ID: Sample Name: adobe.snr.patch.v2.0-painter.exe Cookbook: default.jbs Time: 18:11:59 Date: 06/07/2018 Version:

Transcription

1 ID: Sample Name: adobe.snr.patch.v2.0-painter.exe Cookbook: default.jbs Time: 18:11:5 Date: 06/07/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Key, Mouse, Clipboard, Microphone and Screen Capturing: Persistence and Installation Behavior: Data Obfuscation: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Imports Version Infos Possible Origin Network Behavior Code Manipulations Statistics System Behavior Analysis Process: adobe.snr.patch.v2.0-painter.exe PID: 3380 Parent PID: 256 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 17

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 18:11:5 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 5m 2s false light adobe.snr.patch.v2.0-painter.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal52.winexe@1/1@0/0 HCA Information: Successful, ratio: 72% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 21.6% (good quality ratio 21.3%) Quality average: 82.5% Quality standard deviation: 20.4% Cookbook Comments: Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.exe Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 4 of 17

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Copyright Joe Security LLC 2018 Page 5 of 17

6 Signature Overview AV Detection Spreading Key, Mouse, Clipboard, Microphone and Screen Capturing Persistence and Installation Behavior Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for submitted file Antivirus detection for unpacked file Key, Mouse, Clipboard, Microphone and Screen Capturing: Contains functionality to record screenshots Contains functionality to retrieve information about pressed keystrokes Persistence and Installation Behavior: Drops PE files Data Obfuscation: Entry point lies outside standard sections PE file contains sections with non-standard names Uses code obfuscation techniques (call, push, ret) Binary may include packed or encrypted code Spreading: Contains functionality to enumerate / list files inside a directory System Summary: Detected potential crypto function PE file contains strange resources Sample file is different than original file name gathered from version info PE file has section (not.text) which is very likely to contain packed code (zlib compression ratio < 0.011) Classification label Contains functionality for error logging Contains functionality to load and extract PE file embedded resources Creates temporary files Copyright Joe Security LLC 2018 Page 6 of 17

7 Parts of this applications are using Borland Delphi (Probably coded in Delphi) Reads ini files Reads software policies Sample is known by Antivirus Uses an in-process (OLE) Automation server Executable creates window controls seldom found in malware HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Malware Analysis System Evasion: Found a high number of Window / User specific system calls (may be a loop to detect user behavior) Contains functionality to enumerate / list files inside a directory Contains functionality to query system information Hooking and other Techniques for Hiding and Protection: Contains functionality to check if a window is minimized (may be used to check if an application is visible) Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Contains functionality locales information (e.g. system language) Contains functionality to query windows version Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 17

8 Hide Legend Behavior Graph ID: Sample: adobe.snr.patch.v2.0-painter.exe Startdate: 06/07/2018 Architecture: WINDOWS Score: 52 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Multi AV Scanner detection for submitted file Antivirus detection for unpacked file started Java.Net C# or VB.NET C, C++ or other language Is malicious adobe.snr.patch.v2.0-painter.exe 1 dropped C:\Users\HERBBL~1\AppData\...\vgm_player.dll, PE32 Simulations Behavior and APIs Time Type Description 18:12:45 API Interceptor 1x Sleep call for process: adobe.snr.patch.v2.0-painter.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link adobe.snr.patch.v2.0-painter.exe 5% virustotal Browse adobe.snr.patch.v2.0-painter.exe 41% metadefender Browse Dropped Files Source Detection Scanner Label Link C:\Users\HERBBL~1\AppData\Local\Temp\vgm_player.dll 0% virustotal Browse C:\Users\HERBBL~1\AppData\Local\Temp\vgm_player.dll 2% metadefender Browse Unpacked PE Files Source Detection Scanner Label Link 1.2.adobe.snr.patch.v2.0-painter.exe unpack 100% Avira HEUR/AGEN adobe.snr.patch.v2.0-painter.exe unpack 100% Avira HEUR/AGEN Copyright Joe Security LLC 2018 Page 8 of 17

