Analyzing...
|
File Name:   1.exe
SHA1:   fb608457bdf2def8455bdba2909496290fd25234
MD5:   6d46d6311c2c3abcea5de4288c4fcef5
First Seen Date:  2016-09-10 22:37:28.375940 ( )
Number of Clients Seen:   5
Last Analysis Date:  2017-02-07 17:01:34.428663 ( )
Human Expert Analysis Date:  2017-02-27 19:22:49.037554 ( )Human Expert Analysis Result:   Malware
Analysis Summary
Analysis Type | Date | Verdict | |
---|---|---|---|
Signature Based Detection | 2017-02-07 17:01:34.428663 | Malware | |
Static Analysis Overall Verdict | 2017-02-07 17:01:34.428663 | Highly Suspicious | |
Dynamic Analysis Overall Verdict | 2017-02-07 17:01:34.428663 | No Threat Found | help |
Human Expert Analysis Overall Verdict | 2017-02-27 19:22:49.037554 | Malware |
Static Analysis
Static Analysis Overall Verdict | Result |
---|---|
Highly Suspicious |
Detector | Result | |
---|---|---|
Optional Header LoaderFlags field is valued illegal | Clean | |
Non-ascii or empty section names detected | Clean | |
Illegal size of optional Header | Clean | |
Packer detection on signature database | Unknown | help |
Based on the sections entropy check! file is possibly packed | Suspicious | |
Timestamp value suspicious | Clean | |
Header Checksum is zero! | Clean | |
Enrty point is outside the 1st(.code) section! Binary is possibly packed | Clean | |
Optional Header NumberOfRvaAndSizes field is valued illegal | Clean | |
Anti-vm present | Clean | |
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger | Clean | |
TLS callback functions array detected | Clean |
Packer detection on signature database
Microsoft Visual Basic v5.0
Microsoft Visual Basic v5.0/v6.0
Dynamic Analysis
Dynamic Analysis Overall Verdict | Result |
---|---|
No Threat Found | help |
Suspicious Behaviors | |
---|---|
Creates a child process | |
Writes to address space of another process | |
Uses a function clandestinely | |
Reads memory of another process | |
Modifies Windows policies | |
Opens a file in a system directory |
Behavioral Information
C:\Users\win7\AppData\Local\Temp\taskmgr.exe
C:\Windows\system32\DUser.dll
C:\1.exe
C:\Windows\syswow64\USER32.dll
C:\Windows\system32\zipfldr.dll
C:\Windows\system32\PROPSYS.dll
C:\Windows\System32\shdocvw.dll
C:\Windows\syswow64\SHELL32.dll
file
document
.exe
program
DEPOff
ProtectedModeOffForAllZones
FrameTabWindow
FrameMerging
SessionMerging
AdminTabProcs
TabProcGrowth
EnableLUA
LuaOffLoRIEOn
CreateUriCacheSize
EnablePunycode
DisableSecuritySettingsCheck
SystemSetupInProgress
SpecialFoldersCacheSize
GUID
DisableAntiSpyware
DisableRealtimeMonitoring
DisableIOAVProtection
Enable
MaxFileSize
IOAVMaxSize
Software\Microsoft\Internet Explorer\Main
C:\Windows\system32\rsaenh.dll
C:\Users\win7\AppData\Local\Temp\\~DFC2942C4DE9A769C9.TMP
C:\Windows\SysWOW64\wshom.ocx
C:\Users\win7\AppData\Local\Temp\temp1000.tmp
C:\Users\win7\AppData\Local\Temp\temp1004.tmp
C:\Users\win7\AppData\Local\Temp\temp1001.tmp
C:\Users\win7\AppData\Local\Temp\temp1005.tmp
C:\Users\win7\AppData\Local\Temp\temp1111.tmp
C:\Users\win7\AppData\Local\Temp\temp1006.tmp
C:\Users\win7\AppData\Local\Temp\temp1002.tmp
C:\Users\win7\AppData\Local\Temp\temp1003.tmp
C:\Users\win7\AppData\Local\Temp\temp1010.tmp
C:\Users\win7\AppData\Local\Temp\temp1020.tmp
C:\Users\win7\AppData\Local\Temp\temp1030.tmp
C:\Users\win7\AppData\Local\Temp\temp1040.tmp
C:\Users\win7\AppData\Local\Temp\temp1050.tmp
C:\Users\win7\AppData\Local\Temp\temp1060.tmp
C:\Users\win7\AppData\Local\Temp\temp1070.tmp
C:\Users\win7\AppData\Local\Temp\temp1080.tmp
C:\Users\win7\AppData\Local\Temp\temp1090.tmp
C:\Users\win7\AppData\Local\Temp\temp1100.tmp
C:\Users\win7\AppData\Local\Temp\temp1110.tmp
C:\Users\win7\AppData\Local\Temp\temp1120.tmp
C:\Users\win7\AppData\Local\Temp\temp1130.tmp
C:\Users\win7\AppData\Local\Temp\temp1140.tmp
C:\Users\win7\AppData\Local\Temp\temp0000.tmp
C:\Users\win7\AppData\Local\Temp\files.zip
C:\Users\win7\AppData\Local\Temp\temp910\temp800
C:\Windows\SysWOW64\shell32.dll
C:\
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db
C:\Users\desktop.ini
C:\Users
C:\Users\win7
C:\Users\win7\AppData
C:\Users\win7\AppData\Local
C:\Users\win7\AppData\Local\Temp
