analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

bbflbk5.exe

Full analysis: https://app.any.run/tasks/eec03cce-a968-4208-bc5a-381b52c1520b
Verdict: Malicious activity
Analysis date: February 21, 2020, 20:16:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A248D3B13E3CE03D9619F4B18762B5E6

SHA1:

029D03F381862F0A7944E9E890D794AE9A0D34B1

SHA256:

FF546D3339BD56676C8A21A80D60136FA41AD046FADE665932C94DA0F5BE67F4

SSDEEP:

393216:06ARBUkMvOFEDHLY/dQrrI1a6rH92vsZ0SiURihZFVe2UGESc3mpFyFKyrfvP18Y:0xRBTbF0rY+Q1atLKyWF5b3mpWK61dmq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • bbflbk5.exe (PID: 2220)
      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 2536)
      • DefConfig.exe (PID: 3444)
      • DefConfig.exe (PID: 2112)
      • FlashBack Player.exe (PID: 3816)

    • Application was dropped or rewritten from another process

      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 3444)
      • DefConfig.exe (PID: 2536)
      • ns1AB2.tmp (PID: 1944)
      • DefConfig.exe (PID: 2112)
      • ns1B9E.tmp (PID: 2244)
      • ns1EAC.tmp (PID: 3224)
      • FlashBack Player.exe (PID: 3816)

  • SUSPICIOUS

    • Creates COM task schedule object

      • bbflbk5.exe (PID: 2220)

    • Executable content was dropped or overwritten

      • bbflbk5.exe (PID: 2220)

    • Creates files in the user directory

      • bbflbk5.exe (PID: 2220)
      • DefConfig.exe (PID: 3444)
      • DefConfig.exe (PID: 2536)
      • FlashBack Recorder.exe (PID: 2628)
      • DefConfig.exe (PID: 2112)
      • FlashBack Player.exe (PID: 3816)

    • Modifies the open verb of a shell class

      • bbflbk5.exe (PID: 2220)

    • Creates a software uninstall entry

      • bbflbk5.exe (PID: 2220)

    • Starts application with an unusual extension

      • bbflbk5.exe (PID: 2220)

    • Creates files in the program directory

      • DefConfig.exe (PID: 3444)
      • FlashBack Recorder.exe (PID: 2628)
      • bbflbk5.exe (PID: 2220)

    • Reads Internet Cache Settings

      • FlashBack Recorder.exe (PID: 2628)
      • FlashBack Player.exe (PID: 3816)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • bbflbk5.exe (PID: 2220)

    • Manual execution by user

      • FlashBack Player.exe (PID: 3816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

ProductVersion: 5.42.0.4556
ProductName: FlashBack Pro 5
LegalCopyright: -
FileVersion: 5.42.0.4556
FileDescription: -
CompanyWebsite: http://www.bbflashback.com/
CompanyName: Blueberry Software (UK) Ltd.
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 5.42.0.4556
FileVersionNumber: 5.42.0.4556
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3927
UninitializedDataSize: 2048
InitializedDataSize: 152576
CodeSize: 28160
LinkerVersion: 6
PEType: PE32
TimeStamp: 2018:12:15 23:27:32+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:27:32
Detected languages:
  • English - United States
CompanyName: Blueberry Software (UK) Ltd.
CompanyWebsite: http://www.bbflashback.com/
FileDescription: -
FileVersion: 5.42.0.4556
LegalCopyright: -
ProductName: FlashBack Pro 5
ProductVersion: 5.42.0.4556

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:27:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006C0B
0x00006E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42225
.rdata
0x00008000
0x000013EA
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.21633
.data
0x0000A000
0x00022CF8
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.56705
.ndata
0x0002D000
0x00039000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00066000
0x00008E20
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.46528