9 Domains No Antivirus matches URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 17

10 Startup System is w7 cleanup adobe.snr.patch.v2.0-painter.exe (PID: 3380 cmdline: 'C:\Users\user\Desktop\adobe.snr.patch.v2.0-painter.exe' MD5: B3167DB7DB8782B455320AE6C7C) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\vgm_player.dll Process: File Type: Size (bytes): 8368 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: Reputation: C:\Users\user\Desktop\adobe.snr.patch.v2.0-painter.exe PE32 executable (DLL) (GUI) Intel 80386, for MS Windows false 47361F2E1CE56253C36C1E3E450C B61E C0F02FCDBF514AFA4CE1C C5F76741A5B02C7373A05C13F44B47AF60D130F2B2D1A510E7DF270BD2E4D62A 0B2FAD6A2786D34ED55525F67BE6661BC22CCD3E0E752F60A787E804CE0C475CBA6D672A0507C55334D48 E12E2BBD51F23BE1E30553B528B3516FFF2 true low Antivirus: virustotal, Detection: 0%, Browse Antivirus: metadefender, Detection: 2%, Browse Copyright Joe Security LLC 2018 Page 10 of 17

11 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: MS-DOS executable, MZ for MS-DOS Entropy (8bit): TrID: Win32 Executable (generic) a ( /4).4% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Java Script embedded in Visual Basic Script (1500/0) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: adobe.snr.patch.v2.0-painter.exe b3167db7db8782b455320ae6c7c 7d0d2b434b51abe1e5b16e4c8dc8d26143b138c 256c2a40c7448d168f3eb1bfb8af3d25dfc05a510a3f 464d8e4b348116d4 ac65a280c5bfcda221a47237e6f454c85cf0a2222cd0 46d2326a03cfaaa5b6424c463f128affc1c8861baa c a462717d81a7e3b08a75f2 MZ@...!..L.!Win32.EXE...$@...PE..L...^B*...?S......@......P..@...`...k File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 0x5a533f.MPRESS2 false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI 0x2A425E1 [Fri Jun 1 22:22:17 12 UTC] Copyright Joe Security LLC 2018 Page 11 of 17

12 General Import Hash: 416af365bd ad4b3cea47 Entrypoint Preview Instruction pushad call 00007FB5D1A135D5h pop eax add eax, 00000B5Ah mov esi, dword ptr [eax] add esi, eax sub eax, eax mov edi, esi lodsw shl eax, 0Ch mov ecx, eax push eax lodsd sub ecx, eax add esi, ecx mov ecx, eax push edi push ecx dec ecx mov al, byte ptr [ecx+edi+06h] mov byte ptr [ecx+esi], al jne 00007FB5D1A135C8h sub eax, eax lodsb mov ecx, eax and cl, FFFFFFF0h and al, 0Fh shl ecx, 0Ch mov ch, al lodsb or ecx, eax push ecx add cl, ch mov ebp, FFFFFD00h shl ebp, cl pop ecx pop eax mov ebx, esp lea esp, dword ptr [esp+ebp* e70h] push ecx sub ecx, ecx push ecx push ecx mov ecx, esp push ecx mov dx, word ptr [edi] shl edx, 0Ch push edx push edi add ecx, 04h push ecx push eax add ecx, 04h push esi push ecx call 00007FB5D1A13633h mov esp, ebx pop esi pop edx Copyright Joe Security LLC 2018 Page 12 of 17

