Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FileOpenInstaller.exe

Overview

General Information

Sample Name:FileOpenInstaller.exe
Analysis ID:800687
MD5:599ebd4af31288db879786f49bf9487d
SHA1:ee40630abcb1fe05051c3f832c72c2ee99722c35
SHA256:f469734bc576a00e113bc43b1b1a13de3c74f5370c5b9db8b9289bd9cf8aac31
Infos:

Detection

Score:17
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Obfuscated command line found
Uses 32bit PE files
Sample file is different than original file name gathered from version info
Drops PE files
PE file contains sections with non-standard names
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
PE file contains executable resources (Code or Archives)
Creates a process in suspended mode (likely to inject code)

Classification

Analysis Advice

Sample searches for specific file, try point organization specific fake files to the analysis machine
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

  • System is w7x64
  • FileOpenInstaller.exe (PID: 1216 cmdline: C:\Users\user\Desktop\FileOpenInstaller.exe MD5: 599EBD4AF31288DB879786F49BF9487D)
    • FileOpenInstaller.tmp (PID: 1184 cmdline: "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe" MD5: B7988AC379CEAA456BAA3EF19EB55263)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: FileOpenInstaller.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2023-02-07 #001.txtJump to behavior
Source: FileOpenInstaller.exeStatic PE information: certificate valid
Source: FileOpenInstaller.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://ocsp.digicert.com0A
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://ocsp.digicert.com0H
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://ocsp.digicert.com0I
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://ocsp.digicert.com0X
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://www.digicert.com/CPS0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drString found in binary or memory: http://www.fileopen.com/0
Source: FileOpenInstaller.exe, 00000001.00000003.917681244.000000000062A000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000003.916780670.000000000099D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fileopen.com/request-tech-support/
Source: FileOpenInstaller.exe, 00000001.00000003.917681244.000000000062A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fileopen.com/request-tech-support/Q
Source: FileOpenInstaller.exe, 00000001.00000003.905803433.00000000022D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fileopen.com/request-tech-support/Zhttp://www.fileopen.com/request-tech-support/
Source: FileOpenInstaller.tmp, 00000002.00000003.916780670.000000000099D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.fileopen.com/request-tech-support/q
Source: FileOpenInstaller.exe, 00000001.00000003.907181765.0000000002410000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.exe, 00000001.00000003.907784834.000000007ECB0000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000000.909042225.0000000000401000.00000020.00000001.01000000.00000004.sdmp, FileOpenInstaller.tmp.1.drString found in binary or memory: http://www.innosetup.com/
Source: FileOpenInstaller.exe, 00000001.00000003.907181765.0000000002410000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.exe, 00000001.00000003.907784834.000000007ECB0000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000000.909042225.0000000000401000.00000020.00000001.01000000.00000004.sdmp, FileOpenInstaller.tmp.1.drString found in binary or memory: http://www.remobjects.com/ps
Source: FileOpenInstaller.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: FileOpenInstaller.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: FileOpenInstaller.exe, 00000001.00000003.907784834.000000007EF91000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs FileOpenInstaller.exe
Source: FileOpenInstaller.exe, 00000001.00000002.918219897.00000000006E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs FileOpenInstaller.exe
Source: FileOpenInstaller.exe, 00000001.00000003.907181765.00000000024F5000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs FileOpenInstaller.exe
Source: FileOpenInstaller.exe, 00000001.00000000.905438476.0000000000541000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs FileOpenInstaller.exe
Source: FileOpenInstaller.exeBinary or memory string: OriginalFileName vs FileOpenInstaller.exe
Source: C:\Users\user\Desktop\FileOpenInstaller.exeMemory allocated: 77620000 page execute and read and write
Source: C:\Users\user\Desktop\FileOpenInstaller.exeMemory allocated: 77740000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpMemory allocated: 77620000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpMemory allocated: 77740000 page execute and read and write
Source: FileOpenInstaller.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile read: C:\Users\user\Desktop\FileOpenInstaller.exeJump to behavior
Source: C:\Users\user\Desktop\FileOpenInstaller.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\FileOpenInstaller.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\FileOpenInstaller.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: unknownProcess created: C:\Users\user\Desktop\FileOpenInstaller.exe C:\Users\user\Desktop\FileOpenInstaller.exe
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmpJump to behavior
Source: FileOpenInstaller.exeString found in binary or memory: /LOADINF="filename"
Source: classification engineClassification label: clean17.winEXE@3/2@0/0
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: FileOpenInstaller.exeStatic file information: File size 6831336 > 1048576
Source: FileOpenInstaller.exeStatic PE information: certificate valid
Source: FileOpenInstaller.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