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28794
1070
UNKNOWN
English - United States
RT_MANIFEST
2
4.70165
9640
UNKNOWN
English - United States
RT_ICON
3
3.26807
4264
UNKNOWN
English - United States
RT_ICON
4
4.47002
1384
UNKNOWN
English - United States
RT_ICON
5
4.48066
1128
UNKNOWN
English - United States
RT_ICON
6
4.87093
872
UNKNOWN
English - United States
RT_ICON
103
2.66969
90
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG
107
2.52183
160
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
10
Malicious processes
3
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start bbflbk5.exe no specs bbflbk5.exe ns1ab2.tmp no specs defconfig.exe no specs ns1b9e.tmp no specs defconfig.exe no specs ns1eac.tmp no specs defconfig.exe no specs flashback recorder.exe flashback player.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3956"C:\Users\admin\Desktop\bbflbk5.exe" C:\Users\admin\Desktop\bbflbk5.exe—explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
5.42.0.4556
2220"C:\Users\admin\Desktop\bbflbk5.exe" C:\Users\admin\Desktop\bbflbk5.exe
explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
5.42.0.4556
1944"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1AB2.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1AB2.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3444"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1AB2.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
2244"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1B9E.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1B9E.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2536"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1B9E.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
3224"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1EAC.tmp" C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\ns1EAC.tmp—bbflbk5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2112"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe" -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll" "FlashBack5"C:\Program Files\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe—ns1EAC.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
2628"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe
bbflbk5.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
HIGH
Description:
FlashBack Pro 5 Recorder
Exit code:
0
Version:
5.42.0.4556
3816"C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe" C:\Program Files\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe—explorer.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
MEDIUM
Description:
FlashBack Pro 5 Player
Version:
5.42.0.4556
Total events
573
Read events
321
Write events
0
Delete events
0

Modification events

No data
Executable files
86
Suspicious files
5
Text files
125
Unknown types
33

Dropped files

PID
Process
Filename
Type
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\RemPendingFileOp.dllexecutable
MD5:A06945198BDFAF5925DDE537AFCEAAE6
SHA256:B7057BB7065B54F674455D1059116CB7ED1F49AC93CB1EE72602CDC2CD82C514
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\spltmp.bmpimage
MD5:773A9A6E0A41F2F7BEFDADFC49BB03C9
SHA256:75F9D45676036C8E7F2373B64C1B13DBD2865E1311DED0040DA3DF8CAC5080B2
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\borlndmm.dllexecutable
MD5:F58A883F64B727BCEAB5ED06AA8F3335
SHA256:3BEED8F5DD120B3625210CEBE4E4F2B2DA97B698F73A083E75990089761B08D2
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\vclie260.bplexecutable
MD5:A908B5B6B3CE7BDEEEE67D918D2DB3FD
SHA256:97F7057E8C1A9D7DF400A2C8B85BB22BEB7F9A15038231DD7C70888F65149EF3
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\soaprtl260.bplexecutable
MD5:7A5E310B561402FF7A2F38A6ECDC98AA
SHA256:A2D7BA4E8A04CB42213D6E3D5224DC974B5D96BF92E0F80F1E9D383229411B7B
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\bcbie260.bplexecutable
MD5:DB388F32B782F86FB24835837906216D
SHA256:3C5F469163285C3DC9C468DFDBF854112B16A6495BA6230C73885165D5F5A883
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\links.initext
MD5:F3FBBFF673BBB0D1EE62FA77BCFBD88E
SHA256:664B69A2C207B89130BA3F934A85E06CB943983DAC2E5622BC5282DE603F1FD8
2220bbflbk5.exeC:\Users\admin\AppData\Local\Temp\nso8FA8.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2220bbflbk5.exeC:\Program Files\Blueberry Software\FlashBack Pro 5\inet260.bplexecutable
MD5:7486A77F527EA87C1F7664672C592427
SHA256:1DF1B6FF8C99E62AB8DB60322B96ED1D4D5F6F2D6C10F5B05DB6789663F9F022
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
2628
FlashBack Recorder.exe
POST
200
104.27.151.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
2.21 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
FlashBack Recorder.exe
104.27.151.13:80
regsys.ws.bbsoftware.co.uk
Cloudflare Inc
US
shared
2628
FlashBack Recorder.exe
54.171.208.68:80
stats.ws.bbsoftware.co.uk
Amazon.com, Inc.
IE
suspicious

DNS requests

Domain
IP
Reputation
regsys.ws.bbsoftware.co.uk
  • 104.27.151.13
  • 104.27.150.13
malicious
stats.ws.bbsoftware.co.uk
  • 54.171.208.68
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bbflbk5.exe