Analyzing...

File Name: uninstall.exe

SHA1: ca035914d11ff84a517e270e639e019a020f3186

MD5: 72ef2c5e66910952ac338e133eb99b8a

First Seen Date: 2017-04-13 22:24:54.919774 ( 2017-04-13 22:24:54.919774 )

Number of Clients Seen: 2

Last Analysis Date: 2017-04-13 22:24:54.919774 ( 2017-04-13 22:24:54.919774 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-04-13 22:24:54.919774	Clean
Static Analysis Overall Verdict	2017-04-13 22:24:54.919774	No Threat Found
Dynamic Analysis Overall Verdict	2017-04-13 22:24:54.919774	Highly Suspicious
Precise Detectors Overall Verdict	2017-04-13 22:24:54.919774	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
Highly Suspicious

Suspicious Behaviors
Operation successfully finished.

Behavioral Information

QueryFilePath

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Au_.exe

CreateFile

C:\

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db

C:\Users\desktop.ini

C:\Users

C:\Users\win7

C:\Users\win7\AppData

C:\Users\win7\AppData\Local

C:\Users\win7\AppData\Local\Temp

LoadLibrary

SHFOLDER

ole32.dll

comctl32.dll

ADVAPI32.dll

propsys.dll

ntmarta.dll

SHELL32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

CreateMutex

<NULL>

DeleteFile

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Fu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Gu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Hu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Iu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Ju_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Ku_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Lu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Mu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Nu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Ou_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Pu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Qu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Ru_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Su_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Tu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Uu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Vu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Wu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Xu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Yu_.exe

C:\Users\win7\AppData\Local\Temp\~nsu.tmp\Zu_.exe

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2017-04-13 22:24:41.622463	No Match	NotDetected
Static Precise Virus Detector	2017-04-13 22:24:41.625944	No Match	NotDetected
Static Precise Trojan Detector	2017-04-13 22:24:41.635109	No Match	NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5