Analyzing...

File Name: DriverPack-17-Online.exe

SHA1: c573bd82a5579bffd876c3fa44fa0b64aee87537

MD5: 9170682fd322bed825ee2d8085e77228

First Seen Date: 2018-01-24 12:05:31.207077 ( 2018-01-24 12:05:31.207077 )

Number of Clients Seen: 17

Last Analysis Date: 2018-02-02 01:58:56.044327 ( 2018-02-02 01:58:56.044327 )

Human Expert Analysis Date: 2018-01-24 19:27:42.231224 ( 2018-01-24 19:27:42.231224 )

Human Expert Analysis Result: PUA

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2018-02-02 01:58:56.044327	Malware
Static Analysis Overall Verdict	2018-02-02 01:58:56.044327	No Threat Found
Dynamic Analysis Overall Verdict	2018-02-02 01:58:56.044327	No Threat Found
Precise Detectors Overall Verdict	2018-02-02 01:58:56.044327	No Match
Human Expert Analysis Overall Verdict	2018-01-24 19:27:42.231224	PUA

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Suspicious
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Packer detection on signature database

Armadillo v1.71

Microsoft Visual C++ v5.0/v6.0 (MFC)

Microsoft Visual C++

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Modifies Windows Service Keys
Reads memory of another process
Modifies Windows policies
Opens a file in a system directory

Behavioral Information

QueryFilePath

C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe

C:\Windows\SysWOW64\wscript.exe

LowerChar

.exe

file

CreateProcess

"C:\Users\win7\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx "DriverPack-17-Online.exe"

ReadFile

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db

C:\Users\desktop.ini

C:\

C:\Windows

C:\Windows\Fonts\desktop.ini

C:\Users

C:\Users\win7

C:\Users\win7\AppData

C:\Users\win7\AppData\Roaming

C:\Users\win7\AppData\Roaming\Microsoft

C:\Users\win7\AppData\Roaming\Microsoft\Windows

C:\Users\win7\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini

C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini

C:\Users\win7\Favorites\desktop.ini

C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu

C:\Windows\SysWOW64\shell32.dll

C:\Windows\SysWOW64\scrrun.dll

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\hardware.json

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\newsoft.json

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\soft.json

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\softchanges.json

C:\Users\win7\Contacts\desktop.ini

C:\Users\win7\Downloads\desktop.ini

C:\Users\win7\Links\desktop.ini

C:\Users\win7\Saved Games\desktop.ini

WriteFile

C:\Windows\SysWOW64\scrrun.dll

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\hardware.json

C:\Users\win7\AppData

C:\

C:\Windows\Fonts\desktop.ini

C:\Windows\SysWOW64\shell32.dll

C:\Users\win7

C:\Users\win7\AppData\Roaming\Microsoft

C:\Users\win7\Favorites\desktop.ini

C:\Users\win7\AppData\Roaming

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\newsoft.json

C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu

C:\Windows

C:\Users

C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

C:\Users\win7\AppData\Roaming\Microsoft\Windows

C:\Users\win7\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\softchanges.json

C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini

C:\Users\win7\AppData\Roaming\DRPSu\diagnostics\soft.json

CreateMutex

<NULL>

LoadLibrary

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

SHELL32.dll

ole32.dll

ADVAPI32.dll

propsys.dll

comctl32.dll

ntmarta.dll

OLEAUT32.dll

shell32.dll

C:\Windows\System32\shdocvw.dll

PROPSYS.dll

api-ms-win-downlevel-advapi32-l2-1-0.dll

OpenRegistryKey

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft

\REGISTRY\MACHINE\SOFTWA

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers

\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}

\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe

\REGISTRY\US

\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LDAP

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\N

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2018-02-02 01:58:04.507774	No Match	NotDetected
Static Precise Virus Detector	2018-02-02 01:58:04.507852	No Match	NotDetected
Static Precise Trojan Detector	2018-02-02 01:58:04.540411	No Match	NotDetected
Static Precise Adware InstallCore Detector 1	2018-02-02 01:58:04.533341	No Match	NotDetected
Static Precise Trojan Detector 2	2018-02-02 01:58:04.547300	No Match	NotDetected
Static Precise Trojan Detector 3	2018-02-02 01:58:04.534246	No Match	NotDetected
Static Precise Trojan Generic Cryptor Detector 1	2018-02-02 01:58:04.546065	No Match	NotDetected
Static Precise Virus Detector 2	2018-02-02 01:58:04.533255	No Match	NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2018-01-24 17:32:35.616559 ( 2018-01-24 17:32:35.616559 )

Analysis End Date: 2018-01-24 19:27:42.231224 ( 2018-01-24 19:27:42.231224 )

File Upload Date: 2018-01-24 12:05:02.579285 ( 2018-01-24 12:05:02.579285 )

Update Date: 2018-01-24 17:32:35.616559 ( 2018-01-24 17:32:35.616559 )

Human Expert Analyst Feedback:

Verdict: PUA

Malware Family: Application

Malware Type: 0

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5