Analyzing...

File Name: 150703bukhansan.exe

SHA1: c003cabec5522eda3e44bf29f8c9606a3091e6ba

MD5: c5a54fd4406867ec2115303c970ed949

First Seen Date: 2019-03-26 15:30:13.387232 ( 2019-03-26 15:30:13.387232 )

Number of Clients Seen: 5

Last Analysis Date: 2019-03-27 06:47:56.970497 ( 2019-03-27 06:47:56.970497 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2019-03-27 06:47:56.970497	No Match
Static Analysis Overall Verdict	2019-03-27 06:47:56.970497	No Threat Found
Dynamic Analysis Overall Verdict	2019-03-27 06:47:56.970497	No Threat Found
Precise Detectors Overall Verdict	2019-03-27 06:47:56.970497	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Suspicious
Timestamp value suspicious	Suspicious
Header Checksum is zero!	Suspicious
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Suspicious
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Packer detection on signature database

ASProtect V2.X DLL -> Alexey Solodovnikov

ASPack v2.12

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Opens a file in a system directory
Uses a function clandestinely
Has no visible windows

Behavioral Information

LoadLibrary

C:\150703bukhansan.ENU

C:\150703bukhansan.EN

comctl32.dll

shell32.dll

RICHED20.DLL

msimg32.dll

UxTheme.dll

USER32

olepro32.dll

d3d8.dll

DSound.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Windows\system32\DSound.dll

DDraw.dll

Msdmo.dll

Ksuser.dll

Ksproxy.ax

USER32.dll

KERNEL32.dll

ole32.dll

WINMM.dll

MSACM32.dll

MSVCRT.dll

GdiPlus.dll

C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\GdiPlus.dll

WMVCore.DLL

ADVAPI32.dll

urlmon.dll

user32.dll

gdi32.dll

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ell

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ENU

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.EN

OLEAUT32.DLL

C:\Windows\system32\kernel32.dll

imageres.dll

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

CreateMutex

<NULL>

DeleteFile

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\Effects.ini

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ell

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.xml

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdMasks.zip

OpenMutex

Local\MSCTF.Asm.MutexDefault1

WriteFile

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\Effects.ini

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdMasks.zip

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ell

ReadFile

C:\150703bukhansan.exe

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\Effects.ini

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ell

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.xml

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdMasks.zip

C:\Windows\Fonts\staticcache.dat

QueryFilePath

C:\150703bukhansan.exe

C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\GdiPlus.dll

C:\Users\win7\AppData\Local\Temp\AnTemp\anx0000\Effects\StdLib.ell

C:\Windows\system32\RICHED20.DLL

C:\Windows\system32\DSound.dll

C:\Windows\syswow64\USER32.dll

C:\Windows\syswow64\MSCTF.dll

OpenRegistryKey

\REGISTRY\MACHINE\SOFTWARE\M

QueryProcessAddress

SetWindowsHookExA

GetAsyncKeyState

QueueUserAPC

ShellExecuteA

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2019-03-27 06:47:40.402166	No Match	NotDetected
Static Precise Trojan Detector 5	2019-03-27 06:47:40.456866	No Match	NotDetected
Static Precise Trojan Detector 7	2019-03-27 06:47:40.458347	No Match	NotDetected
Static Precise PUA Detector 4	2019-03-27 06:47:40.457310	No Match	NotDetected
Static Precise PUA Detector 5	2019-03-27 06:47:40.501005	No Match	NotDetected
Static Precise Trojan Detector 1	2019-03-27 06:47:40.499988	No Match	NotDetected
Static Precise Trojan Detector 2	2019-03-27 06:47:40.457212	No Match	NotDetected
Static Precise Trojan Detector 3	2019-03-27 06:47:40.459891	No Match	NotDetected
Static Precise Trojan Detector 12	2019-03-27 06:47:40.488482	No Match	NotDetected
Static Precise Trojan Detector 10	2019-03-27 06:47:40.499159	No Match	NotDetected
Static Precise Virus Detector 1	2019-03-27 06:47:40.545249	No Match	NotDetected
Static Precise Virus Detector 2	2019-03-27 06:47:40.537902	No Match	NotDetected