barindex
Obfuscated command line found
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"
Source: FileOpenInstaller.exeStatic PE information: section name: .didata
Source: FileOpenInstaller.tmp.1.drStatic PE information: section name: .didata
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2023-02-07 #001.txtJump to behavior
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp
Source: C:\Users\user\Desktop\FileOpenInstaller.exeFile opened: C:\Users\user\
Source: C:\Users\user\Desktop\FileOpenInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts12
Command and Scripting Interpreter		Path Interception11
Process Injection		11
Process Injection		OS Credential Dumping1
File and Directory Discovery		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Deobfuscate/Decode Files or Information		LSASS Memory1
System Information Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 800687 Sample: FileOpenInstaller.exe Startdate: 07/02/2023 Architecture: WINDOWS Score: 17 5 FileOpenInstaller.exe 2 2->5         started        file3 11 C:\Users\user\...\FileOpenInstaller.tmp, PE32 5->11 dropped 13 Obfuscated command line found 5->13 9 FileOpenInstaller.tmp 1 5->9         started        signatures4 process5

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
FileOpenInstaller.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.innosetup.com/0%URL Reputationsafe
http://www.remobjects.com/ps0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.innosetup.com/FileOpenInstaller.exe, 00000001.00000003.907181765.0000000002410000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.exe, 00000001.00000003.907784834.000000007ECB0000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000000.909042225.0000000000401000.00000020.00000001.01000000.00000004.sdmp, FileOpenInstaller.tmp.1.drfalse
  • URL Reputation: safe
unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUFileOpenInstaller.exefalse
    		high
    http://www.fileopen.com/0FileOpenInstaller.exe, FileOpenInstaller.tmp.1.drfalse
      		high
      http://www.fileopen.com/request-tech-support/FileOpenInstaller.exe, 00000001.00000003.917681244.000000000062A000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000003.916780670.000000000099D000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        http://www.remobjects.com/psFileOpenInstaller.exe, 00000001.00000003.907181765.0000000002410000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.exe, 00000001.00000003.907784834.000000007ECB0000.00000004.00001000.00020000.00000000.sdmp, FileOpenInstaller.tmp, 00000002.00000000.909042225.0000000000401000.00000020.00000001.01000000.00000004.sdmp, FileOpenInstaller.tmp.1.drfalse
        • URL Reputation: safe
        		unknown
        http://www.fileopen.com/request-tech-support/Zhttp://www.fileopen.com/request-tech-support/FileOpenInstaller.exe, 00000001.00000003.905803433.00000000022D0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://www.fileopen.com/request-tech-support/QFileOpenInstaller.exe, 00000001.00000003.917681244.000000000062A000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            http://www.fileopen.com/request-tech-support/qFileOpenInstaller.tmp, 00000002.00000003.916780670.000000000099D000.00000004.00001000.00020000.00000000.sdmpfalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              General Information

              Joe Sandbox Version:36.0.0 Rainbow Opal
              Analysis ID:800687
              Start date and time:2023-02-07 18:09:40 +01:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 3m 31s
              Hypervisor based Inspection enabled:false
              Report type:light
              Cookbook file name:default.jbs
              Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
              Number of analysed new started processes analysed:3
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample file name:FileOpenInstaller.exe
              Detection:CLEAN
              Classification:clean17.winEXE@3/2@0/0
              EGA Information:Failed
              HDC Information:Failed
              HCA Information:
              • Successful, ratio: 100%
              • Number of executed functions: 0
              • Number of non-executed functions: 0
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Stop behavior analysis, all processes terminated

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe
              • VT rate limit hit for: FileOpenInstaller.exe

              Simulations

              Behavior and APIs

              TimeTypeDescription
              18:10:22API Interceptor38x Sleep call for process: FileOpenInstaller.tmp modified

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\Local\Temp\Setup Log 2023-02-07 #001.txt

