1A4781E2FDF1C84AC7003836CA7C9933

SHA1:

0DE2D715A41C95DD756B774E21F2373304BEE5C3

SHA256:

C9BCB825ADCEC93DAFD994A6ADA429AC386B0BF807C3F9509161CD17658C8DD5

SSDEEP:

12288:KYk5xRqJAIofeL0lQEVbW4EQK+ZeE+tz3BloONTRaFhcWqgRfkxAqUuFL3YCUw+y:/eI/omLpJ4E+IzxloyTgFmHgdkxAqxIs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MoffFreeCalcSetup.exe (PID: 1388)
      • is-H4LPK.tmp (PID: 2724)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MoffFreeCalcSetup.exe (PID: 1388)
      • is-H4LPK.tmp (PID: 2724)

    • Process drops legitimate windows executable

      • is-H4LPK.tmp (PID: 2724)

    • Reads the Windows owner or organization settings

      • is-H4LPK.tmp (PID: 2724)

  • INFO

    • Checks supported languages

      • MoffFreeCalcSetup.exe (PID: 1388)
      • is-H4LPK.tmp (PID: 2724)
      • MoffFreeCalc.exe (PID: 2744)

    • Reads the computer name

      • is-H4LPK.tmp (PID: 2724)
      • MoffFreeCalc.exe (PID: 2744)

    • Create files in a temporary directory

      • is-H4LPK.tmp (PID: 2724)
      • MoffFreeCalcSetup.exe (PID: 1388)

    • Creates files or folders in the user directory

      • is-H4LPK.tmp (PID: 2724)

    • Creates files in the program directory

      • is-H4LPK.tmp (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (82.8)
.exe | Win32 Executable Delphi generic (10.7)
.exe | Win32 Executable (generic) (3.4)
.exe | Generic Win/DOS Executable (1.5)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 35328
InitializedDataSize: 16896
UninitializedDataSize: -
EntryPoint: 0x9264
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: Moffsoft
FileDescription: Moffsoft FreeCalc Setup
FileVersion:
InternalName: -
OriginalFileName: -
ProductName: -
ProductVersion: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mofffreecalcsetup.exe is-h4lpk.tmp mofffreecalc.exe no specs mofffreecalcsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Users\admin\AppData\Local\Temp\MoffFreeCalcSetup.exe" C:\Users\admin\AppData\Local\Temp\MoffFreeCalcSetup.exe—explorer.exe
User:
admin
Company:
Moffsoft
Integrity Level:
MEDIUM
Description:
Moffsoft FreeCalc Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\mofffreecalcsetup.exe
c:\windows\system32\ntdll.dll
1388"C:\Users\admin\AppData\Local\Temp\MoffFreeCalcSetup.exe" C:\Users\admin\AppData\Local\Temp\MoffFreeCalcSetup.exe
explorer.exe
User:
admin
Company:
Moffsoft
Integrity Level:
HIGH
Description:
Moffsoft FreeCalc Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\mofffreecalcsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2724"C:\Users\admin\AppData\Local\Temp\is-FACFG.tmp\is-H4LPK.tmp" /SL4 $9010A C:\Users\admin\AppData\Local\Temp\MoffFreeCalcSetup.exe 563965 50688 C:\Users\admin\AppData\Local\Temp\is-FACFG.tmp\is-H4LPK.tmp
MoffFreeCalcSetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-facfg.tmp\is-h4lpk.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2744"C:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.exe"C:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.exe—is-H4LPK.tmp
User:
admin
Company:
Moffsoft
Integrity Level:
HIGH
Description:
FreeCalc
Exit code:
0
Version:
1.2.0.6
Modules
Images
c:\program files\moffsoft freecalc\mofffreecalc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
900
Read events
900
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
13
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.exeexecutable
MD5:446507A89B2B45A8FB7E2B6760C5710E
SHA256:C97FFE36669D48C422EFE237E5FE44098ACF3B313B1155296904757422DC8D99
2724is-H4LPK.tmpC:\Users\admin\AppData\Local\Temp\is-PDKQ2.tmp\_isdecmp.dllexecutable
MD5:9F015911C4073BA9B8AD5A4C36FCAF88
SHA256:C630FB87C007C1E3D008EAC97EDF7E025C0CB806C886971E32B7063D606FD125
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\is-CNH1O.tmpexecutable
MD5:6E1936C94D616D759CF90029C3DAA2B1
SHA256:1DCDAA10AD9C7B72C00CF0520DFF8A8E29C005FA6270B84DF3EE17628A38C2EF
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\unins000.exeexecutable
MD5:6E1936C94D616D759CF90029C3DAA2B1
SHA256:1DCDAA10AD9C7B72C00CF0520DFF8A8E29C005FA6270B84DF3EE17628A38C2EF
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.chmbinary
MD5:1A59CB1AB3B10427B355205A72BB1B59
SHA256:6C31D0B3CF89DC3A90F1E9B26D6824EA03A8EF61FD1DB2B636D06F4597DEB57C
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\is-PAID2.tmpbinary
MD5:1A59CB1AB3B10427B355205A72BB1B59
SHA256:6C31D0B3CF89DC3A90F1E9B26D6824EA03A8EF61FD1DB2B636D06F4597DEB57C
1388MoffFreeCalcSetup.exeC:\Users\admin\AppData\Local\Temp\is-FACFG.tmp\is-H4LPK.tmpexecutable
MD5:0D0622F7D2FD629455A028D7E1CB1C07
SHA256:AB0982C120A65ADC3AA898AF09AD923C9B896EDFC52F7D206798C5FDF59D8F5A
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\is-42JOG.tmptext
MD5:1D2CF1966562BB4BB9068792420AC139
SHA256:A457915F5CD25AB3200FD1AEF55BA22E08B1FA31D23BF7F5A9169A91430E1D56
2724is-H4LPK.tmpC:\Users\admin\AppData\Local\Temp\is-PDKQ2.tmp\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
2724is-H4LPK.tmpC:\Program Files\Moffsoft FreeCalc\ReadMe.txttext
MD5:22C3BD9125302028713387A67732D2CF
SHA256:F62CC58FEF532F59D8C4808642199C42B719B0A1FD650C08C450C104C11EBF22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MoffFreeCalcSetup.exe