|
Analyzing...
|
File Name: JDSetup131038153431675335.exe
SHA1: bfa372c778d40be998f4ec2cfc77c3fc9d46a34d
MD5: 1b565d6bed32cebd8087bc5228f8b3b4
First Seen Date: 2016-03-30 11:43:49.386648 ( )
Number of Clients Seen: 20
Last Analysis Date: 2018-11-14 16:14:15.242623 ( )
Human Expert Analysis Date: 2018-11-14 16:13:08.443746 ( )Human Expert Analysis Result: PUA
Analysis Summary
| Analysis Type | Date | Verdict | |
|---|---|---|---|
| Signature Based Detection | 2018-11-14 16:14:15.242623 | PUA | |
| Static Analysis Overall Verdict | 2018-11-14 16:14:15.242623 | No Threat Found | help |
| Dynamic Analysis Overall Verdict | 2018-11-14 16:14:15.242623 | No Threat Found | help |
| Precise Detectors Overall Verdict | 2018-11-14 16:14:15.242623 | No Match | help |
| Human Expert Analysis Overall Verdict | 2018-11-14 16:13:08.443746 | PUA | |
Static Analysis
| Static Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Detector | Result | |
|---|---|---|
| Optional Header LoaderFlags field is valued illegal | Clean | |
| Non-ascii or empty section names detected | Clean | |
| Illegal size of optional Header | Clean | |
| Packer detection on signature database | Unknown | help |
| Based on the sections entropy check! file is possibly packed | Clean | |
| Timestamp value suspicious | Clean | |
| Header Checksum is zero! | Clean | |
| Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
| Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
| Anti-vm present | Clean | |
| The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Suspicious | |
| TLS callback functions array detected | Clean | |
Dynamic Analysis
| Dynamic Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Suspicious Behaviors | |
|---|---|
| Creates a child process | |
| Writes to address space of another process | |
| Uses a function clandestinely | |
| Reads memory of another process | |
| Opens a file in a system directory | |
Behavioral Information
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
C:\Windows\system32\kernel32.dll
C:\Windows\System32\msxml3r.dll
urlmon.dll
wininet.dll
API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL
api-ms-win-downlevel-shlwapi-l2-1-0.dll
ADVAPI32.dll
CRYPTBASE.dll
OLEAUT32.dll
ole32.dll
SXS.DLL
RichEd20
comctl32.dll
UxTheme.dll
IMM32.dll
C:\Windows\system32\ole32.dll
C:\Users\win7\AppData\Local\Temp\nsk9F50.tmp\nsExec.dll
file
wmic /NAMESPACE:\\root\SecurityCenter path AntiVirusProduct get displayName
C:\Windows\system32\wbem\XSL-Mappings.xml
C:\Windows\system32\wbem\texttable.xsl
C:\Windows\System32\msxml3.dll
C:\Windows\SysWOW64\stdole2.tlb
C:\JDSetup131038153431675335.exe
C:\Users\win7\AppData\Local\Temp\nsk9117.tmp
C:\Windows\Fonts\staticcache.dat
C:\Users\win7\AppData\Local\Temp\nsk9116.tmp
C:\Users\win7\AppData\Local\Temp\nsk9F50.tmp
Local\MSCTF.Asm.MutexDefault1
C:\Users\win7\AppData\Local\Temp\nsk9F50.tmp\nsExec.dll
C:\Users\win7\AppData\Local\Temp\nsk9117.tmp
<NULL>
C:\JDSetup131038153431675335.exe
C:\Windows\SysWOW64\Wbem\wmic.exe
C:\Windows\System32\msxml3.dll
C:\Windows\system32\RichEd20.DLL
C:\Windows\syswow64\MSCTF.dll
C:\Windows\syswow64\USER32.dll
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
\REGISTRY\MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID
\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BFE
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\CIMOM
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Keyboard Layout\Toggle
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}
\REGISTRY\MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
\REGISTRY\MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\InprocServer32
\REGISTRY\MA
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Control Panel\Desktop
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\C
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\InProcServer32
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\N
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\InProcServer32
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Rpc
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\CTF\DirectSwitchHotkeys
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\CIMOM
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Precise Detectors Analysis Results
| Detector Name | Date | Verdict | Reason | |
|---|---|---|---|---|
| Static Precise PUA Detector 1 | 2018-04-18 18:40:55.079904 | No Match | help | NotDetected |
| Static Precise PUA Detector 5 | 2018-04-18 18:40:55.151110 | No Match | help | NotDetected |
| Static Precise Trojan Detector 1 | 2018-04-18 18:40:55.156271 | No Match | help | NotDetected |
| Static Precise Trojan Detector 2 | 2018-04-18 18:40:55.151760 | No Match | help | NotDetected |
| Static Precise Trojan Detector 3 | 2018-04-18 18:40:55.155614 | No Match | help | NotDetected |
| Static Precise Trojan Detector 10 | 2018-04-18 18:40:55.212923 | No Match | help | NotDetected |
| Static Precise Virus Detector 1 | 2018-04-18 18:40:55.237617 | No Match | help | NotDetected |
| Static Precise Virus Detector 2 | 2018-04-18 18:40:55.236565 | No Match | help | NotDetected |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date: 2018-11-14 15:38:22.117871 ( )
Analysis End Date: 2018-11-14 16:13:08.443746 ( )
File Upload Date: 2018-11-14 15:09:37.652139 ( )
Update Date: 2018-11-14 16:14:14.629498 ( )
Human Expert Analyst Feedback:
Verdict: PUA
Malware Family:
Malware Type: 0
Additional File Information
| Property | Value |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|