Analyzing...

File Name: webplugin.exe

SHA1: 359c0bbe7a69c0a6877c6d8320043499382b8877

MD5: 3702ab1e600e5c635249f63e3d33a0e0

First Seen Date: 2017-06-14 01:16:52.127460 ( 2017-06-14 01:16:52.127460 )

Number of Clients Seen: 5

Last Analysis Date: 2017-07-28 08:23:12.972075 ( 2017-07-28 08:23:12.972075 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-07-28 08:23:12.972075	Malware
Static Analysis Overall Verdict	2017-07-28 08:23:12.972075	No Threat Found
Dynamic Analysis Overall Verdict	2017-07-28 08:23:12.972075	No Threat Found
Precise Detectors Overall Verdict	2017-07-28 08:23:12.972075	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Suspicious
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Suspicious
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Packer detection on signature database

Armadillo v1.71

Microsoft Visual C++ v5.0/v6.0 (MFC)

Microsoft Visual C++

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Has no visible windows
Reads memory of another process

Behavioral Information

QueryFilePath

C:\webplugin.exe

C:\Windows\system32\PROPSYS.dll

ReadRegisteryKey

FrameMerging

CreateUriCacheSize

EnablePunycode

DisableSecuritySettingsCheck

SpecialFoldersCacheSize

FrameTabWindow

SessionMerging

AdminTabProcs

TabProcGrowth

SystemSetupInProgress

SetFilePointer

{"lDistanceToMove": "c3302", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a490", "hFile": "d8"}

{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18a54c", "hFile": "d8"}

{"lDistanceToMove": "20", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a4d8", "hFile": "d8"}

{"lDistanceToMove": "c3302", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a3ec", "hFile": "d8"}

{"lDistanceToMove": "1cd", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a4d8", "hFile": "d8"}

{"lDistanceToMove": "20", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a578", "hFile": "d8"}

{"lDistanceToMove": "1cd", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a578", "hFile": "d8"}

{"lDistanceToMove": "c34cf", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18a534", "hFile": "d8"}

{"lDistanceToMove": "0", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "0", "hFile": "228"}

{"lDistanceToMove": "0", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "18a54c", "hFile": "d8"}

CreateFile

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\unregist.bat", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\dhnetsdk.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\WebActiveEXE.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\mjpegdec.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\TimeGridEXE.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\dhplay.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\h264dec.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\7zResource.7z", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\VideoWindow.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\timeAxesDll.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\Version.ini", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\registPlugin.bat", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\npmedia.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\registPlugin.bat", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\uninstall.exe", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\7zResource.7z", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\DHSurveillanceDll.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\npTimeGrid.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\registPlugin.bat", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

{"dwCreationDisposition": "2", "path": "C:\\Program Files\\webrec\\WEB30\\WebPlugin\\postproc.dll", "dwDesiredAccess": "40000000", "dwShareMode": "1"}

OpenRegisteryKey

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "178", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_LOCALMACHINE_LOCKDOWN"}

{"hKey": "17c", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_PROTOCOL_LOCKDOWN"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\Setup"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "168", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

CreateMutex

smartplayerclient

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

<NULL>

WriteFile

{"nNumberOfBytesToWrite": "c34f3", "lpOverlapped": "0", "lpBuffer": "40d180", "lpNumberOfBytesWritten": "18eccc", "hFile": "d8"}

{"nNumberOfBytesToWrite": "1c000", "lpOverlapped": "0", "lpBuffer": "2474c77", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "14076", "lpOverlapped": "0", "lpBuffer": "249bc77", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "20057", "lpOverlapped": "0", "lpBuffer": "2454c20", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "45000", "lpOverlapped": "0", "lpBuffer": "23c9020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "1e000", "lpOverlapped": "0", "lpBuffer": "226b020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "124", "lpOverlapped": "0", "lpBuffer": "c14ba4", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "82000", "lpOverlapped": "0", "lpBuffer": "2347020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "1e000", "lpOverlapped": "0", "lpBuffer": "24bdced", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "31c", "lpOverlapped": "0", "lpBuffer": "c14888", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "22", "lpOverlapped": "0", "lpBuffer": "c14cc8", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "d000", "lpOverlapped": "0", "lpBuffer": "2250020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "b000", "lpOverlapped": "0", "lpBuffer": "2490c77", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "46c00", "lpOverlapped": "0", "lpBuffer": "240e020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "be000", "lpOverlapped": "0", "lpBuffer": "2289020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "e000", "lpOverlapped": "0", "lpBuffer": "24afced", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

{"nNumberOfBytesToWrite": "e000", "lpOverlapped": "0", "lpBuffer": "225d020", "lpNumberOfBytesWritten": "18a60c", "hFile": "dc"}

CreateProcess

"C:\Program Files\webrec\WEB30\WebPlugin\registPlugin.bat" WebPlugin

LoadLibrary

ADVAPI32.dll

propsys.dll

ole32.dll

comctl32.dll

SHELL32.dll

ntmarta.dll

Secur32.dll

API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL

api-ms-win-downlevel-advapi32-l2-1-0.dll

OLEAUT32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Program Files\webrec\WEB30\WebPlugin\registPlugin.bat

DeleteFile

C:\Program Files\webrec\WEB30\WebPlugin\7zResource.7z

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise Adware InstallCore Detector 1	2017-07-28 08:22:56.895397	No Match	No match.
Static Precise Adware Prepscram 1	2017-07-28 08:22:56.899609	No Match	No match.
Static Precise Trojan Cryptor Detector 1	2017-07-28 08:22:56.905631	No Match	No match.
Static Precise Trojan Generic Cryptor Detector 1	2017-07-28 08:22:56.907940	No Match	No match.
Yara Rule Static Malware Detector	2017-07-28 08:22:56.911573	No Match	No match.
Static Precise PUA Detector 1	2017-07-28 08:22:56.933933	No Match	NotDetected
Static Precise Virus Detector	2017-07-28 08:22:56.935012	No Match	NotDetected
Static Precise Trojan Detector	2017-07-28 08:22:56.946246	No Match	NotDetected
Static Precise PUA Detector 2	2017-07-28 08:22:56.946973	No Match	No match.
Static Precise PUA Detector 3	2017-07-28 08:22:56.969533	No Match	No match.
Static Precise Virus Detector 2	2017-07-28 08:22:56.975188	No Match	No match.
Static Precise Trojan Detector 2	2017-07-28 08:22:56.982065	No Match	No match.
Static Precise Trojan Detector 3	2017-07-28 08:22:56.995161	No Match	No match.
Static Precise Virus Hezhi Detector	2017-07-28 08:22:57.002237	No Match	No match.
Ransomware Chunk Detector	2017-07-28 08:23:00.630960	No Match	No match.
Malicious Url Detector	2017-07-28 08:23:12.938636	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5