Analyzing...

File Name: FreeTrimMP3.exe

SHA1: 369a743dfa5d5b94f53d182500587e1c5c2a4edf

MD5: 79cbb3c5484496766d0c8363d106d1bb

First Seen Date: 2017-07-08 11:28:27.130327 ( 2017-07-08 11:28:27.130327 )

Number of Clients Seen: 5

Last Analysis Date: 2017-09-13 16:01:42.850903 ( 2017-09-13 16:01:42.850903 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-09-13 16:01:42.850903	PUA
Static Analysis Overall Verdict	2017-09-13 16:01:42.850903	No Threat Found
Dynamic Analysis Overall Verdict	2017-09-13 16:01:42.850903	No Threat Found
Precise Detectors Overall Verdict	2017-09-13 16:01:42.850903	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Suspicious
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Opens a file in a system directory
Uses a function clandestinely

Behavioral Information

CreateRegisteryKey

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fde8", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fdec", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fdc8", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fddc", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fdf8", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fdfc", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

RegCloseKey

150

144

22c

120

114

258

14c

224

QueryFilePath

C:\Users\win7\AppData\Local\Temp\is-R0S59.tmp\FreeTrimMP3.tmp

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\itdownload.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\uwIknPJtj.dll

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

ReadRegisteryKey

AppData

Plane4

Plane5

Plane6

Plane7

Plane1

Plane2

Plane3

Plane8

Plane9

WaitToKillServiceTimeout

RegisteredOrganization

CommonFilesDir

Disable

DataFilePath

Plane16

Plane14

Plane15

Plane12

Plane13

Plane10

Plane11

SystemProductName

RegisteredOwner

ProgramFilesDir

RegSetValue

{"Reserved": "0", "hKey": "150", "lpData": "384c08", "dwType": "3", "lpValueName": "Owner", "cbData": "c"}

{"Reserved": "0", "hKey": "150", "lpData": "3857a8", "dwType": "3", "lpValueName": "SessionHash", "cbData": "20"}

{"Reserved": "0", "hKey": "14c", "lpData": "18fe24", "dwType": "4", "lpValueName": "Sequence", "cbData": "4"}

SetFilePointer

{"lDistanceToMove": "1e600", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "17f9f8", "hFile": "218"}

{"lDistanceToMove": "129968", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe64", "hFile": "114"}

{"lDistanceToMove": "0", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "17f9ec", "hFile": "14c"}

{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18fe74", "hFile": "114"}

{"lDistanceToMove": "32200", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "17f9f8", "hFile": "14c"}

{"lDistanceToMove": "0", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "17f9ec", "hFile": "218"}

{"lDistanceToMove": "eea00", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "17f9f8", "hFile": "14c"}

{"lDistanceToMove": "e200", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fba8", "hFile": "154"}

{"lDistanceToMove": "1a196", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fba8", "hFile": "154"}

{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18fe7c", "hFile": "114"}

{"lDistanceToMove": "108b9a", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fba8", "hFile": "154"}

{"lDistanceToMove": "11dad8", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe80", "hFile": "114"}

{"lDistanceToMove": "129a31", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fe64", "hFile": "114"}

CreateFile

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-NLKCF.tmp\\uwIknPJtj.dll", "dwDesiredAccess": "40000000", "dwShareMode": "0"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-NLKCF.tmp\\isxdl.dll", "dwDesiredAccess": "40000000", "dwShareMode": "0"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-NLKCF.tmp\\_isetup\\_setup64.tmp", "dwDesiredAccess": "c0000000", "dwShareMode": "0"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-NLKCF.tmp\\itdownload.dll", "dwDesiredAccess": "40000000", "dwShareMode": "0"}

{"dwCreationDisposition": "3", "path": "C:\\FreeTrimMP3.exe", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\staticcache.dat", "dwDesiredAccess": "80000000", "dwShareMode": "5"}

OpenRegisteryKey

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SYSTEM\\CurrentControlSet\\Control\\SystemInformation"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Delphi\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\RestartManager"}

{"hKey": "22c", "phkResult": "0", "lpSubKey": "MS Sans Serif"}

{"hKey": "22c", "phkResult": "0", "lpSubKey": "Tahoma"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\CurrentControlSet\\Control"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FreeTrim MP3_is1"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FreeTrim MP3_is1"}

CreateMutex

Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511

Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000

<NULL>

OpenMutex

Local\MSCTF.Asm.MutexDefault1

DefaultTabtip-MainUI

WriteFile

{"nNumberOfBytesToWrite": "10000", "lpOverlapped": "0", "lpBuffer": "17fa38", "lpNumberOfBytesWritten": "17f9ec", "hFile": "14c"}

{"nNumberOfBytesToWrite": "2200", "lpOverlapped": "0", "lpBuffer": "17fa38", "lpNumberOfBytesWritten": "17f9ec", "hFile": "14c"}

{"nNumberOfBytesToWrite": "10000", "lpOverlapped": "0", "lpBuffer": "17fa38", "lpNumberOfBytesWritten": "17f9ec", "hFile": "218"}

{"nNumberOfBytesToWrite": "ea00", "lpOverlapped": "0", "lpBuffer": "17fa38", "lpNumberOfBytesWritten": "17f9ec", "hFile": "14c"}

{"nNumberOfBytesToWrite": "e600", "lpOverlapped": "0", "lpBuffer": "17fa38", "lpNumberOfBytesWritten": "17f9ec", "hFile": "218"}

{"nNumberOfBytesToWrite": "1800", "lpOverlapped": "0", "lpBuffer": "4b2ac4", "lpNumberOfBytesWritten": "18fdb8", "hFile": "120"}

LoadLibrary

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

C:\Windows\system32\uxtheme.dll

C:\Windows\system32\shell32.dll

ADVAPI32.dll

ole32.dll

comctl32.dll

C:\Windows\system32\shfolder.dll

C:\Windows\system32\Rstrtmgr.dll

C:\Windows\SysWOW64\bcryptprimitives.dll

user32.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\itdownload.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\itdownload.ENU

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\itdownload.EN

ws2_32.dll

API-MS-Win-Security-SDDL-L1-1-0.dll

WS2_32.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\isxdl.dll

wininet.dll

Kernel32.dll

UxTheme.dll

IMM32.dll

C:\Windows\system32\imageres.dll

C:\Windows\system32\shlwapi.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\uwIknPJtj.dll

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\uwIknPJtj.ENU

C:\Users\win7\AppData\Local\Temp\is-NLKCF.tmp\uwIknPJtj.EN

kernel32

OLEAUT32.DLL

QueryProcessAddress

InternetReadFile

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise Trojan Detector 2	2017-09-13 16:00:54.705195	No Match	NotDetected
Static Precise Trojan Detector 3	2017-09-13 16:00:54.722968	No Match	NotDetected
Static Precise Adware InstallCore Detector 1	2017-09-13 16:00:54.701241	No Match	NotDetected
Static Precise Trojan Generic Cryptor Detector 1	2017-09-13 16:00:54.721850	No Match	NotDetected
Static Precise PUA Detector 1	2017-09-13 16:00:54.746542	No Match	NotDetected
Static Precise Virus Detector	2017-09-13 16:00:54.776695	No Match	NotDetected
Static Precise Trojan Detector	2017-09-13 16:00:54.773774	No Match	NotDetected
Static Precise Virus Detector 2	2017-09-13 16:00:54.776937	No Match	NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5