Analyzing...
|
File Name:   m1.exe
SHA1:   92eab2d3224bd1c465052dc48bca7e379c7c1cdf
MD5:   4c4e81db339f03b0b5ab0d18d3a40202
First Seen Date:  2015-10-06 10:05:27.665000 ( )
Number of Clients Seen:   5
Last Analysis Date:  2016-04-08 14:40:06.806410 ( )
Human Expert Analysis Result:   No human expert analysis verdict given to this sample yet.
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2016-04-08 14:40:06.806410 | Malware | |
Static Analysis Overall Verdict | 2016-04-08 14:40:06.806410 | Highly Suspicious | |
Dynamic Analysis Overall Verdict | 2016-04-08 14:40:06.806410 | Highly Suspicious |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Clean | |
Illegal size of optional Header | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Based on the sections entropy check! file is possibly packed | Suspicious | |
Timestamp value suspicious | Clean | |
Header Checksum is zero! | Clean | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Packer detection on signature database | Unknown | help |
Anti-vm present | Clean | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Clean |
Anti-debug calls
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Suspicious Behaviors | |
---|---|
Writes to address space of another process | |
Uses a function clandestinely | |
Has no visible windows |
Behavioral Information
C:\Windows\SysWOW64\schtasks.exe
API-MS-Win-Security-LSALookup-L1-1-0.dll
comctl32.dll
UxTheme.dll
IMM32.dll
SHELL32.dll
kernel32.dll
C:\sample
SspiCli.dll
ADVAPI32.dll
SHLWAPI.dll
KERNEL32.DLL
COMCTL32.dll
comdlg32.dll
CRYPT32.dll
iphlpapi.dll
msi.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
USER32.dll
USERENV.dll
VERSION.dll
WS2_32.dll
WTSAPI32.dll
fltlib.dll
psapi.dll
C:\Windows\system32\ole32.dll
C:\Windows\syswow64\MSCTF.dll
OLEAUT32.DLL
API-MS-Win-Security-SDDL-L1-1-0.dll
C:\Windows\system32\kernel32.dll
SHFOLDER
propsys.dll
ntmarta.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
C:\Users\win7\AppData\Local\Temp\nssE959.tmp\System.dll
C:\Users\win7\AppData\Local\Temp\nssE959.tmp\UAC.dll
AdvAPI32
SECUR32
RichEd20
C:\Users\win7\AppData\Local\Temp\nssE959.tmp\InstallOptions.dll
C:\Users\win7\AppData\Local\Temp\nssE959.tmp\ServicesHelper.dll
OLEACCRC.DLL
Mxipw5
ntdll.dll
KERNEL32.dll
c:\0
C:\Windows\system32\version.dll
c:\e4414128181412223d9e7db89e\MpSigStub.exe
advapi32
C:\Windows\system32\user32.dll
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FFD9CD54-90C2-4686-A056-5ADA54A30AF5}\mpengine.dll
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FFD9CD54-90C2-4686-A056-5ADA54A30AF5}\mpasbase.vdm
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FFD9CD54-90C2-4686-A056-5ADA54A30AF5}\mpasdlta.vdm
c:\e4414128181412223d9e7db89e\mpasdlta.vdm
c:\e4414128181412223d9e7db89e\mpengine.dll._p
c:\e4414128181412223d9e7db89e\mpasbase.vdm._p
C:\Windows\system32\mspatcha.dll
C:\Windows\system32\wer.dll
C:\e4414128181412223d9e7db89e\MPSigStub.exe
SensApi.dll
CRYPTSP.dll
CRYPTBASE.dll
C:\Windows\system32\dwmapi.dll
C:\Windows\system32\atl.dll
C:\Windows\system32\ntmarta.dll
C:\Windows\system32\winmm.dll
C:\Windows\system32\dsound.dll
C:\Windows\system32\powrprof.dll
C:\Windows\system32\d3d9.dll
C:\Windows\system32\d3d8thk.dll
C:\Windows\system32\mscms.dll
C:\Windows\system32\userenv.dll
C:\Windows\system32\profapi.dll
C:\Windows\system32\ieframe.dll
C:\Windows\system32\oleacc.dll
C:\Windows\system32\oleaccrc.dll
C:\Windows\system32\dbghelp.dll
C:\Windows\system32\uxtheme.dll
C:\Windows\system32\msasn1.dll
C:\Windows\system32\crypt32.dll
C:\Windows\system32\psapi.dll
C:\Windows\system32\advapi32.dll
C:\Windows\system32\propsys.dll
C:\Windows\system32\secur32.dll
C:\Windows\system32\pcacli.dll
C:\Windows\system32\devrtl.dll
C:\Windows\system32\apphelp.dll
C:\Windows\system32\Shell32.dll
C:\Users\win7\AppData\Local\Temp\{B628BB58-BEA9-4570-A1A6-94FB075CBF16}\fpb.tmp
C:\Users\win7\AppData\Local\Temp\{539E16AF-6A32-4FD6-B60D-97A660B3B133}\fpb.tmp
C:\Windows\system32\Advapi32.dll
C:\Windows\system32\Msimg32.dll
atl.dll
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-string-l1-1-0
