Analyzing...

File Name: KGGouWo.exe

SHA1: 08d33aaa6f1965bfebf61188d45389e396958d54

MD5: 49692cc6414f0c6481d3cd5ee4cb0f2e

First Seen Date: 2017-05-10 02:31:11.387777 ( 2017-05-10 02:31:11.387777 )

Number of Clients Seen: 8

Last Analysis Date: 2017-07-15 04:08:14.976044 ( 2017-07-15 04:08:14.976044 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-07-15 04:08:14.976044	Clean
Static Analysis Overall Verdict	2017-07-15 04:08:14.976044	No Threat Found
Dynamic Analysis Overall Verdict	2017-07-15 04:08:14.976044	No Threat Found
Precise Detectors Overall Verdict	2017-07-15 04:08:14.976044	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Suspicious
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Reads memory of another process
Opens a file in a system directory
Has no visible windows

Behavioral Information

QueryFilePath

C:\KGGouWo.exe

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

C:\Windows\system32\PROPSYS.dll

ReadRegisteryKey

Plane4

Plane5

Plane6

Plane7

Plane1

Plane2

Plane3

Plane8

Plane9

Disable

FrameTabWindow

DataFilePath

SystemSetupInProgress

EnablePunycode

DisableSecuritySettingsCheck

Plane16

Plane14

Plane15

Plane12

Plane13

Plane10

Plane11

TabProcGrowth

FrameMerging

CreateUriCacheSize

SpecialFoldersCacheSize

SessionMerging

AdminTabProcs

CreateFile

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\skin.jpg", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\Config.ini", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\msvcp120.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\about-bg.jpg", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Searches\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\progress-bar.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\setup.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\popup2.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\oauth.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico9_9.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\login.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\download-pic2.gif", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\msvcr100.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\close-1h.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico70X70.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\btn60X24.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico13_13.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\pop.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\qhyh.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\BugReport.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\KGGouWo.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\head.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Videos\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\btn69X32.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\download-pic1.gif", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Contacts\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\animations.tis", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico29X27.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\zhubo.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\changeuser.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\drag.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico12X12.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\login_slogan.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\phone-ih.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\close-1.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico35X35.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\KGGouWo.exe", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\mmxg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\list1.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\update.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\logout.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\left-menu.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\sub-ico.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\sciter32.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\loading.gif", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\msgbox.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\box2-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\bind-ico.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\head-ico.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\custom-frame-hole.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\about.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\http.tis", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html", "dwDesiredAccess": "40000000", "dwShareMode": "3"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\user.xml", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico10_6_3.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico10_6_2.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\tip-cot.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\qklog.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\game-i.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\box2-pic.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\config.xml", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\set-box-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\update.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\list2.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "\\??\\C:\\Windows\\System32\\shdocvw.dll", "dwDesiredAccess": "80", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\popup1.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico23X23.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\std-menu.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Links\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\setup.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\off-net.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\hzsz.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\clock.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\regsiter.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\close-h.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico18X21.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\qk-bind.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Saved Games\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\qd-icon.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico20X20.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ddm.tis", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\home-ih.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\login2.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\bind-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\changepass.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico10_6_4.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\prompt.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\skin-bottom.jpg", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Downloads\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\alarm.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico10_6_1.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\plugin.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\off-net.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico27X27.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\staticcache.dat", "dwDesiredAccess": "80000000", "dwShareMode": "5"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\home-i.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\tourist-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\qk-bind.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico18X18.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\part-1-ico.gif", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\logo.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\head-pic.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\clock.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\subuser.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\msgbox.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\yhtc.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\login_left.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\gamecore.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\login1.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\popup2-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\all-sound.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\corner.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\home-pic.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\scrollbar.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\alarm.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\plugin.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\game-ih.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\zxzh.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\kg-ico.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\msvcp100.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\login.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\tourist.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico8X5.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\msvcr120.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\subuser.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\KGGouWo.exe", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\changeuser.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\tourist.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\box1-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Favorites\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\btn90X32.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\setup.xml", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\8X8.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\shadow.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\yjxf.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\oauth.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\left-.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\xhgl.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\alarm.wav", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\DownCore.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res", "dwDesiredAccess": "40000000", "dwShareMode": "3"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\fillet.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\close.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\yqhy.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\divider.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\uninst.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\pop-bg.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\changepass.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico14X14.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\ipc.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\moveable-view.tis", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\phone-i.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\kftx.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\btn82X32.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\news-icon.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\head.css", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\third-party.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\about.htm", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\loading.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\html\\tourist.html", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Roaming\\GouWo\\kugou002\\res\\ico16_16.png", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

OpenRegisteryKey

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "23c", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_PROTOCOL_LOCKDOWN"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "11c", "phkResult": "0", "lpSubKey": "SimSun"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\Setup"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "224", "phkResult": "0", "lpSubKey": "FEATURE_LOCALMACHINE_LOCKDOWN"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "240", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"}

CreateMutex

<NULL>

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

UxTheme.dll

IMM32.dll

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

ADVAPI32.dll

OLEAUT32.DLL

propsys.dll

ole32.dll

SHELL32.dll

ntmarta.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Windows\System32\shdocvw.dll

PROPSYS.dll

OLEAUT32.dll

Secur32.dll

API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL

api-ms-win-downlevel-advapi32-l2-1-0.dll

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Uninstaller FP Detector	2017-07-15 04:07:56.459327	No Match	No match.
Yara Rule Static Malware Detector	2017-07-15 04:07:56.568543	No Match	No match.
Static Precise PUA Detector 1	2017-07-15 04:07:56.475843	No Match	NotDetected
Static Precise Virus Detector	2017-07-15 04:07:56.473940	No Match	NotDetected
Static Precise Trojan Detector	2017-07-15 04:07:56.481473	No Match	NotDetected
Static Precise PUA Detector 2	2017-07-15 04:07:56.505687	No Match	No match.
Static Precise PUA Detector 3	2017-07-15 04:07:56.508619	No Match	No match.
Static Precise Virus Detector 2	2017-07-15 04:07:56.505196	No Match	No match.
Static Precise Trojan Detector 2	2017-07-15 04:07:56.505056	No Match	No match.
Static Precise Trojan Detector 3	2017-07-15 04:07:56.505994	No Match	No match.
Malicious Url Detector	2017-07-15 04:08:14.900553	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5

File Name: KGGouWo.exe

SHA1: 08d33aaa6f1965bfebf61188d45389e396958d54

MD5: 49692cc6414f0c6481d3cd5ee4cb0f2e

First Seen Date: 2017-05-10 02:31:11.387777 ( 2017-05-10 02:31:11.387777 )

Number of Clients Seen: 8

Last Analysis Date: 2017-07-15 04:08:14.976044 ( 2017-07-15 04:08:14.976044 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Static Analysis

Dynamic Analysis

KGGouWo.exe tried to connect to some addresses pinned on the map below (click pins for more details):

Behavioral Information

QueryFilePath

LowerChar

ReadRegisteryKey

CreateFile

OpenRegisteryKey

CreateMutex

OpenMutex

CreateProcess

LoadLibrary

Precise Detectors Analysis Results

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

PE Sections

PE Imports

PE Exports

PE Resources