13 Instruction sub eax, eax mov dword ptr [edx+esi], eax mov ah, 10h sub edx, eax sub ecx, ecx cmp ecx, edx jnc 00007FB5D1A135F8h mov ebx, ecx lodsb inc ecx and al, FEh cmp al, E8h jne 00007FB5D1A135C4h inc ebx add ecx, 04h lodsd or eax, eax js 00007FB5D1A135D8h cmp eax, edx jnc 00007FB5D1A135B7h jmp 00007FB5D1A135D8h add eax, ebx js 00007FB5D1A135B1h add eax, edx sub eax, ebx mov dword ptr [esi-04h], eax jmp 00007FB5D1A135A8h call 00007FB5D1A135D5h pop edi add edi, FFFFFF4Dh mov al, Eh stosb mov eax, 00000B56h Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x1a5000 0x340.MPRESS2 IMAGE_DIRECTORY_ENTRY_RESOURCE 0x1a6000 0x6be4.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x1a5eb0 0x18.MPRESS2 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x1a517c 0x50.MPRESS2 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.MPRESS1 0x1000 0x1a4000 0x8b000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZE D_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 2018 Page 13 of 17

14 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.MPRESS2 0x1a5000 0xed8 0x1000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZE D_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x1a6000 0x6be4 0x6c00 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country LIB 0x15f64c 0x14800 empty English United States RT_CURSOR 0x173e4c 0x134 empty English United States RT_CURSOR 0x173f80 0x134 empty RT_CURSOR 0x1740b4 0x134 empty RT_CURSOR 0x1741e8 0x134 empty RT_CURSOR 0x17431c 0x134 empty RT_CURSOR 0x x134 empty RT_CURSOR 0x x134 empty RT_CURSOR 0x1746b8 0x134 empty RT_BITMAP 0x1747ec 0x1d0 empty RT_BITMAP 0x174bc 0x1e4 empty RT_BITMAP 0x174ba0 0x1d0 empty RT_BITMAP 0x174d70 0x1d0 empty RT_BITMAP 0x174f40 0x1d0 empty RT_BITMAP 0x x1d0 empty RT_BITMAP 0x1752e0 0x1d0 empty RT_BITMAP 0x1754b0 0x1d0 empty RT_BITMAP 0x x1d0 empty RT_BITMAP 0x x1d0 empty RT_BITMAP 0x175a20 0x488 empty Russian Russia RT_BITMAP 0x175ea8 0xc0 empty RT_BITMAP 0x175f68 0xe0 empty RT_BITMAP 0x xe0 empty RT_BITMAP 0x xe0 empty RT_BITMAP 0x xc0 empty RT_BITMAP 0x1762c8 0xc0 empty RT_BITMAP 0x xe0 empty RT_BITMAP 0x xc58 empty English United States RT_BITMAP 0x1770c0 0x328 empty English United States RT_BITMAP 0x1773e8 0xc0 empty RT_BITMAP 0x1774a8 0xe0 empty RT_BITMAP 0x xe8 empty Russian Russia RT_BITMAP 0x x328 empty English United States RT_BITMAP 0x1778 0xc0 empty RT_BITMAP 0x177a58 0x328 empty English United States RT_BITMAP 0x177d80 0x328 empty English United States RT_BITMAP 0x1780a8 0x328 empty English United States RT_BITMAP 0x1783d0 0xe0 empty RT_ICON 0x1a6a04 0x11fc PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced English United States RT_ICON 0x1a7c28 0x25a8 data English United States RT_ICON 0x1aa1f8 0x10a8 data English United States RT_ICON 0x1ab2c8 0x468 GLS_BINARY_LSB_FIRST English United States RT_DIALOG 0x17d164 0x52 empty RT_STRING 0x17d1b8 0x4c empty RT_STRING 0x17d204 0xaa empty RT_STRING 0x17d2b0 0x186 empty RT_STRING 0x17d438 0x1ce empty RT_STRING 0x17d608 0x144 empty RT_STRING 0x17d74c 0x7e empty RT_STRING 0x17d7cc 0x24 empty RT_STRING 0x17d7f0 0x1a0 empty RT_STRING 0x17d0 0x1d8 empty Copyright Joe Security LLC 2018 Page 14 of 17