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-appmodel-runtime-l1-1-1
ext-ms-win-kernel32-package-current-l1-1-0
imm32.dll
SXS.DLL
ptRes.dll
ptSknMgr.dll
C:\wbxtrace.dll
C:\Users\win7\AppData\Local\Temp\is-QSQI2.tmp\sample.ENU
C:\Users\win7\AppData\Local\Temp\is-QSQI2.tmp\sample.EN
uxtheme.dll
shell32.dll
C:\Users\win7\AppData\Local\Temp\is-QBKV7.tmp\_isetup\_shfoldr.dll
shfolder.dll
C:\Users\win7\AppData\Local\Temp\is-QBKV7.tmp\_isetup\_iscrypt.dll
Rstrtmgr.dll
C:\Windows\SysWOW64\bcryptprimitives.dll
C:\Users\win7\AppData\Local\Temp\is-QBKV7.tmp\isxdl.dll
wininet.dll
C:\Users\win7\AppData\Local\Temp\is-QBKV7.tmp\pcdp.dll
C:\Windows\system32\msi.dll
C:\Windows\system32\imageres.dll
C:\Windows\system32\shell32.dll
C:\Windows\system32\shlwapi.dll
imageres.dll
C:\Users\win7\AppData\Local\Temp\nsk7335.tmp\nsDialogs.dll
C:\Users\win7\AppData\Local\Temp\nsk7335.tmp\System.dll
C:\Windows\System32\shdocvw.dll
PROPSYS.dll
USER32.DLL
werui.dll
DUI70.dll
Comctl32.dll
DUser.dll
C:\Windows\system32\DUser.dll
user32.dll
C:\Windows\system32\RICHED20.DLL
dwmapi.dll
C:\Windows\system32\xmllite.dll
user32
version.dll
C:\sampleENU.dll
C:\sampleLOC.dll
api-ms-win-downlevel-shlwapi-l2-1-0.dll
urlmon.dll
api-ms-win-downlevel-ole32-l1-1-0.dll
Secur32.dll
API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL
WININET.dll
api-ms-win-downlevel-advapi32-l2-1-0.dll
MSHTML.dll
advapi32.dll
C:\Windows\System32\msxml3r.dll
mshtml.dll
IEFRAME.dll
C:\Windows\system32\Msimtf.dll
OLEACC.DLL
C:\Windows\system32\Oleacc.dll
MLANG.dll
d2d1.dll
DWrite.dll
dxgi.dll
C:\DXGIDebug.dll
C:\Windows\system32\DXGIDebug.dll
gdi32.dll
setupapi.dll
WINTRUST.dll
d3d11.dll
D3D10Warp.dll
C:\Windows\system32\D3D10Warp.dll
msls31.dll
COMCTL32
C:\Windows\SysWOW64\TSAPPCMP.DLL
Ntdll.dll
C:\Windows\SysWOW64\SHLWAPI.DLL
C:\Windows\SysWOW64\OLE32.DLL
C:\Windows\SysWOW64\KERNEL32.DLL
MsiMsg.dll
C:\Windows\SysWOW64\SHELL32.DLL
C:\Windows\SysWOW64\NETAPI32.DLL
C:\Windows\SysWOW64\ADVAPI32.DLL
MSISIP.DLL
C:\Windows\syswow64\CRYPT32.dll
ncrypt.dll
WINTRUST.DLL
crypt32.dll
cryptnet.dll
C:\Windows\SysWOW64\cryptnet.dll
WINHTTP.dll
winhttp.dll
RPCRT4.dll
IPHLPAPI.DLL
NSI.dll
CFGMGR32.dll
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-Management-L2-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
profapi.dll
C:\Users\win7\AppData\Local\Temp\{ADCC4C06-A93F-4412-9B04-C1D3A044B850}\fpb.tmp
C:\Users\win7\AppData\Local\Temp\{46971CA2-DABD-4364-B02A-9A14E97C1BAA}\fpb.tmp
WINSTA.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
mscoree.dll
ntdll
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
RichEd20.dll
mscorsec.dll
imagehlp.dll
bcrypt.dll
C:\Windows\system32\cryptnet.dll
C:\DLL_Loader.exe
C:\sample
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\schtasks.exe
C:\Windows\SYSTEM32\MSCOREE.DLL
C:\Windows\syswow64\MSCTF.dll
C:\Windows\syswow64\USER32.dll
C:\Windows\system32\RichEd20.DLL
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\DINPUT8.dll
c:\e4414128181412223d9e7db89e\MpSigStub.exe
C:\Windows\system32\dsound.dll
C:\Windows\system32\ieframe.dll
C:\Windows\system32\MSVBVM60.DLL
C:\Users\win7\AppData\Local\Temp\is-QSQI2.tmp\sample.tmp
C:\Users\win7\AppData\Local\Tem
C:\Users\win7\AppData\Local\Temp\is-QBKV7.tmp\pcdp.dll
C:\Users\win7\AppData\Local\Temp\nsc2D56.tmp\webapp-uninstaller.exe
C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Au_.exe
C:\Windows\system32\DUser.dll
C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
C:\Windows\system32\RICHED20.DLL
C:\Windows\system32\werui.dll
C:\Windows\SysWOW64\ieframe.dll
C:\Windows\SysWOW64\mshtml.dll
C:\Windows\System32\msxml3.dll
C:\Windows\SysWOW64\jscript9.dll
C:\Windows\system32\dxgi.dll
C:\Windows\system32\d3d11.dll
C:\Windows\system32\D3D10Warp.dll
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msi.dll
C:\Windows\syswow64\CRYPT32.dll
C:\Windows\SysWOW64\cryptnet.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\system32\RichEd20.dll
C:\Windows\system32\cryptnet.dll
Precise Detectors Analysis Results
No Detector Result Received
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|