              Download File
              Process:C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp
              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
              Category:dropped
              Size (bytes):1100
              Entropy (8bit):5.1148711354880705
              Encrypted:false
              SSDEEP:24:21g4XM47BOdXBs9OBOvzuHeWrOMdL7YjNzBEvo:gzXMe2ROOBOa+W6EL7QNlEvo
              MD5:E592A6BBE98B59DCCE026C69E35411D6
              SHA1:7161F1BB99730354B162F183260513543E9261A7
              SHA-256:278DA06FBD78E12DF7F7EA8A2F85F690B9F5B1EA4D07D99017F6ABD7FD874DEF
              SHA-512:FACD18EC182336C4BED89CA5B1408E3D5826072DE4CB5288FE974F6AB4E706E201DAD0A0478B64B80F7851CBC05F4175737C5FA24642FC97125667FE222992CF
              Malicious:false
              Reputation:low
              Preview:.2023-02-07 18:10:22.073 Log opened. (Time zone: UTC-08:00)..2023-02-07 18:10:22.073 Setup version: Inno Setup version 6.0.4 (u)..2023-02-07 18:10:22.073 Original Setup EXE: C:\Users\user\Desktop\FileOpenInstaller.exe..2023-02-07 18:10:22.073 Setup command line: /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe" ..2023-02-07 18:10:22.073 Windows version: 6.1.7601 SP1 (NT platform: Yes)..2023-02-07 18:10:22.073 64-bit Windows: Yes..2023-02-07 18:10:22.073 Processor architecture: x64..2023-02-07 18:10:22.073 User privileges: Administrative..2023-02-07 18:10:22.416 Administrative install mode: Yes..2023-02-07 18:10:22.416 Install mode root key: HKEY_LOCAL_MACHINE..2023-02-07 18:10:22.416 64-bit install mode: Yes..2023-02-07 18:10:22.416 Message box (OK):.. This program does not support the version of Windows your computer is running...2023-02-07 18:10:24.927 User chose OK...2023-02-07 18:10:24.927 Got EAbort

              C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp

              Download File
              Process:C:\Users\user\Desktop\FileOpenInstaller.exe
              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):3119936
              Entropy (8bit):6.073128166324036
              Encrypted:false
              SSDEEP:49152:IR/KpmZubPf2S8W2ILeWl+C1p9jWy5Mnd0wigbLNDH:O/jtYLP1Sy5i0qH
              MD5:B7988AC379CEAA456BAA3EF19EB55263
              SHA1:15C13A91E64739C76FF48E20C5BB4182AAD94339
              SHA-256:69383793D354F2A95D88F610B0559F321F37C97197554CD1E9D6D30B038C352D
              SHA-512:22D4544911F496B22AF502869CBDFBC371617A418EB8010319D1842A862F84CA2CA23F1BE505C5F03BD404CB2EE5E489B1FE86B3047356ACE3965F5494AA9FA6
              Malicious:true
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:low
              Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....m^..................%...........%.......%...@..........................`0.....5./...@......@....................'.......&..5...0'.|+...........z/.@!................................... '.....................L.&.H.....&......................text.....%.......%................. ..`.itext...&....%..(....%............. ..`.data...dZ....%..\....%.............@....bss.....x...0&..........................idata...5....&..6....&.............@....didata.......&......@&.............@....edata........'......J&.............@..@.tls....D.....'..........................rdata..].... '......L&.............@..@.rsrc...|+...0'..,...N&.............@..@............. (......:'.............@..@........................................................

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows
              Entropy (8bit):7.779130580328553
              TrID:
              • Win32 Executable (generic) a (10002005/4) 98.45%
              • Inno Setup installer (109748/4) 1.08%
              • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
              • Win16/32 Executable Delphi generic (2074/23) 0.02%
              • Generic Win/DOS Executable (2004/3) 0.02%
              File name:FileOpenInstaller.exe
              File size:6831336
              MD5:599ebd4af31288db879786f49bf9487d
              SHA1:ee40630abcb1fe05051c3f832c72c2ee99722c35
              SHA256:f469734bc576a00e113bc43b1b1a13de3c74f5370c5b9db8b9289bd9cf8aac31
              SHA512:1f5ab864f07bfc0900eefbc5dbc94ead881156262bf401b46c188a9b51af54247d406eb225f7d7479e75817150313e7ddefadf85ca0edc960f34f4db5d4d3f30
              SSDEEP:98304:ZEVrLQI+bHRk0ryjyKY0hMrF2t2nvuk9orCFrGD4pStQgyCsadx0tJnX1BzNE3:sMdDRk0+WG4QCOugtsa70ttX1da3
              TLSH:6E6602AF73A6902ED86A8AF105BAD3104C776F115C06CCDA13F0E5CCDB369A0FD2A655
              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

