|
Analyzing...
|
File Name: name.exe
SHA1: 32a60427d3847f46bf4ba46d5236b8e9e17ee6b2
MD5: 2963897646f6008e4d4222d57e4f38a4
First Seen Date: 2017-04-07 07:54:04.048729 ( )
Number of Clients Seen: 5
Last Analysis Date: 2022-07-13 12:31:36.159987 ( )
Human Expert Analysis Date: 2022-07-13 12:24:34.403716 ( )Human Expert Analysis Result: Malware
Analysis Summary
| Analysis Type | Date | Verdict | |
|---|---|---|---|
| Signature Based Detection | 2020-06-11 03:08:24.169685 | Malware | |
| Static Analysis Overall Verdict | 2022-07-13 12:31:36.159987 | No Threat Found | help |
| Dynamic Analysis Overall Verdict | 2022-07-13 12:31:36.159987 | Highly Suspicious | |
| Precise Detectors Overall Verdict | 2022-07-13 12:31:36.159987 | No Match | help |
| Human Expert Analysis Overall Verdict | 2022-07-13 12:24:34.403716 | Malware | |
Static Analysis
| Static Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Detector | Result | |
|---|---|---|
| Optional Header LoaderFlags field is valued illegal | Clean | |
| Non-ascii or empty section names detected | Clean | |
| Illegal size of optional Header | Clean | |
| Packer detection on signature database | Unknown | help |
| Based on the sections entropy check! file is possibly packed | Suspicious | |
| Timestamp value suspicious | Clean | |
| Header Checksum is zero! | Suspicious | |
| Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
| Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
| Anti-vm present | Clean | |
| The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
| TLS callback functions array detected | Clean | |
Packer detection on signature database
Microsoft Visual C# / Basic .NET
.NET executable
Dynamic Analysis
| Dynamic Analysis Overall Verdict | Result |
|---|---|
| Highly Suspicious |
| Suspicious Behaviors | |
|---|---|
| Operation successfully finished. | |
Behavioral Information
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
file
Load
DisplayName
ConfigMask
ConfigString
MVID
EvalationData
Status
ILDependencies
NIDependencies
MissingDependencies
Modules
SIG
LastModTime
Microsoft.VisualBasic
System
System.Xml
System.Configuration
System.Web
System.Management
System.Runtime.Remoting
System.Deployment
System.Drawing
System.Windows.Forms
System.Runtime.Serialization.Formatters.Soap
Accessibility
System.Security
System.Data.SqlXml
<NULL>
Software\Microsoft\Windows NT\CurrentVersion\Windows
C:\[uname.exe]
C:\Windows\system32\rsaenh.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config
C:\[uname.config
policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
NI\1c22df2f\4f99a7c9
NI\1c22df2f\4f99a7c9\66
IL\c991064\5086dba8\51
IL\6dc7d4c0\c47ad54\56
IL\3ced59c5\48d69eb2\54
IL\f6e8397\628bc3e2\47
IL\2b1a4e4\3822b536\f
IL\24bf93f6\708deaf7\46
IL\4f99a7c9\191b956f\66
NI\30bc7c4f\3f50fe4f\18
IL\424bd4d8\324708cb\5c
IL\19ab8d57\c91dbb2\5e
IL\3f50fe4f\265c633d\60
policy.2.0.System__b77a5c561934e089
policy.2.0.System.Xml__b77a5c561934e089
policy.2.0.System.Configuration__b03f5f7f11d50a3a
policy.2.0.System.Web__b03f5f7f11d50a3a
policy.2.0.System.Management__b03f5f7f11d50a3a
policy.2.0.System.Runtime.Remoting__b77a5c561934e089
policy.2.0.System.Deployment__b03f5f7f11d50a3a
policy.2.0.System.Drawing__b03f5f7f11d50a3a
policy.2.0.System.Windows.Forms__b77a5c561934e089
SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
NI\61e7e666\c991064
NI\61e7e666\c991064\a
IL\475dce40\1c022996\5b
IL\2dd6ac50\553abeb3\58
IL\41c04c7e\4bf62c79\50
NI\3cca06a0\6dc7d4c0\b
policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
policy.2.0.Accessibility__b03f5f7f11d50a3a
policy.2.0.System.Security__b03f5f7f11d50a3a
NI\6faf58\19ab8d57
NI\6faf58\19ab8d57\15
IL\75638fee\27002c8f\5a
policy.2.0.System.Data.SqlXml__b77a5c561934e089
CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
NI\9e7b1d6\42a1e6cd
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\C:|[uname.exe]
Software\Microsoft\Installer\Assemblies\C:|[uname.exe]
SOFTWARE\Classes\Installer\Assemblies\C:|[uname.exe]
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\Global
Software\Microsoft\Installer\Assemblies\Global
SOFTWARE\Classes\Installer\Assemblies\Global
NI\9e7b1d6\7c05469e
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\win7\AppData\Local\Temp\FolderN\name.exe.lnk " /f
"cmd.exe"
NTDLL.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\12dc10e5c0e8d176cf21a16a6fc5fc3b\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5a401fd2a7689ff13fb54182953f9c40\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6949c4470a81970ec3de0a575d93babc\System.Windows.Forms.ni.dll
CRYPTSP.dll
ADVAPI32.dll
CRYPTBASE.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
bcrypt.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
advapi32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
ntdll.dll
mscoree.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
CreateProcess
CreateProcessW
Precise Detectors Analysis Results
| Detector Name | Date | Verdict | Reason | |
|---|---|---|---|---|
| Static Precise PUA Detector 1 | 2017-04-10 23:11:47.024404 | No Match | help | NotDetected |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date: 2022-07-13 06:28:02.067432 ( )
Analysis End Date: 2022-07-13 12:24:34.403716 ( )
File Upload Date: 2017-04-07 07:54:05.549159 ( )
Update Date: 2022-07-13 12:31:19.830002 ( )
Human Expert Analyst Feedback:
Verdict: Malware
Malware Family:
Malware Type: Trojan Generic
Additional File Information
| Property | Value |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|