C:\Users\win7\Searches\desktop.ini
C:\Users\win7\Videos\desktop.ini
C:\Users\win7\Contacts\desktop.ini
C:\Users\win7\Favorites\desktop.ini
C:\Users\win7\Downloads\desktop.ini
C:\Users\win7\Links\desktop.ini
C:\Users\win7\Saved Games\desktop.ini
\??\C:\Windows\System32\shdocvw.dll
\??\C:\Windows\system32\zipfldr.dll
C:\Users\win7\AppData\Local\Temp\temp1998.zip
C:\Users\win7\AppData\Local\Temp\desktop.ini
C:\Users\win7\AppData\Local\Temp\1
C:\Users\win7\AppData\Local\Temp\2
C:\Users\win7\AppData\Local\Temp\3
C:\Users\win7\AppData\Local\Temp\4
C:\Users\win7\AppData\Local\Temp\v1843453.pdf
C:\Users\Public
C:\ProgramData
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\Users\win7\AppData\Roaming
C:\Users\win7\AppData\Roaming\Microsoft\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft
C:\Users\win7\AppData\Roaming\Microsoft\Windows
C:\Windows
C:\Windows\Fonts\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows 10 updater.lnk
C:\Users\win7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows 10 updater.lnk\desktop.ini
C:\Users\win7\AppData\Local\Temp\taskmgr.exe
C:\1.exe
Software\Policies\Microsoft\Internet Explorer\Main
Software\Microsoft\Internet Explorer\Main
Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
Software\Microsoft\Internet Explorer\Main\FeatureControl
FEATURE_ENABLESAFESEARCHPATH_KB963027
Software\Policies
Software
Software\Policies\Microsoft\Internet Explorer
Microsoft\Internet Explorer\Low Rights
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Internet Explorer\Low Rights
Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.zip
SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
Tahoma
FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915
FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
Software\Microsoft\Windows\CurrentVersion\Internet Settings
FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
Microsoft\Internet Explorer\Security
System\Setup
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
FEATURE_LOCALMACHINE_LOCKDOWN
FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
FEATURE_PROTOCOL_LOCKDOWN
Software\Microsoft\RemovalTools\MRT
SOFTWARE\Policies\Microsoft
SOFTWARE\Microsoft\Windows Defender
SOFTWARE\Policies\Microsoft\Windows Defender\
SOFTWARE\Microsoft\MpDebug\DebugValues\MsMpEng.exe
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Hosts\SHDOCVW\1.exe
CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Hosts\SHDOCVW
Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.
Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.pdf
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
<NULL>
CicLoadWinStaWinSta0
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" www.adobe.com
"C:\Users\win7\AppData\Local\Temp\taskmgr.exe" 0
api-ms-win-downlevel-shell32-l1-1-0.dll
SXS.DLL
ADVAPI32.dll
CRYPTBASE.dll
ws2_32.dll
user32
SspiCli.dll
C:\Windows\system32\kernel32.dll
C:\Windows\system32\ole32.dll
ntmarta.dll
C:\Windows\System32\shdocvw.dll
PROPSYS.dll
OLEAUT32.dll
C:\Windows\system32\zipfldr.dll
comctl32.dll
Comctl32.dll
ntdll.dll
DUser.dll
C:\Windows\system32\DUser.dll
user32.dll
dwmapi.dll
UxTheme.dll
ole32.dll
C:\Windows\system32\xmllite.dll
OLEACC.dll
OLEACCRC.DLL
OLEAUT32.DLL
kernel32.dll
Secur32.dll
API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL
SHELL32.dll
api-ms-win-downlevel-advapi32-l2-1-0.dll
advapi32
C:\Windows\system32\user32.dll
C:\Windows\system32\winshfhc.dll
shell32.dll
C:\Users\win7\AppData\Local\Temp\files.zip
C:\Users\win7\AppData\Local\Temp\temp777
C:\Users\win7\AppData\Local\Temp\temp1998.zip
ShellExecuteA
Precise Detectors Analysis Results
No Detector Result Received
Advance Heuristics
No Advanced Heuristic Analysis Result Received
Human Expert Analysis Results
Analysis Start Date:   2017-01-19 04:18:56.647244 ( )
Analysis End Date:  2017-02-27 19:22:49.037554 ( )
File Upload Date:  2016-09-10 22:37:28.795502 ( )
Update Date:  2017-02-27 19:22:49.043549 ( )
Human Expert Analyst Feedback:   Malware
Verdict:   Malware
Malware Family:   TrojWare.Win32.Agent
Malware Type:   Trojan Generic
Additional File Information
Property | Value |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | MD5 |
---|