              File Icon

              Icon Hash:c0d4d4d4d4d4dc60

              Static PE Info

              General

              Entrypoint:0x4b5eec
              Entrypoint Section:.itext
              Digitally signed:true
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Time Stamp:0x5E6D1B8D [Sat Mar 14 17:59:41 2020 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:6
              OS Version Minor:0
              File Version Major:6
              File Version Minor:0
              Subsystem Version Major:6
              Subsystem Version Minor:0
              Import Hash:5a594319a0d69dbc452e748bcf05892e

              Authenticode Signature

              Signature Valid:true
              Signature Issuer:CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
              Signature Validation Error:The operation completed successfully
              Error Number:0
              Not Before, Not After
              • 3/1/2021 4:00:00 PM 3/1/2023 3:59:59 PM
              Subject Chain
              • CN=FileOpen Systems Inc., O=FileOpen Systems Inc., L=Santa Cruz, S=California, C=US, SERIALNUMBER=5070649, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization
              Version:3
              Thumbprint MD5:672CE4183DD35C3C4E6ABD4CAF549C09
              Thumbprint SHA-1:42E58D6C0DCC7076DDEB6E71534CB1F0913CD6C9
              Thumbprint SHA-256:BB460A91449CA5F96957CE80966CF8CC861F26A2FAA340DD81D50A41B9885AE8
              Serial:0FDAD5722CB13F7F2013A1CA98D144FE

              Entrypoint Preview

              Instruction
              push ebp
              mov ebp, esp
              add esp, FFFFFFA4h
              push ebx
              push esi
              push edi
              xor eax, eax
              mov dword ptr [ebp-3Ch], eax
              mov dword ptr [ebp-40h], eax
              mov dword ptr [ebp-5Ch], eax
              mov dword ptr [ebp-30h], eax
              mov dword ptr [ebp-38h], eax
              mov dword ptr [ebp-34h], eax
              mov dword ptr [ebp-2Ch], eax
              mov dword ptr [ebp-28h], eax
              mov dword ptr [ebp-14h], eax
              mov eax, 004B10D8h
              call 00007F20D8A615B5h
              xor eax, eax
              push ebp
              push 004B65DEh
              push dword ptr fs:[eax]
              mov dword ptr fs:[eax], esp
              xor edx, edx
              push ebp
              push 004B659Ah
              push dword ptr fs:[edx]
              mov dword ptr fs:[edx], esp
              mov eax, dword ptr [004BE634h]
              call 00007F20D8B03CC7h
              call 00007F20D8B0381Eh
              lea edx, dword ptr [ebp-14h]
              xor eax, eax
              call 00007F20D8A77028h
              mov edx, dword ptr [ebp-14h]
              mov eax, 004C1D3Ch
              call 00007F20D8A5C1A7h
              push 00000002h
              push 00000000h
              push 00000001h
              mov ecx, dword ptr [004C1D3Ch]
              mov dl, 01h
              mov eax, dword ptr [004237A4h]
              call 00007F20D8A7808Fh
              mov dword ptr [004C1D40h], eax
              xor edx, edx
              push ebp
              push 004B6546h
              push dword ptr fs:[edx]
              mov dword ptr fs:[edx], esp
              call 00007F20D8B03D4Fh
              mov dword ptr [004C1D48h], eax
              mov eax, dword ptr [004C1D48h]
              cmp dword ptr [eax+0Ch], 01h
              jne 00007F20D8B0A34Ah
              mov eax, dword ptr [004C1D48h]
              mov edx, 00000028h
              call 00007F20D8A78984h
              mov edx, dword ptr [004C1D48h]

