|
Analyzing...
|
File Name: ZippyUploader.exe
SHA1: 7e1e613978dd77ba30dda0184d8abe3f43f79e78
MD5: 9472a797e9cec61c90aabcd1f551c677
First Seen Date: 2017-12-06 18:40:18.937212 ( )
Number of Clients Seen: 5
Last Analysis Date: 2017-12-06 18:40:18.937212 ( )
Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.
Analysis Summary
| Analysis Type | Date | Verdict | |
|---|---|---|---|
| Signature Based Detection | 2017-12-06 18:40:18.937212 | Clean | |
| Static Analysis Overall Verdict | 2017-12-06 18:40:18.937212 | No Threat Found | help |
| Dynamic Analysis Overall Verdict | 2017-12-06 18:40:18.937212 | No Threat Found | help |
| Precise Detectors Overall Verdict | 2017-12-06 18:40:18.937212 | No Match | help |
Static Analysis
| Static Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Detector | Result | |
|---|---|---|
| Optional Header LoaderFlags field is valued illegal | Clean | |
| Non-ascii or empty section names detected | Clean | |
| Illegal size of optional Header | Clean | |
| Packer detection on signature database | Unknown | help |
| Based on the sections entropy check! file is possibly packed | Suspicious | |
| Timestamp value suspicious | Clean | |
| Header Checksum is zero! | Suspicious | |
| Enrty point is outside the 1st(.code) section! Binary is possibly packed | Suspicious | |
| Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
| Anti-vm present | Clean | |
| The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
| TLS callback functions array detected | Clean | |
Packer detection on signature database
UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]
Dynamic Analysis
| Dynamic Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Suspicious Behaviors | |
|---|---|
| Opens a file in a system directory | |
| Uses a function clandestinely | |
| Has no visible windows | |
Behavioral Information
C:\ZippyUploader.exe
C:\Windows\syswow64\USER32.dll
C:\Windows\syswow64\MSCTF.dll
C:\Windows\Fonts\staticcache.dat
Local\MSCTF.Asm.MutexDefault1
KERNEL32.DLL
ADVAPI32.DLL
COMCTL32.DLL
COMDLG32.DLL
GDI32.DLL
OLE32.DLL
OLEAUT32.DLL
SHELL32.DLL
USER32.DLL
VERSION.DLL
C:\ZippyUploader.ENU
C:\ZippyUploader.EN
UxTheme.dll
dwmapi.dll
msimg32.dll
USER32
gdiplus.dll
Wship6.dll
uxtheme.dll
comctl32.dll
ADVAPI32.dll
WS2_32.DLL
API-MS-Win-Security-SDDL-L1-1-0.dll
WS2_32.dll
C:\ZippyUploader.exe
imageres.dll
C:\Windows\system32\ole32.dll
C:\Windows\syswow64\MSCTF.dll
IMM32.dll
HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_CURRENT_USERSoftware\Borland\C++Builder
HKEY_CURRENT_USERSoftware\Embarcadero\BDS
HKEY_LOCAL_MACHINESoftware\Borland\Locales
HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_CURRENT_USERSoftware\Borland\Delphi
HKEY_CURRENT_USERSoftware\Borland\Delphi\Locales
HKEY_CURRENT_USERSoftware\Borland\Locales
HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_CURRENT_USERSoftware\CodeGear\BDS
HKEY_CURRENT_USERSoftware\Borland\BDS
SetWindowsHookExA
GetAsyncKeyState
CreateProcessA
ShellExecuteA
Precise Detectors Analysis Results
| Detector Name | Date | Verdict | Reason | |
|---|---|---|---|---|
| Static Precise PUA Detector 1 | 2017-12-06 18:40:00.950850 | No Match | help | NotDetected |
| Static Precise Virus Detector | 2017-12-06 18:40:00.984290 | No Match | help | NotDetected |
| Static Precise Trojan Detector | 2017-12-06 18:40:00.983464 | No Match | help | NotDetected |
| Static Precise Adware InstallCore Detector 1 | 2017-12-06 18:40:00.983075 | No Match | help | NotDetected |
| Static Precise Trojan Detector 2 | 2017-12-06 18:40:00.983151 | No Match | help | NotDetected |
| Static Precise Trojan Detector 3 | 2017-12-06 18:40:00.982488 | No Match | help | NotDetected |
| Static Precise Trojan Generic Cryptor Detector 1 | 2017-12-06 18:40:00.982100 | No Match | help | NotDetected |
| Static Precise Virus Detector 2 | 2017-12-06 18:40:00.984035 | No Match | help | NotDetected |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Additional File Information
| Property | Value |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|