Analyzing...
|
File Name:   php.exe
SHA1:   ccd3d0e091167fca1cfd06dfb3850c68730c64c1
MD5:   05c9668dc4efca3354a88dc773c4a736
First Seen Date:  2017-09-08 20:59:16.516353 ( )
Number of Clients Seen:   5
Last Analysis Date:  2017-09-09 01:58:22.245400 ( )
Human Expert Analysis Date:  2017-09-09 06:24:04.472540 ( )Human Expert Analysis Result:   Malware
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2017-09-09 01:58:22.245400 | Malware | |
Static Analysis Overall Verdict | 2017-09-09 01:58:22.245400 | No Threat Found | help |
Precise Detectors Overall Verdict | 2017-09-09 01:58:22.245400 | No Match | help |
Human Expert Analysis Overall Verdict | 2017-09-09 06:24:04.472540 | Malware |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
No Threat Found | help |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Clean | |
Illegal size of optional Header | Clean | |
Packer detection on signature database | Unknown | help |
Based on the sections entropy check! file is possibly packed | Clean | |
Timestamp value suspicious | Clean | |
Header Checksum is zero! | Suspicious | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Anti-vm present | Clean | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Clean |
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
No Threat Found | help |
Suspicious Behaviors | |
---|---|
Opens a file in a system directory | |
Uses a function clandestinely |
Behavioral Information
2bc
2a8
104
2ac
C:\Users\win7\AppData\Local\Temp\RarSFX0\VkLock v1.9.exe
C:\Users\win7\AppData\Local\Tem
C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll
C:\Windows\syswow64\MSCTF.dll
C:\Windows\syswow64\USER32.dll
Plane16
MS Shell Dlg 2
Plane14
Plane15
Plane12
Plane13
Plane10
Plane11
Plane4
Plane5
Plane6
Disable
Plane7
Plane1
Plane2
Plane3
DataFilePath
Plane8
Plane9
{"lDistanceToMove": "0", "dwMoveMethod": "0", "lpDistanceToMoveHigh": "18fccc", "hFile": "12c"}
{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "18fccc", "hFile": "12c"}
{"lDistanceToMove": "0", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "18fccc", "hFile": "12c"}
{"lDistanceToMove": "0", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "22c"}
{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\PSE20\\3f9b32e8c488ba5f4851a5306f07e440\\php.ini", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\RarSFX0\\VkLock v1.9.exe", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\PSE20\\3f9b32e8c488ba5f4851a5306f07e440\\php-embed.ini", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32\\drivers\\etc\\protocol", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "\\\\.\\Nsi", "dwDesiredAccess": "0", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\\\PSE20\\3f9b32e8c488ba5f4851a5306f07e440\\php.ini", "dwDesiredAccess": "c0000000", "dwShareMode": "0"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\RarSFX0\\ext\\php_curl.dll", "dwDesiredAccess": "80000000", "dwShareMode": "3"}
{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData", "dwDesiredAccess": "100081", "dwShareMode": "7"}
{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\staticcache.dat", "dwDesiredAccess": "80000000", "dwShareMode": "5"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"}
{"hKey": "2bc", "phkResult": "0", "lpSubKey": "Comic Sans MS"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"}
{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Delphi\\Locales"}
{"hKey": "2ac", "phkResult": "0", "lpSubKey": "Trebuchet MS"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\PHP\\5.3\\Per Directory Values"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"}
{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\PHP\\Per Directory Values"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\PHP\\5.3.8\\Per Directory Values"}
{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\PHP\\5\\Per Directory Values"}
{"hKey": "2bc", "phkResult": "0", "lpSubKey": "Webdings"}
<NULL>
Local\MSCTF.Asm.MutexDefault1
{"nNumberOfBytesToWrite": "1846", "lpOverlapped": "0", "lpBuffer": "8a52a0", "lpNumberOfBytesWritten": "18fc9c", "hFile": "1c"}
KERNEL32.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
imm32.dll
msimg32.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
version.dll
winmm.dll
winspool.drv
wsock32.dll
C:\Users\win7\AppData\Local\Temp\RarSFX0\VkLock v1.9.ENU
C:\Users\win7\AppData\Local\Temp\RarSFX0\VkLock v1.9.EN
uxtheme.dll
C:\Users\win7\AppData\Local\Temp\RarSFX0\php5ts.dll
.\ext\php_curl.dll
API-MS-Win-Security-SDDL-L1-1-0.dll
WS2_32.dll
ADVAPI32.dll
SHELL32.dll
propsys.dll
ntmarta.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
UxTheme.dll
IMM32.dll
C:\Windows\system32\kernel32.dll
C:\Windows\system32\ole32.dll
C:\Windows\syswow64\MSCTF.dll
OLEAUT32.DLL
SetWindowsHookExA
GetAsyncKeyState
OpenProcess
CreateProcessA
ShellExecuteA
Precise Detectors Analysis Results
Detector Name | Date | Verdict | Reason | |
---|---|---|---|---|
Static Precise Adware Prepscram 1 | 2017-09-09 01:57:09.606792 | No Match | help | No match. |
Static Precise Trojan Cryptor Detector 1 | 2017-09-09 01:57:09.602527 | No Match | help | No match. |
Yara Rule Static Malware Detector | 2017-09-09 01:57:09.704754 | No Match | help | No match. |
Static Precise PUA Detector 1 | 2017-09-09 01:57:09.605918 | No Match | help | NotDetected |
Static Precise Virus Detector | 2017-09-09 01:57:09.613960 | No Match | help | NotDetected |
Static Precise Trojan Detector | 2017-09-09 01:57:09.620283 | No Match | help | NotDetected |
Static Precise PUA Detector 2 | 2017-09-09 01:57:09.624735 | No Match | help | No match. |
Static Precise PUA Detector 3 | 2017-09-09 01:57:09.632883 | No Match | help | No match. |
Static Precise Virus Hezhi Detector | 2017-09-09 01:57:09.632405 | No Match | help | No match. |
Ransomware Chunk Detector | 2017-09-09 01:57:30.047226 | No Match | help | No match. |
Static Precise Virus Detector 2 | 2017-09-09 01:57:09.651055 | No Match | help | NotDetected |
Static Precise Trojan Detector 2 | 2017-09-09 01:57:09.665774 | No Match | help | NotDetected |
Static Precise Trojan Detector 3 | 2017-09-09 01:57:09.656143 | No Match | help | NotDetected |
Static Precise Adware InstallCore Detector 1 | 2017-09-09 01:57:09.671011 | No Match | help | NotDetected |
Static Precise Trojan Generic Cryptor Detector 1 | 2017-09-09 01:57:09.667193 | No Match | help | NotDetected |
Static Precise MD5 Detector | 2017-09-09 01:57:10.660822 | No Match | help | No match. |
Malicious Url Detector | 2017-09-09 01:58:22.221185 | No Match | help | No match. |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date:   2017-09-09 01:34:41.702326 ( )
Analysis End Date:  2017-09-09 06:24:04.472540 ( )
File Upload Date:  2017-09-08 20:57:43.972856 ( )
Update Date:  2017-09-09 06:24:05.442994 ( )
Human Expert Analyst Feedback:   Trojan.Win32.Agent
Verdict:   Malware
Malware Family:   Trojan.Win32.Agent
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|