15 Name RVA Size Type Language Country RT_STRING 0x17db68 0x1ec empty RT_STRING 0x17dd54 0xec empty RT_STRING 0x17de40 0x370 empty RT_STRING 0x17e1b0 0xc0 empty RT_STRING 0x17e270 0xfc empty RT_STRING 0x17e36c 0x120 empty RT_STRING 0x17e48c 0x4ac empty RT_STRING 0x17e38 0x36c empty RT_STRING 0x17eca4 0x30 empty RT_STRING 0x17f034 0x430 empty RT_STRING 0x17f464 0xf0 empty RT_STRING 0x17f554 0xd8 empty RT_STRING 0x17f62c 0x274 empty RT_STRING 0x17f8a0 0x3e0 empty RT_STRING 0x17fc80 0x388 empty RT_STRING 0x x2d8 empty RT_RCDATA 0x1802e0 0xcbf empty English United States RT_RCDATA 0x180fa0 0x3a5 empty English United States RT_RCDATA 0x xd58 empty Russian Russia RT_RCDATA 0x1820a0 0xd0d empty Russian Russia RT_RCDATA 0x182db0 0x10 empty RT_RCDATA 0x182dc0 0x684 empty RT_RCDATA 0x x434 empty English United States RT_RCDATA 0x x4b1 empty English United States RT_RCDATA 0x183d2c 0x1a1 empty English United States RT_RCDATA 0x183ed0 0x671 empty English United States RT_RCDATA 0x x7b1 empty English United States RT_RCDATA 0x184cf8 0x70b empty RT_RCDATA 0x x1a0b empty RT_RCDATA 0x1fd10 0x640 empty RT_RCDATA 0x1a0350 0x1bf0 empty RT_RCDATA 0x1a1f40 0x1fdb empty RT_RCDATA 0x1a3f1c 0x2f3 empty RT_GROUP_CURSOR 0x1a4210 0x14 empty English United States RT_GROUP_CURSOR 0x1a4224 0x14 empty RT_GROUP_CURSOR 0x1a4238 0x14 empty RT_GROUP_CURSOR 0x1a424c 0x14 empty RT_GROUP_CURSOR 0x1a4260 0x14 empty RT_GROUP_CURSOR 0x1a4274 0x14 empty RT_GROUP_CURSOR 0x1a4288 0x14 empty RT_GROUP_CURSOR 0x1a42c 0x14 empty RT_GROUP_ICON 0x1ac2b4 0x3e MS Windows icon resource - 4 icons, 256-colors English United States RT_VERSION 0x1ac334 0x2e0 data English United States RT_MANIFEST 0x1ac654 0x58f XML document text English United States Imports DLL KERNEL32.DLL user32.dll advapi32.dll oleaut32.dll version.dll gdi32.dll ole32.dll comctl32.dll shell32.dll comdlg32.dll Import GetModuleHandleA, GetProcAddress CharNextA RegCloseKey SysFreeString VerQueryValueA SaveDC CoInitialize ImageList_Add SHGetFileInfoA GetOpenFileNameA Version Infos Description Data LegalCopyright PainteR InternalName Universal Adobe Patcher FileVersion Copyright Joe Security LLC 2018 Page 15 of 17

16 Description Data CompanyName PainteR ProductName Universal Adobe Patcher ProductVersion FileDescription Universal Adobe Patcher OriginalFilename adobesnr.exe Translation 0x041 0x04b0 Possible Origin Language of compilation system Country where language is spoken Map English United States Russian Russia Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: adobe.snr.patch.v2.0-painter.exe PID: 3380 Parent PID: 256 General Start time: 18:12:45 Start date: 06/07/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\adobe.snr.patch.v2.0-painter.exe false 'C:\Users\user\Desktop\adobe.snr.patch.v2.0-painter.exe' 0x bytes B3167DB7DB8782B455320AE6C7C true Borland Delphi low File Activities Copyright Joe Security LLC 2018 Page 16 of 17

17 File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol File Path Offset Length Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 17 of 17