Analyzing...

File Name: FreemakeVideoDownloaderFull34.exe

SHA1: 1bb69abefd267f74954182a6b62d9e2c2bf22993

MD5: d5ca3f77804509fe248db7c7af584d0a

First Seen Date: 2017-06-09 21:06:57.088027 ( 2017-06-09 21:06:57.088027 )

Number of Clients Seen: 5

Last Analysis Date: 2017-06-09 21:06:57.088027 ( 2017-06-09 21:06:57.088027 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-06-09 21:06:57.088027	Malware
Static Analysis Overall Verdict	2017-06-09 21:06:57.088027	No Threat Found
Dynamic Analysis Overall Verdict	2017-06-09 21:06:57.088027	No Threat Found
Precise Detectors Overall Verdict	2017-06-09 21:06:57.088027	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Suspicious
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Opens a file in a system directory

Behavioral Information

RegCloseKey

13c

100

134

QueryFilePath

C:\Users\win7\AppData\Local\Temp\is-9H1FA.tmp\FreemakeVideoDownloaderFull34.tmp

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

LowerChar

reemakeVideoDownloaderFull34

reemakevideodownloaderfull34

ReadRegisteryKey

Plane16

MS Shell Dlg 2

Plane14

Plane15

Plane12

Plane13

Plane10

Plane11

Plane4

Plane5

Plane6

Disable

Plane7

Plane1

Plane2

Plane3

DataFilePath

Plane8

Plane9

SetFilePointer

{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18fe1c", "hFile": "120"}

{"lDistanceToMove": "11b89b1", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe0c", "hFile": "120"}

{"lDistanceToMove": "11983ba", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe28", "hFile": "120"}

{"lDistanceToMove": "11b74ea", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe0c", "hFile": "120"}

{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18fe24", "hFile": "120"}

CreateFile

{"dwCreationDisposition": "1", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\Setup Log 2017-06-10 #001.txt", "dwDesiredAccess": "c0000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\staticcache.dat", "dwDesiredAccess": "80000000", "dwShareMode": "5"}

{"dwCreationDisposition": "3", "path": "C:\\FreemakeVideoDownloaderFull34.exe", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

OpenRegisteryKey

{"hKey": "13c", "phkResult": "0", "lpSubKey": "Tahoma"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\CodeGear\\Locales"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Freemake Video Downloader_is1"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Delphi\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\CurrentControlSet\\Control\\Keyboard Layouts\\04090409"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\CurrentControlSet\\Control\\Keyboard Layouts\\041F0409"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\CodeGear\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Freemake Video Downloader_is1"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"}

OpenMutex

Local\MSCTF.Asm.MutexDefault1

WriteFile

{"nNumberOfBytesToWrite": "3", "lpOverlapped": "0", "lpBuffer": "502278", "lpNumberOfBytesWritten": "18fc98", "hFile": "12c"}

{"nNumberOfBytesToWrite": "22", "lpOverlapped": "0", "lpBuffer": "7f62bc", "lpNumberOfBytesWritten": "18fc98", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1b", "lpOverlapped": "0", "lpBuffer": "8aa88c", "lpNumberOfBytesWritten": "18fcdc", "hFile": "12c"}

{"nNumberOfBytesToWrite": "2", "lpOverlapped": "0", "lpBuffer": "86187c", "lpNumberOfBytesWritten": "18fcdc", "hFile": "12c"}

{"nNumberOfBytesToWrite": "57", "lpOverlapped": "0", "lpBuffer": "2a56cac", "lpNumberOfBytesWritten": "18fd54", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1a", "lpOverlapped": "0", "lpBuffer": "88d64c", "lpNumberOfBytesWritten": "18fcdc", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1a", "lpOverlapped": "0", "lpBuffer": "88d64c", "lpNumberOfBytesWritten": "18fd54", "hFile": "12c"}

{"nNumberOfBytesToWrite": "13", "lpOverlapped": "0", "lpBuffer": "89c9dc", "lpNumberOfBytesWritten": "18fcdc", "hFile": "12c"}

{"nNumberOfBytesToWrite": "38", "lpOverlapped": "0", "lpBuffer": "2a6d17c", "lpNumberOfBytesWritten": "18fd54", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1f", "lpOverlapped": "0", "lpBuffer": "8367fc", "lpNumberOfBytesWritten": "18fd00", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1a", "lpOverlapped": "0", "lpBuffer": "88d64c", "lpNumberOfBytesWritten": "18fd00", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1a", "lpOverlapped": "0", "lpBuffer": "88d64c", "lpNumberOfBytesWritten": "18fc98", "hFile": "12c"}

{"nNumberOfBytesToWrite": "2", "lpOverlapped": "0", "lpBuffer": "861864", "lpNumberOfBytesWritten": "18fd54", "hFile": "12c"}

{"nNumberOfBytesToWrite": "2", "lpOverlapped": "0", "lpBuffer": "861864", "lpNumberOfBytesWritten": "18fc98", "hFile": "12c"}

{"nNumberOfBytesToWrite": "31", "lpOverlapped": "0", "lpBuffer": "85422c", "lpNumberOfBytesWritten": "18fcdc", "hFile": "12c"}

{"nNumberOfBytesToWrite": "2", "lpOverlapped": "0", "lpBuffer": "86187c", "lpNumberOfBytesWritten": "18fd00", "hFile": "12c"}

{"nNumberOfBytesToWrite": "2b", "lpOverlapped": "0", "lpBuffer": "2a73bd4", "lpNumberOfBytesWritten": "18fd54", "hFile": "12c"}

LoadLibrary

C:\Users\win7\AppData\Local\Temp\is-9H1FA.tmp\FreemakeVideoDownloaderFull34.ENU

C:\Users\win7\AppData\Local\Temp\is-9H1FA.tmp\FreemakeVideoDownloaderFull34.EN

imm32.dll

uxtheme.dll

shell32.dll

C:\Windows\system32\ole32.dll

ADVAPI32.dll

comctl32.dll

UxTheme.dll

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Uninstaller FP Detector	2017-06-09 21:06:32.590575	No Match	No match.
Yara Rule Static Malware Detector	2017-06-09 21:06:32.801691	No Match	No match.
Static Precise PUA Detector 1	2017-06-09 21:06:32.608667	No Match	NotDetected
Static Precise Virus Detector	2017-06-09 21:06:32.721385	No Match	NotDetected
Static Precise Trojan Detector	2017-06-09 21:06:32.822556	No Match	NotDetected
Malicious Url Detector	2017-06-09 21:06:56.978863	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5