|
Analyzing...
|
File Name: etypesetup.exe
SHA1: cd9a7a057e8bf08b74cea908b24b4ccc8a46af85
MD5: fa4e96517639830a7ce0daec5f9ed240
First Seen Date: 2016-06-19 08:46:16.463514 ( )
Number of Clients Seen: 11
Last Analysis Date: 2019-10-21 06:06:29.737935 ( )
Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.
Analysis Summary
| Analysis Type | Date | Verdict | |
|---|---|---|---|
| Signature Based Detection | 2019-10-21 06:06:29.737935 | Malware | |
| Static Analysis Overall Verdict | 2019-10-21 06:06:29.737935 | No Threat Found | help |
| Dynamic Analysis Overall Verdict | 2019-10-21 06:06:29.737935 | No Threat Found | help |
| Precise Detectors Overall Verdict | 2019-10-21 06:06:29.737935 | No Match | help |
Static Analysis
| Static Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Detector | Result | |
|---|---|---|
| Optional Header LoaderFlags field is valued illegal | Clean | |
| Non-ascii or empty section names detected | Clean | |
| Illegal size of optional Header | Clean | |
| Packer detection on signature database | Unknown | help |
| Based on the sections entropy check! file is possibly packed | Clean | |
| Timestamp value suspicious | Clean | |
| Header Checksum is zero! | Clean | |
| Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
| Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
| Anti-vm present | Clean | |
| The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Suspicious | |
| TLS callback functions array detected | Clean | |
Dynamic Analysis
| Dynamic Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Suspicious Behaviors | |
|---|---|
| Creates a child process | |
| Writes to address space of another process | |
| Reads memory of another process | |
| Opens a file in a system directory | |
| Has no visible windows | |
Behavioral Information
CRYPTSP.dll
ADVAPI32.dll
SHELL32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
propsys.dll
ntmarta.dll
"C:\Users\win7\AppData\Local\Temp\BetterInstaller.exe" /affid "etype" /id "etype" /name "eType"
<NULL>
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db
C:\Users\win7\AppData\Local\Temp\BetterInstaller.exe
C:\Users\win7\AppData\Local\Temp\config.ini
C:\Users\win7\AppData\Local\Temp\nsoD221.tmp
C:\etypesetup.exe
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db
C:\etypesetup.exe
C:\Users\win7\AppData\Local\Temp\nsoD221.tmp
C:\etypesetup.exe
C:\Users\win7\AppData\Local\Temp\BetterInstaller.exe
C:\Users\win7\AppData\Local\Temp\nsoD220.tmp
C:\Users\win7\AppData\Local\Temp\nsdD231.tmp
C:\Users\win7\AppData\Local\Temp\config.ini
C:\Users\win7\AppData\Local\Temp\BetterInstaller.exe
Precise Detectors Analysis Results
| Detector Name | Date | Verdict | Reason | |
|---|---|---|---|---|
| Static Precise PUA Detector 1 | 2019-10-21 06:06:26.847087 | No Match | help | NotDetected |
| Static Precise PUA Detector 4 | 2019-10-21 06:06:26.853544 | No Match | help | NotDetected |
| Static Precise NI Detector 3 | 2019-10-21 06:06:26.870900 | No Match | help | NotDetected |
| Static Precise PUA Detector 5 | 2019-10-21 06:06:26.847628 | No Match | help | NotDetected |
| Static Precise Trojan Detector 1 | 2019-10-21 06:06:26.872188 | No Match | help | NotDetected |
| Static Precise Trojan Detector 3 | 2019-10-21 06:06:26.813689 | No Match | help | NotDetected |
| Static Precise PUA Detector 6 | 2019-10-21 06:06:26.831841 | No Match | help | NotDetected |
| Static Precise Trojan Detector 12 | 2019-10-21 06:06:26.846290 | No Match | help | NotDetected |
| Static Precise Virus Detector 1 | 2019-10-21 06:06:27.007744 | No Match | help | NotDetected |
| Static Precise Virus Detector 2 | 2019-10-21 06:06:27.010208 | No Match | help | NotDetected |
| Static Precise Trojan Detector 13 | 2019-10-21 06:06:26.929870 | No Match | help | NotDetected |
| Static Precise PUA Detector 2 | 2019-10-21 06:06:26.909776 | No Match | help | NotDetected |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Additional File Information
| Property | Value |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|