Analyzing...
|
File Name:   Jan_2017_PI.exe
SHA1:   bf99ffba51adf002cba4686fc80d674411871cf9
MD5:   f500fd2dd3baa98195bb3a833ec56fba
First Seen Date:  2017-01-13 18:58:31.531231 ( )
Number of Clients Seen:   6
Last Analysis Date:  2017-01-13 18:58:31.531231 ( )
Human Expert Analysis Date:  2017-01-16 19:35:22.823863 ( )Human Expert Analysis Result:   Malware
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2017-01-13 18:58:31.531231 | Malware | |
Static Analysis Overall Verdict | 2017-01-13 18:58:31.531231 | Highly Suspicious | |
Dynamic Analysis Overall Verdict | 2017-01-13 18:58:31.531231 | Highly Suspicious | |
Human Expert Analysis Overall Verdict | 2017-01-16 19:35:22.823863 | Malware |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Clean | |
Illegal size of optional Header | Clean | |
Packer detection on signature database | Unknown | help |
Based on the sections entropy check! file is possibly packed | Suspicious | |
Timestamp value suspicious | Clean | |
Header Checksum is zero! | Suspicious | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Anti-vm present | Clean | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Clean |
Packer detection on signature database
Microsoft Visual C# / Basic .NET
.NET executable
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Suspicious Behaviors | |
---|---|
Creates a child process | |
Writes to address space of another process | |
Uses a function clandestinely | |
Reads memory of another process | |
Has no visible windows |
Behavioral Information
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
file
Load
DisplayName
ConfigMask
ConfigString
MVID
EvalationData
Status
ILDependencies
NIDependencies
MissingDependencies
Modules
SIG
LastModTime
System
System.Xml
System.Configuration
Microsoft.VisualBasic
System.Web
System.Management
System.Runtime.Remoting
System.Deployment
System.Drawing
System.Windows.Forms
System.Runtime.Serialization.Formatters.Soap
Accessibility
System.Security
<NULL>
Software\Microsoft\Windows NT\CurrentVersion\Windows
C:\Jan_2017_PI.exe
policy.2.0.System__b77a5c561934e089
NI\30bc7c4f\3f50fe4f
NI\30bc7c4f\3f50fe4f\18
IL\424bd4d8\324708cb\5c
IL\19ab8d57\c91dbb2\5e
IL\3f50fe4f\265c633d\60
policy.2.0.System.Xml__b77a5c561934e089
policy.2.0.System.Configuration__b03f5f7f11d50a3a
SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
NI\1c22df2f\4f99a7c9
NI\1c22df2f\4f99a7c9\66
IL\c991064\5086dba8\51
IL\6dc7d4c0\c47ad54\56
IL\3ced59c5\48d69eb2\54
IL\f6e8397\628bc3e2\47
IL\2b1a4e4\3822b536\f
IL\24bf93f6\708deaf7\46
IL\4f99a7c9\191b956f\66
policy.2.0.System.Web__b03f5f7f11d50a3a
policy.2.0.System.Management__b03f5f7f11d50a3a
policy.2.0.System.Runtime.Remoting__b77a5c561934e089
policy.2.0.System.Deployment__b03f5f7f11d50a3a
policy.2.0.System.Drawing__b03f5f7f11d50a3a
policy.2.0.System.Windows.Forms__b77a5c561934e089
NI\61e7e666\c991064
NI\61e7e666\c991064\a
IL\475dce40\1c022996\5b
IL\2dd6ac50\553abeb3\58
IL\41c04c7e\4bf62c79\50
NI\3cca06a0\6dc7d4c0\b
policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
policy.2.0.Accessibility__b03f5f7f11d50a3a
policy.2.0.System.Security__b03f5f7f11d50a3a
CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32
CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server
policy.0.0.nx.resources_en-US_34256fcd934ca661
NI\353ecda2\6803d2c4
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\C:|Jan_2017_PI.exe
Software\Microsoft\Installer\Assemblies\C:|Jan_2017_PI.exe
SOFTWARE\Classes\Installer\Assemblies\C:|Jan_2017_PI.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3979321414-2393373014-2172761192-1000\Installer\Assemblies\Global
Software\Microsoft\Installer\Assemblies\Global
SOFTWARE\Classes\Installer\Assemblies\Global
policy.0.0.nx.resources_en_34256fcd934ca661
NI\353ecda2\1e7cc32d
policy.0.0.{168c10e0-bd51-420b-b7ad-2eae2d8c85cb}__3e56350693f7355e
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\win7\AppData\Roaming\winbothz\winbothz.exe.lnk " /f
"cmd.exe"
NTDLL.DLL
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\12dc10e5c0e8d176cf21a16a6fc5fc3b\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5a401fd2a7689ff13fb54182953f9c40\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6949c4470a81970ec3de0a575d93babc\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
bcrypt.dll
advapi32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
ntdll.dll
mscoree.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
CreateProcess
CreateProcessW
Precise Detectors Analysis Results
No Detector Result Received
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date:   2017-01-16 15:12:07.662151 ( )
Analysis End Date:  2017-01-16 19:35:22.823863 ( )
File Upload Date:  2017-01-13 18:58:31.693310 ( )
Update Date:  2017-01-16 19:35:22.828879 ( )
Human Expert Analyst Feedback:  
Verdict:   Malware
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|