Analyzing...

File Name: op.exe

SHA1: ed7f68a3326516c2a3a30a84dec9319a1852c462

MD5: e7afad0275fd4b45abded64157a08afd

First Seen Date: 2018-06-14 02:34:23.474164 ( 2018-06-14 02:34:23.474164 )

Number of Clients Seen: 7

Last Analysis Date: 2018-06-14 02:34:23.474164 ( 2018-06-14 02:34:23.474164 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2018-06-14 02:34:23.474164	Clean
Static Analysis Overall Verdict	2018-06-14 02:34:23.474164	No Threat Found
Dynamic Analysis Overall Verdict	2018-06-14 02:34:23.474164	No Threat Found
Precise Detectors Overall Verdict	2018-06-14 02:34:23.474164	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Suspicious
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Packer detection on signature database

Armadillo v1.71

Microsoft Visual C++ v5.0/v6.0 (MFC)

Microsoft Visual C++

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Has no visible windows
Reads memory of another process

Behavioral Information

QueryFilePath

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\installer.exe

CreateProcess

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\GenericSetup.exe

CreateMutex

GenericSetupInstaller_PF001

<NULL>

DeleteFile

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\2018.06.14_05.34.15.698375_installer_pid=2748.txt

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\BundleConfig.xml

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\de\DevLib.resources.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\DevLib.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\en\DevLib.resources.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\es\DevLib.resources.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\fr\DevLib.resources.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\GenericSetup.exe

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\GenericSetup.exe.config

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\installer.exe

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\Microsoft.Win32.TaskScheduler.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\OfferInstaller.exe

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\OfferInstaller.exe.config

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\PDFForge.dll

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\WizardPages.dll

WriteFile

C:/Users/win7/AppData/Local/Temp/7zS01B6EE63/GenericSetup.exe.config

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\2018.06.14_05.34.15.698375_installer_pid=2748.txt

ReadFile

C:\Users\win7\AppData\Local\Temp\7zS01B6EE63\BundleConfig.xml

C:/Users/win7/AppData/Local/Temp/7zS01B6EE63/GenericSetup.exe.config

C:/Users/win7/AppData/Local/Temp/7zS01B6EE63/BundleConfig.xml

LoadLibrary

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-appmodel-runtime-l1-1-1

ext-ms-win-kernel32-package-current-l1-1-0

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

OLEAUT32.dll

CRYPTSP.dll

api-ms-win-core-sysinfo-l1-2-1

OpenRegistryKey

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Micro

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2018-06-14 02:34:20.213366	No Match	NotDetected
Static Precise Trojan Detector 5	2018-06-14 02:34:20.213670	No Match	NotDetected
Static Precise Trojan Detector 7	2018-06-14 02:34:20.217907	No Match	NotDetected
Static Precise PUA Detector 4	2018-06-14 02:34:20.213888	No Match	NotDetected
Static Precise PUA Detector 5	2018-06-14 02:34:20.226063	No Match	NotDetected
Static Precise Trojan Detector 1	2018-06-14 02:34:20.226187	No Match	NotDetected
Static Precise Trojan Detector 2	2018-06-14 02:34:20.266736	No Match	NotDetected
Static Precise Trojan Detector 3	2018-06-14 02:34:20.250730	No Match	NotDetected
Static Precise Trojan Detector 12	2018-06-14 02:34:20.293797	No Match	NotDetected
Static Precise Trojan Detector 10	2018-06-14 02:34:20.306075	No Match	NotDetected
Static Precise Virus Detector 1	2018-06-14 02:34:20.301850	No Match	NotDetected
Static Precise Virus Detector 2	2018-06-14 02:34:20.325604	No Match	NotDetected