Analyzing...

File Name: uninstall.exe

SHA1: c5c29e961d418f2c86e7d25886d5c56fd4717c85

MD5: d5d0cb431627c54489fd04118d66fa35

First Seen Date: 2017-06-19 13:50:32.314433 ( 2017-06-19 13:50:32.314433 )

Number of Clients Seen: 20

Last Analysis Date: 2017-06-25 09:19:37.789176 ( 2017-06-25 09:19:37.789176 )

Human Expert Analysis Date: 2017-06-28 05:54:31.685678 ( 2017-06-28 05:54:31.685678 )

Human Expert Analysis Result: Clean

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-06-25 09:19:37.789176	Clean
Static Analysis Overall Verdict	2017-06-25 09:19:37.789176	No Threat Found
Dynamic Analysis Overall Verdict	2017-06-25 09:19:37.789176	No Threat Found
Precise Detectors Overall Verdict	2017-06-25 09:19:37.789176	No Match
Human Expert Analysis Overall Verdict	2017-06-28 05:54:31.685678	Clean

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Has no visible windows

Behavioral Information

QueryFilePath

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

CreateFile

{"dwCreationDisposition": "3", "path": "C:\\Users\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Temp", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

LoadLibrary

C:\Windows\system32\UXTHEME.dll

C:\Windows\system32\USERENV.dll

C:\Windows\system32\SETUPAPI.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

advapi32.dll

C:\Windows\system32\APPHELP.dll

C:\Windows\system32\PROPSYS.dll

ADVAPI32.dll

propsys.dll

C:\Windows\system32\DWMAPI.dll

C:\Windows\system32\CRYPTBASE.dll

C:\Windows\system32\OLEACC.dll

OLEACCRC.DLL

C:\Windows\system32\CLBCATQ.dll

C:\Windows\system32\SHFOLDER.dll

ole32.dll

comctl32.dll

ntmarta.dll

SHELL32.dll

CreateMutex

<NULL>

DeleteFile

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_E.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_F.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_G.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_H.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_I.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_J.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_K.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_L.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_M.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_N.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_O.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_P.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_Q.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_R.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_S.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_T.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_U.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_V.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_W.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_X.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_Y.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Un_Z.exe

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Uninstaller FP Detector	2017-06-25 09:19:29.105201	No Match	No match.
Yara Rule Static Malware Detector	2017-06-25 09:19:27.212960	No Match	No match.
Static Precise PUA Detector 1	2017-06-25 09:19:27.224887	No Match	NotDetected
Static Precise Virus Detector	2017-06-25 09:19:27.225810	No Match	NotDetected
Static Precise Trojan Detector	2017-06-25 09:19:27.244409	No Match	NotDetected
Static Precise PUA Detector 2	2017-06-25 09:19:27.248218	No Match	No match.
Static Precise PUA Detector 3	2017-06-25 09:19:27.244908	No Match	No match.
Static Precise Virus Detector 2	2017-06-25 09:19:27.245423	No Match	No match.
Static Precise Trojan Detector 2	2017-06-25 09:19:27.247803	No Match	No match.
Static Precise Trojan Detector 3	2017-06-25 09:19:27.247998	No Match	No match.
Malicious Url Detector	2017-06-25 09:19:37.768809	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2017-06-28 01:07:35.460365 ( 2017-06-28 01:07:35.460365 )

Analysis End Date: 2017-06-28 05:54:31.685678 ( 2017-06-28 05:54:31.685678 )

File Upload Date: 2017-06-27 23:17:28.139299 ( 2017-06-27 23:17:28.139299 )

Update Date: 2017-06-28 15:20:01.847343 ( 2017-06-28 15:20:01.847343 )

Human Expert Analyst Feedback:

Verdict: Clean

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5