File name:

PhrozenVirusTotalUploaderV3-1_setup.exe

Full analysis: https://app.any.run/tasks/d0e37f6f-6fde-492a-8109-71f62141e267
Verdict: Malicious activity
Analysis date: February 08, 2021, 20:33:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

061E11719E1D0E01147465C7E0EBBA65

SHA1:

B9CE5417E13767AD6563EA62F8B466F4EAB94B86

SHA256:

F4F7CFB2A973C8B923225584BE5E14A0E2D2F7B59C96EAC53E75FA25BA0E02FA

SSDEEP:

49152:vATQ2T73hhL45V6ewtP8lmpghDEqbeIQ4sa6+OIx3QMNJSM3X7y+RMTdRl:DGhLaynkDEm0vIx3QEoMbap

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • PhrozenVirusTotalUploaderV3-1_setup.exe (PID: 1648)
      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Changes the autorun value in the registry

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

  • SUSPICIOUS

    • Starts Internet Explorer

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Executable content was dropped or overwritten

      • PhrozenVirusTotalUploaderV3-1_setup.exe (PID: 1648)
      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Reads the Windows organization settings

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Reads Windows owner or organization settings

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Drops a file with too old compile date

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Drops a file that was compiled in debug mode

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Creates files in the user directory

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 812)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2612)

    • Creates a software uninstall entry

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2612)

    • Application launched itself

      • iexplore.exe (PID: 2612)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2612)

    • Changes internet zones settings

      • iexplore.exe (PID: 2612)

    • Application was dropped or rewritten from another process

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)

    • Loads dropped or rewritten executable

      • PhrozenVirusTotalUploaderV3-1_setup.tmp (PID: 2848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:01:30 15:21:56+01:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 67584
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Phrozen Software™ Solutions (c) 2013
FileDescription: PhrozenSoft VirusTotal Uploader Setup
FileVersion:
LegalCopyright: Phrozen Software™ Solutions (c) 2013 - Phrozen Software™
ProductName: PhrozenSoft VirusTotal Uploader
ProductVersion: 3.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 30-Jan-2013 14:21:56
Detected languages:
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: Phrozen Software™ Solutions (c) 2013
FileDescription: PhrozenSoft VirusTotal Uploader Setup
FileVersion: -
LegalCopyright: Phrozen Software™ Solutions (c) 2013 - Phrozen Software™
ProductName: PhrozenSoft VirusTotal Uploader
ProductVersion: 3.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 30-Jan-2013 14:21:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000F12C
0x0000F200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.39148
.itext
0x00011000
0x00000B44
0x00000C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.73207
.data
0x00012000
0x00000C88
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.24631
.bss
0x00013000
0x000056B4
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00019000
0x00000DD0
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.97188
.tls
0x0001A000
0x00000008
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x0001B000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.204488
.rsrc
0x0001C000
0x0000EA00
0x0000EA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.88074

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08452
1444
Latin 1 / Western European
English - United States
RT_MANIFEST
2
4.7389
2216
Latin 1 / Western European
English - United States
RT_ICON
3
3.91559
1384
Latin 1 / Western European
English - United States
RT_ICON
4
5.11662
9640
Latin 1 / Western European
English - United States
RT_ICON
5
5.62687
4264
Latin 1 / Western European
English - United States
RT_ICON
6
5.97397
1128
Latin 1 / Western European
English - United States
RT_ICON
4091
2.56031
104
Latin 1 / Western European
UNKNOWN
RT_STRING
4092
3.25287
212
Latin 1 / Western European
UNKNOWN
RT_STRING
4093
3.26919
164
Latin 1 / Western European
UNKNOWN
RT_STRING
4094
3.33268
684
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
oleaut32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
812"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2612 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1648"C:\Users\admin\AppData\Local\Temp\PhrozenVirusTotalUploaderV3-1_setup.exe" C:\Users\admin\AppData\Local\Temp\PhrozenVirusTotalUploaderV3-1_setup.exe
explorer.exe
User:
admin
Company:
Phrozen Software™ Solutions (c) 2013
Integrity Level:
MEDIUM
Description:
PhrozenSoft VirusTotal Uploader Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\phrozenvirustotaluploaderv3-1_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2612"C:\Program Files\Internet Explorer\iexplore.exe" http://facebook.com/PhrozenSoftC:\Program Files\Internet Explorer\iexplore.exe
PhrozenVirusTotalUploaderV3-1_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2848"C:\Users\admin\AppData\Local\Temp\is-O22G4.tmp\PhrozenVirusTotalUploaderV3-1_setup.tmp" /SL5="$20138,2407897,133632,C:\Users\admin\AppData\Local\Temp\PhrozenVirusTotalUploaderV3-1_setup.exe" C:\Users\admin\AppData\Local\Temp\is-O22G4.tmp\PhrozenVirusTotalUploaderV3-1_setup.tmp
PhrozenVirusTotalUploaderV3-1_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-o22g4.tmp\phrozenvirustotaluploaderv3-1_setup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
921
Read events
821
Write events
93
Delete events
7

