File name: | cuteftp.exe |
Full analysis: | https://app.any.run/tasks/2780bd4f-9003-4c51-8ce6-d17cb8b0f110 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 20:50:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive |
MD5: | FEDC847CD04CEFF9C720AADD7063826B |
SHA1: | 269B163E9FD3012F0B92D299AF23564972FCB649 |
SHA256: | EDF511340FB13401D2F9C8013CF5156AAD1E0800B6464201162C6B1F8884512C |
SSDEEP: | 393216:5xVxRm9esTHaPNP2QVeAZzhv6+7GGQI3gROcMT8sY3AJg:/RtFP2QIAjv6+7b36OcG8L |
.exe | | | InstallShield setup (54.3) |
---|---|---|
.exe | | | Win64 Executable (generic) (34.8) |
.exe | | | Win32 Executable (generic) (5.6) |
.exe | | | Generic Win/DOS Executable (2.5) |
.exe | | | DOS Executable Generic (2.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2001:09:05 19:02:57+02:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 73728 |
InitializedDataSize: | 212992 |
UninitializedDataSize: | - |
EntryPoint: | 0x8947 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 4.0.100.1190 |
ProductVersionNumber: | 4.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
Comments: | |
CompanyName: | GlobalSCAPE, Inc. |
FileDescription: | |
InternalName: | stub32 |
OriginalFileName: | stub32i.exe |
FileVersion: | 9.3.0.3 |
LegalCopyright: | Copyright © 2000-2017 GlobalSCAPE, Inc. All rights reserved. |
ProductName: | CuteFTP |
ProductVersion: | 9.3.0.3 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 05-Sep-2001 17:02:57 |
Detected languages: |
|
Comments: | - |
CompanyName: | GlobalSCAPE, Inc. |
FileDescription: | - |
InternalName: | stub32 |
OriginalFilename: | stub32i.exe |
FileVersion: | 9.3.0.3 |
LegalCopyright: | Copyright © 2000-2017 GlobalSCAPE, Inc. All rights reserved. |
ProductName: | CuteFTP |
ProductVersion: | 9.3.0.3 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 05-Sep-2001 17:02:57 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00011B16 | 0x00012000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.6021 |
.rdata | 0x00013000 | 0x00001950 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.78253 |
.data | 0x00015000 | 0x00004E38 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.42192 |
.rsrc | 0x0001A000 | 0x0002CAA8 | 0x0002D000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.02305 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 2.5838 | 1640 | UNKNOWN | English - United States | RT_VERSION |
2 | 6.39652 | 1384 | UNKNOWN | English - United States | RT_ICON |
3 | 3.18406 | 424 | UNKNOWN | English - United States | RT_STRING |
4 | 3.07096 | 282 | UNKNOWN | English - United States | RT_STRING |
19 | 2.86832 | 186 | UNKNOWN | English - United States | RT_STRING |
20 | 3.28952 | 870 | UNKNOWN | English - United States | RT_STRING |
21 | 2.89596 | 152 | UNKNOWN | English - United States | RT_STRING |
103 | 2.64576 | 62 | UNKNOWN | English - United States | RT_GROUP_ICON |
118 | 7.04133 | 154530 | UNKNOWN | English - United States | RT_BITMAP |
132 | 4.04914 | 14564 | UNKNOWN | English - United States | RT_BITMAP |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
LZ32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2168 | "C:\Users\admin\AppData\Local\Temp\cuteftp.exe" | C:\Users\admin\AppData\Local\Temp\cuteftp.exe | — | explorer.exe |
User: admin Company: GlobalSCAPE, Inc. Integrity Level: MEDIUM Description: Exit code: 3221226540 Version: 9.3.0.3 | ||||
820 | "C:\Users\admin\AppData\Local\Temp\cuteftp.exe" | C:\Users\admin\AppData\Local\Temp\cuteftp.exe | explorer.exe | |
User: admin Company: GlobalSCAPE, Inc. Integrity Level: HIGH Description: Version: 9.3.0.3 | ||||
2608 | "C:\Program Files\Globalscape\CuteFTP\Setup\Disk1\Setup.exe" | C:\Program Files\Globalscape\CuteFTP\Setup\Disk1\Setup.exe | cuteftp.exe | |
User: admin Company: InstallShield Software Corporation Integrity Level: HIGH Description: InstallShield (R) Setup Launcher Exit code: 0 Version: 6, 31, 100, 1190 | ||||
3860 | "C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe" -RegServer | C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe | Setup.exe | |
User: admin Company: InstallShield Software Corporation Integrity Level: HIGH Description: InstallShield (R) Setup Engine Exit code: 0 Version: 6, 31, 100, 1221 | ||||
3788 | C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe -Embedding | C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe | svchost.exe | |
User: admin Company: InstallShield Software Corporation Integrity Level: HIGH Description: InstallShield (R) Setup Engine Version: 6, 31, 100, 1221 | ||||
2912 | "C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER | C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe | — | IKernel.exe |
User: admin Company: InstallShield Software Corporation Integrity Level: HIGH Description: InstallShield (R) Setup Engine Exit code: 0 Version: 6, 31, 100, 1221 | ||||
1516 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2832 | C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2716 | regsvr32.exe /s\ \"C:\Program Files\Globalscape\CuteFTP\CuteShell.dll" | C:\Windows\system32\regsvr32.exe | IKernel.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
284 | "C:\Program Files\Globalscape\CuteFTP\ftpte.exe" /RegServer | C:\Program Files\Globalscape\CuteFTP\ftpte.exe | IKernel.exe | |
User: admin Company: Globalscape, Inc. Integrity Level: HIGH Description: FTP Transfer Engine Exit code: 0 Version: 9.3.0.3 |
PID | Process | Filename | Type | |
---|---|---|---|---|
820 | cuteftp.exe | C:\Users\admin\AppData\Local\Temp\extCDDB.tmp | — | |
MD5:— | SHA256:— | |||
820 | cuteftp.exe | C:\Users\admin\AppData\Local\Temp\pft1C98.tmp\pftw1.pkg | — | |
MD5:— | SHA256:— | |||
820 | cuteftp.exe | C:\Program Files\Globalscape\CuteFTP\Setup\Disk1\data2.cab | — | |
MD5:— | SHA256:— | |||
2608 | Setup.exe | C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\temp.000 | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\core22c0.rra | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\ctor22d0.rra | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\obje235c.rra | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\iuse237b.rra | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Program Files\Common Files\InstallShield\IScript\iscr2418.rra | — | |
MD5:— | SHA256:— | |||
3788 | IKernel.exe | C:\Users\admin\AppData\Local\Temp\{89B9E358-75C6-4C6B-BD38-803FF156CC4B}\setu25ae.rra | — | |
MD5:— | SHA256:— |