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
              IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xf36.idata
              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x88578.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x681ba80x2140
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0xc22e40x244.idata
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000xb36040xb3800False0.34484761272632314data6.354329115342966IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .itext0xb50000x16840x1800False0.5445963541666666data5.970901565517897IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .data0xb70000x37a40x3800False0.36104910714285715data5.0421620677813435IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .bss0xbb0000x6da00x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .idata0xc20000xf360x1000False0.3681640625data4.8987046479600425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .didata0xc30000x1a40x200False0.345703125data2.7563628682496506IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .edata0xc40000x9a0x200False0.2578125data1.8722228665884297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .tls0xc50000x180x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .rdata0xc60000x5d0x200False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .rsrc0xc70000x885780x88600False0.05596571379468378data3.1574910512692473IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountry
              RT_ICON0xc77980x42028Device independent bitmap graphic, 256 x 512 x 32, image size 262144EnglishUnited States
              RT_ICON0x1097c00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States
              RT_ICON0x119fe80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States
              RT_ICON0x1234900x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States
              RT_ICON0x1276b80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States
              RT_ICON0x129c600x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States
              RT_ICON0x12ad080x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States
              RT_ICON0x12b6900x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States
              RT_ICON0x12baf80x12428Device independent bitmap graphic, 256 x 512 x 8, image size 65536EnglishUnited States
              RT_ICON0x13df200x4c28Device independent bitmap graphic, 128 x 256 x 8, image size 16384EnglishUnited States
              RT_ICON0x142b480x2ca8Device independent bitmap graphic, 96 x 192 x 8, image size 9216EnglishUnited States
              RT_ICON0x1457f00x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096EnglishUnited States
              RT_ICON0x146e180xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304EnglishUnited States
              RT_ICON0x147cc00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024EnglishUnited States
              RT_ICON0x1485680x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 576EnglishUnited States
              RT_ICON0x148c300x568Device independent bitmap graphic, 16 x 32 x 8, image size 256EnglishUnited States
              RT_ICON0x1491980x2868Device independent bitmap graphic, 128 x 256 x 4, image size 8192EnglishUnited States
              RT_ICON0x14ba000xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States
              RT_ICON0x14c4680x1e8Device independent bitmap graphic, 24 x 48 x 4, image size 288EnglishUnited States
              RT_STRING0x14c6500x360data
              RT_STRING0x14c9b00x260data
              RT_STRING0x14cc100x45cdata
              RT_STRING0x14d06c0x40cdata
              RT_STRING0x14d4780x2d4data
              RT_STRING0x14d74c0xb8data
              RT_STRING0x14d8040x9cdata
              RT_STRING0x14d8a00x374data
              RT_STRING0x14dc140x398data
              RT_STRING0x14dfac0x368data
              RT_STRING0x14e3140x2a4data
              RT_RCDATA0x14e5b80x10data
              RT_RCDATA0x14e5c80x2c4data
              RT_RCDATA0x14e88c0x2cdata
              RT_GROUP_ICON0x14e8b80x110dataEnglishUnited States
              RT_VERSION0x14e9c80x584dataEnglishUnited States
              RT_MANIFEST0x14ef4c0x62cXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States

              Imports

              DLLImport
              kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
              comctl32.dllInitCommonControls
              version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
              user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
              oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
              netapi32.dllNetWkstaGetInfo, NetApiBufferFree
              advapi32.dllRegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

              Exports

              NameOrdinalAddress
              TMethodImplementationIntercept30x454058
              __dbk_fcall_wrapper20x40d0a0
              dbkFCallWrapperAddr10x4be63c

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

              Statistics

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:1
              Start time:18:10:19
              Start date:07/02/2023
              Path:C:\Users\user\Desktop\FileOpenInstaller.exe
              Wow64 process (32bit):true
              Commandline:C:\Users\user\Desktop\FileOpenInstaller.exe
              Imagebase:0x400000
              File size:6831336 bytes
              MD5 hash:599EBD4AF31288DB879786F49BF9487D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:Borland Delphi
              Reputation:low

              General

              Target ID:2
              Start time:18:10:21
              Start date:07/02/2023
              Path:C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp
              Wow64 process (32bit):true
              Commandline:"C:\Users\user\AppData\Local\Temp\is-IK3FC.tmp\FileOpenInstaller.tmp" /SL5="$202B6,6054369,1320960,C:\Users\user\Desktop\FileOpenInstaller.exe"
              Imagebase:0x400000
              File size:3119936 bytes
              MD5 hash:B7988AC379CEAA456BAA3EF19EB55263
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:Borland Delphi
              Antivirus matches:
              • Detection: 0%, ReversingLabs
              Reputation:low

              Disassembly

              ⊘No disassembly