|
Analyzing...
|
File Name: Bilquees.exe
SHA1: e52d383f016876cdc664e31323600c9d6ba77752
MD5: b3ccf63a68c552947cbba69031a232f8
First Seen Date: 2019-03-26 15:26:53.554052 ( )
Number of Clients Seen: 4
Last Analysis Date: 2019-03-27 06:47:05.646850 ( )
Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.
Analysis Summary
| Analysis Type | Date | Verdict | |
|---|---|---|---|
| Signature Based Detection | 2019-03-27 06:47:05.646850 | No Match | help |
| Static Analysis Overall Verdict | 2019-03-27 06:47:05.646850 | No Threat Found | help |
| Dynamic Analysis Overall Verdict | 2019-03-27 06:47:05.646850 | No Threat Found | help |
| Precise Detectors Overall Verdict | 2019-03-27 06:47:05.646850 | No Match | help |
Static Analysis
| Static Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Detector | Result | |
|---|---|---|
| Optional Header LoaderFlags field is valued illegal | Clean | |
| Non-ascii or empty section names detected | Clean | |
| Illegal size of optional Header | Clean | |
| Packer detection on signature database | Unknown | help |
| Based on the sections entropy check! file is possibly packed | Clean | |
| Timestamp value suspicious | Clean | |
| Header Checksum is zero! | Clean | |
| Enrty point is outside the 1st(.code) section! Binary is possibly packed | Suspicious | |
| Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
| Anti-vm present | Clean | |
| The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
| TLS callback functions array detected | Clean | |
Dynamic Analysis
| Dynamic Analysis Overall Verdict | Result |
|---|---|
| No Threat Found | help |
| Suspicious Behaviors | |
|---|---|
| Opens a file in a system directory | |
| Uses a function clandestinely | |
Behavioral Information
C:\Bilquees.exe
C:\Windows\syswow64\MSCTF.dll
C:\Windows\syswow64\USER32.dll
C:\heierun.dll
C:\Windows\syswow64\kernel32.dll
ilquees
bx_thread_mutex_000008a4
boxedapp_shared_env_mutex_0000088c_000008a4
boxedapp_process_list_mutex_0000088c_000008a4
boxedapp_global_shared_mem_0000088c_000008a4
bx_thread_mutex_0000038c
bx_process_mutex_0000088c_000008a4_0000088c
MutexNPA_UnitVersioning_2188
Local\MSCTF.Asm.MutexDefault1
C:\Windows\Fonts\staticcache.dat
comctl32.dll
UxTheme.dll
C:\Windows\system32\ole32.dll
ADVAPI32.dll
KERNEL32.dll
USER32.dll
GDI32.dll
ole32.dll
OLEAUT32.dll
ntdll.dll
kernel32.dll
shell32.dll
sxs.dll
advapi32.dll
mpr.dll
bxsdk32.dll
KernelBase.dll
C:\heierun.dll
imm32.dll
OLEAUT32.DLL
msimg32.dll
Comctl32
dwmapi.dll
olepro32.dll
C:\Windows\system32\ieframe.dll
SXS.DLL
wtsapi32.dll
WINSTA.dll
API-MS-Win-Security-LSALookup-L1-1-0.dll
RPCRT4.dll
uxtheme.dll
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.certstore
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\x-pkcs7-certificates
\REGISTRY\MACHINE\SOFTWARE\Classes\.msrcincident
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkcs10
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.seccat
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/hta
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.seccat
\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000_CLASSES\.PML
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-xpsdocument
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-icon
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/fractals
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-photo
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/scriptlet
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-compressed
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkcs7-mime
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-ms-contact
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-license
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\pkcs10
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-pkcs7-certreqresp
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-application
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-component
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-x509-ca-cert
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mix-transfer
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-latex
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/xhtml+xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkcs7-signature
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/xaml+xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/tiff
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\pkcs7-signature
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/plain
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\x-x509-ca-cert
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-emf
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-jtx+xps
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-stuffit
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/vnd.ms-dds
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\pkcs7-mime
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/bmp
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\x-pkcs12
\REGISTRY\MACHINE\SOFTWARE\Classes\.zfsendtotarget
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.certstore
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-zip-compressed
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-compress
\REGISTRY\MACHINE\SOFTWARE\Classes\.printerExport
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\pkix-crl
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mp3
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-scriptlet
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.stl
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\message/rfc822
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-complus
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/css
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mpeg
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/rss+xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.pko
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/gif
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\model/vnd.eprtx+xps
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-png
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/png
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/pjpeg
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-troff-man
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/html
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-xbap
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
\REGISTRY\MACHINE\SOFTWARE\Classes\.compositefont
\REGISTRY\MACHINE\SOFTWARE\M
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-gzip
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\x-pkcs7-certreqresp
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-wmf
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkix-crl
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-informationCard
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\vnd.ms-pki.pko
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-mpeg
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/mac-binhex40
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\model/vnd.dwfx+xps
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-pkcs12
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkix-cert
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\model/vnd.edrwx+xps
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-pki.stl
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-pkcs7-certificates
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\pkix-cert
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/jpeg
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/atom+xml
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/postscript
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mswebsite
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-tar
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wma
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/x-jg
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-msvideo
\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\model/vnd.easmx+xps
OpenProcess
ReadProcessMemory
WriteProcessMemory
CreateRemoteThread
CreateProcessW
CreateProcessA
WinExec
IsDebuggerPresent
Precise Detectors Analysis Results
| Detector Name | Date | Verdict | Reason | |
|---|---|---|---|---|
| Static Precise PUA Detector 1 | 2019-03-27 06:46:51.870935 | No Match | help | NotDetected |
| Static Precise Trojan Detector 5 | 2019-03-27 06:46:51.874964 | No Match | help | NotDetected |
| Static Precise Trojan Detector 7 | 2019-03-27 06:46:51.871956 | No Match | help | NotDetected |
| Static Precise PUA Detector 4 | 2019-03-27 06:46:51.874646 | No Match | help | NotDetected |
| Static Precise PUA Detector 5 | 2019-03-27 06:46:51.927785 | No Match | help | NotDetected |
| Static Precise Trojan Detector 1 | 2019-03-27 06:46:51.971311 | No Match | help | NotDetected |
| Static Precise Trojan Detector 2 | 2019-03-27 06:46:51.972870 | No Match | help | NotDetected |
| Static Precise Trojan Detector 3 | 2019-03-27 06:46:51.960691 | No Match | help | NotDetected |
| Static Precise Trojan Detector 12 | 2019-03-27 06:46:51.982226 | No Match | help | NotDetected |
| Static Precise Trojan Detector 10 | 2019-03-27 06:46:51.994253 | No Match | help | NotDetected |
| Static Precise Virus Detector 1 | 2019-03-27 06:46:52.051827 | No Match | help | NotDetected |
| Static Precise Virus Detector 2 | 2019-03-27 06:46:52.056406 | No Match | help | NotDetected |
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Additional File Information
| Property | Value |
|---|
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
|---|