Modification events

(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
200B0000380F36BB59FED601
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
7E8C6435AC3148B152A75F43289ADD13EEDEA9D2B09A91779D1A409977CF38EE
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\PVTUploader.exe
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
00EBDCB2DC12EE9CA0BF51766A166842B168F8CD5CE1D8358E59CE796F036D62
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:PhrozenSoft VirusTotal Uploader
Value:
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PhrozenSoft VirusTotal Uploader_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.3 (u)
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PhrozenSoft VirusTotal Uploader_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PhrozenSoft VirusTotal Uploader_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\
(PID) Process:(2848) PhrozenVirusTotalUploaderV3-1_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PhrozenSoft VirusTotal Uploader_is1
Operation:writeName:Inno Setup: Icon Group
Value:
PhrozenSoft VirusTotal Uploader
Executable files
9
Suspicious files
9
Text files
61
Unknown types
8

Dropped files

PID
Process
Filename
Type
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-7DDL5.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-4TN4D.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-ICE3V.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-63F1V.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-D21PB.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-8TDKF.tmp —
MD5:—
SHA256:—
2848PhrozenVirusTotalUploaderV3-1_setup.tmpC:\Users\admin\AppData\Roaming\PhrozenSoft\PVTUploader\is-A0NRA.tmp —
MD5:—
SHA256:—
812iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab57A.tmp —
MD5:—
SHA256:—
812iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar57B.tmp —
MD5:—
SHA256:—
1648PhrozenVirusTotalUploaderV3-1_setup.exeC:\Users\admin\AppData\Local\Temp\is-O22G4.tmp\PhrozenVirusTotalUploaderV3-1_setup.tmpexecutable
MD5:CF7735C772AA8A19E40C423D784F80EA
SHA256:9513E9CC721FAB2BE7E2D94B566264AC5DE0E1E0A78D4ECD918F5BF9AECFE37D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
812
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA5YU1Y%2FADdXsW8S3Kokx7I%3D
US
der
471 b
whitelisted
812
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
812
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAx0%2Btw3URVCeizPL1qpt5I%3D
US
der
471 b
whitelisted
2612
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
812
iexplore.exe
GET
301
185.60.216.35:80
http://facebook.com/PhrozenSoft
IE
—
—
whitelisted
812
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAx0%2Btw3URVCeizPL1qpt5I%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
812
iexplore.exe
185.60.216.35:80
facebook.com
Facebook, Inc.
IE
whitelisted
812
iexplore.exe
185.60.216.35:443
facebook.com
Facebook, Inc.
IE
whitelisted
812
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
812
iexplore.exe
31.13.72.36:443
m.facebook.com
Facebook, Inc.
IE
whitelisted
812
iexplore.exe
31.13.72.12:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
812
iexplore.exe
157.240.30.27:443
scontent-prg1-1.xx.fbcdn.net
Facebook, Inc.
US
unknown
812
iexplore.exe
69.171.250.35:443
fbcdn.net
Facebook, Inc.
US
suspicious
—
—
31.13.72.12:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
2612
iexplore.exe
31.13.72.12:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
2612
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
facebook.com
  • 185.60.216.35
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
m.facebook.com
  • 31.13.72.36
whitelisted
static.xx.fbcdn.net
  • 31.13.72.12
whitelisted
scontent-prg1-1.xx.fbcdn.net
  • 157.240.30.27
whitelisted
fbcdn.net
  • 69.171.250.35
whitelisted
fbsbx.com
  • 31.13.72.36
whitelisted
external-prg1-1.xx.fbcdn.net
  • 157.240.30.27
unknown
scontent.xx.fbcdn.net
  • 31.13.72.12
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PhrozenVirusTotalUploaderV3-1_setup.exe