Analyzing...

File Name: youtubesaved2_303748.exe

SHA1: f03808503d329b4b91c4434e659ec6b7a91a4a64

MD5: c6c17842e893a6f4ed7c1b549121c929

First Seen Date: 2016-10-05 00:34:43.140488 ( 2016-10-05 00:34:43.140488 )

Number of Clients Seen: 7

Last Analysis Date: 2018-12-13 08:56:00.304651 ( 2018-12-13 08:56:00.304651 )

Human Expert Analysis Date: 2018-12-13 08:47:45.469809 ( 2018-12-13 08:47:45.469809 )

Human Expert Analysis Result: Malware

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2018-12-13 08:56:00.304651	Malware
Static Analysis Overall Verdict	2018-12-13 08:56:00.304651	No Threat Found
Dynamic Analysis Overall Verdict	2018-12-13 08:56:00.304651	No Threat Found
Precise Detectors Overall Verdict	2018-12-13 08:56:00.304651	No Match
Human Expert Analysis Overall Verdict	2018-12-13 08:47:45.469809	Malware

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Opens a file in a system directory
Uses a function clandestinely
Has no visible windows

Behavioral Information

LoadLibrary

SHFOLDER

ole32.dll

comctl32.dll

ADVAPI32.dll

SHELL32.dll

propsys.dll

ntmarta.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\nxs.dll

UxTheme.dll

imageres.dll

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

OLEAUT32.DLL

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\NSISArray.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\System.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\IpConfig.dll

API-MS-Win-Security-LSALookup-L1-1-0.dll

CRYPTBASE.dll

OLEAUT32.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\inetc_n.dll

Secur32.dll

api-ms-win-downlevel-advapi32-l2-1-0.dll

api-ms-win-downlevel-ole32-l1-1-0.dll

WS2_32.dll

winhttp.dll

wininet.dll

IPHLPAPI.DLL

api-ms-win-downlevel-shlwapi-l2-1-0.dll

DNSAPI.dll

urlmon.dll

dhcpcsvc.DLL

CreateMutex

<NULL>

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

DeleteFile

C:\Users\win7\AppData\Local\Temp\nsvEDA5.tmp

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp

C:\Users\win7\AppData\Local\Temp\303748\303748_1.zip

C:\Users\win7\AppData\Local\Temp\303748\303748.zip

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\inetc_n.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\IpConfig.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\NSISArray.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\nxs.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\System.dll

OpenMutex

Local\MSCTF.Asm.MutexDefault1

WriteFile

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\System.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\NSISArray.dll

C:\youtubesaved2_303748.exe

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db

C:\Users\win7\AppData\Local\Temp\nsvEDA6.tmp

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\IpConfig.dll

C:\Users\win7\AppData\Local\Temp\303748\303748.zip

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\inetc_n.dll

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\nxs.dll

ReadFile

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db

C:\youtubesaved2_303748.exe

C:\Users\win7\AppData\Local\Temp\nsvEDA6.tmp

C:\Windows\Fonts\staticcache.dat

QueryFilePath

C:\youtubesaved2_303748.exe

C:\Users\win7\AppData\Local\Temp\nsfEE33.tmp\nxs.dll

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

OpenRegistryKey

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_CURRENT_USERSoftware\Microsoft\Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USERSOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Internet Explorer

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_CURRENT_USERSoftware\Policies

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

HKEY_LOCAL_MACHINESoftware\Microsoft\Internet Explorer\Main

HKEY_CURRENT_USERSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\PeerDist\Service

HKEY_CURRENT_USERSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINESoftware\Microsoft\Windows NT\CurrentVersion\PeerDist\Service

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink

HKEY_LOCAL_MACHINESystem\Setup

HKEY_CURRENT_USERSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback

HKEY_CURRENT_USERSoftware

HKEY_CURRENT_USERSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USERSoftware\Policies\Microsoft\Internet Explorer

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad

HKEY_LOCAL_MACHINESoftware\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl

HKEY_LOCAL_MACHINESoftware\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

HKEY_LOCAL_MACHINESoftware\Policies

HKEY_CURRENT_USERSoftware\Policies\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINESoftware\Microsoft\Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USERSoftware\Microsoft\Internet Explorer\Main

HKEY_LOCAL_MACHINESoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINESoftware

HKEY_LOCAL_MACHINESoftware\Microsoft\WBEM\CIMOM

CreateRegistryKey

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

HKEY_CURRENT_USERSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_CURRENT_USERSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2017-12-12 10:44:02.481340	No Match	NotDetected
Static Precise Virus Detector	2017-12-12 10:44:02.481034	No Match	NotDetected
Static Precise Trojan Detector	2017-12-12 10:44:02.512546	No Match	NotDetected
Static Precise Adware InstallCore Detector 1	2017-12-12 10:44:02.514244	No Match	NotDetected
Static Precise Trojan Detector 2	2017-12-12 10:44:02.515706	No Match	NotDetected
Static Precise Trojan Detector 3	2017-12-12 10:44:02.515814	No Match	NotDetected
Static Precise Trojan Generic Cryptor Detector 1	2017-12-12 10:44:02.525599	No Match	NotDetected
Static Precise Virus Detector 2	2017-12-12 10:44:02.533034	No Match	NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2018-12-13 07:37:20.570239 ( 2018-12-13 07:37:20.570239 )

Analysis End Date: 2018-12-13 08:47:45.469809 ( 2018-12-13 08:47:45.469809 )

File Upload Date: 2018-12-13 07:34:09.723184 ( 2018-12-13 07:34:09.723184 )

Update Date: 2018-12-13 08:55:58.807380 ( 2018-12-13 08:55:58.807380 )

Human Expert Analyst Feedback:

Verdict: Malware

Malware Family: Trojware

Malware Type: 0

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5

PE Imports

PE Exports

PE Resources

Loading...

File Name: youtubesaved2_303748.exe

SHA1: f03808503d329b4b91c4434e659ec6b7a91a4a64

MD5: c6c17842e893a6f4ed7c1b549121c929

First Seen Date: 2016-10-05 00:34:43.140488 ( 2016-10-05 00:34:43.140488 )

Number of Clients Seen: 7

Last Analysis Date: 2018-12-13 08:56:00.304651 ( 2018-12-13 08:56:00.304651 )

Human Expert Analysis Result: Malware

Analysis Summary

Static Analysis

Dynamic Analysis

youtubesaved2_303748.exe tried to connect to some addresses pinned on the map below (click pins for more details):

Behavioral Information

Precise Detectors Analysis Results

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2018-12-13 07:37:20.570239 ( 2018-12-13 07:37:20.570239 )

Analysis End Date: 2018-12-13 08:47:45.469809 ( 2018-12-13 08:47:45.469809 )

File Upload Date: 2018-12-13 07:34:09.723184 ( 2018-12-13 07:34:09.723184 )

Update Date: 2018-12-13 08:55:58.807380 ( 2018-12-13 08:55:58.807380 )

Human Expert Analyst Feedback:

Verdict: Malware

Malware Family: Trojware

Malware Type: 0

Additional File Information