ID: Sample Name: calc1 Cookbook: default.jbs Time: 14:46:00 Date: 13/07/2018 Version:

Transcription

1 ID: 98 Sample Name: calc1 Cookbook: default.jbs Time: 14:4:00 Date: 13/0/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Data Obfuscation: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Code Manipulations Statistics System Behavior Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Disassembly 12 Copyright Joe Security LLC 2018 Page 3 of 12

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 98 Start time: 14:4:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 1s false light calc1 (renamed file extension from none to exe) default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Warnings: Errors: HCA enabled EGA enabled HDC enabled Timeout UNKNOWN unknown1.winexe@0/0@0/0 Adjust boot time Correcting counters for adjusted boot time Unable to launch sample, stop analysis Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Unable to start the sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 4 of 12

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample requires a 4bit OS, try executing the sample on a 4bit version of Windows Copyright Joe Security LLC 2018 Page 5 of 12

6 Signature Overview Data Obfuscation System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section Data Obfuscation: PE file contains sections with non-standard names System Summary: PE file contains strange resources Classification label PE file has a high image base, often used for DLLs Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Scanner Label Link calc1.exe 3% virustotal Browse Dropped Files No Antivirus matches Copyright Joe Security LLC 2018 Page of 12

7 Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 12

8 Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE32+ executable (GUI) x8-4, for MS Windows Entropy (8bit): Copyright Joe Security LLC 2018 Page 8 of 12

9 General TrID: Win4 Executable GUI (20200/5) 98.04% Generic Win/DOS Executable (2004/3) 0.9% DOS Executable Generic (2002/1) 0.9% VXD Driver (31/22) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.00% File name: File size: MD5: SHA1: SHA25: SHA512: File Content Preview: calc1.exe f82a38c080f8b135bf559dcd5ad59bad e2d1c9ab338432abb13c01f054133c8a19 f2a5591cb3f51dd34f240e13d4128a e203ce0fede38ff f42e5b1542ea1188ed2bfb98d9df4d4eb159 59ff050d5524b4d82158e2208ece0a59d5ad090b 9d9d8354af4ca90d8143ac85081f is program cannot be run in DOS mode...$...pe..d... File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x code false 0x windows gui LOCAL_SYMS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x59E250F0 [Sat Oct 14 18:01: UTC] fd0a bcae5e414d1f Entrypoint Preview Instruction sub esp, 28h dec ecx mov eax, h xor edx, edx mov ecx, 4000D4h add dword ptr [eax], eax add byte ptr [eax], al call 0000FD2D15F98h xor ecx, ecx call 0000FD2D15F9h mov dword ptr [00005B0h], eax dec ebp Copyright Joe Security LLC 2018 Page 9 of 12

10 Instruction xor eax, eax mov edx, h xor ecx, ecx call 0000FD2D15F83h mov dword ptr [000058Fh], eax call 0000FD2D11ABh call 0000FD2D18h call 0000FD2D1205h push ecx sub esp, 28h call 0000FD2D120h add esp, 28h pop ecx push eax sub esp, 08h push ecx sub esp, 28h call 0000FD2D11F3h add esp, 28h pop ecx mov edx, eax mov ecx, h add byte ptr [eax], al add byte ptr [eax], al sub esp, 20h call 0000FD2D15FF8h add esp, 28h lea ecx, dword ptr [00005Ch] pop edx call 0000FD2D121h mov ecx, dword ptr [000055Fh] call 0000FD2D103Bh push eax mov eax, dword ptr [ h] mov ecx, eax pop edx call 0000FD2D15F0Ch mov ecx, dword ptr [ h] Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x04c 0x8.data IMAGE_DIRECTORY_ENTRY_RESOURCE 0x8000 0x4e0.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x5000 0x2c4.pdata IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 Copyright Joe Security LLC 2018 Page 10 of 12

11 Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x284 0x1c0.data IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.code 0x1000 0x8e1 0xa00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.text 0x2000 0x1faa 0x2000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0x4000 0x2b0 0x400 False VAX-order 8k Blit mpx/mux executable IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ.pdata 0x5000 0x2c4 0x400 False data IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ.data 0x000 0x1108 0x800 False data IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x8000 0x4e0 0x00 False data IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x8280 0x2e8 data English United States RT_ICON 0x858 0x128 GLS_BINARY_LSB_FIRST English United States RT_ICON 0x890 0xea8 dbase IV DBT of `.DBF, blocks size 48, next free block index 40, 1st item "\3\215R" English United States RT_ICON 0x9538 0x8a8 data English United States RT_ICON 0x9de0 0x58 GLS_BINARY_LSB_FIRST English United States RT_ICON 0xa348 0x25a8 dbase IV DBT of `.DBF, blocks size 48, next free block index 40, 1st item "\202kd\341b[X\2\023\022\022\223" English United States RT_ICON 0xc8f0 0x10a8 data English United States RT_ICON 0xd998 0x48 GLS_BINARY_LSB_FIRST English United States RT_GROUP_ICON 0xde00 0x MS Windows icon resource - 8 icons, 32x32, 1-colors English United States RT_VERSION 0xde8 0x304 data English United States RT_MANIFEST 0xe1c 0x33 XML document text English United States Imports DLL msvcrt.dll KERNEL32.dll USER32.DLL SHELL32.DLL WINMM.DLL Import memset, wcslen, wcscpy, wcscat, memcpy, memmove, wcscmp GetModuleHandleW, HeapCreate, GetSystemDirectoryW, HeapDestroy, ExitProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, CloseHandle, Sleep, InitializeCriticalSection, GetCurrentProcess, DuplicateHandle, CreatePipe, GetStdHandle, HeapAlloc, CreateProcessW, WaitForSingleObject, EnterCriticalSection, LeaveCriticalSection, HeapFree, MultiByteToWideChar, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, GetLastError, SetLastError, UnregisterWait, DeleteCriticalSection, GetCurrentThread, RegisterWaitForSingleObject EnumWindows, IsWindowVisible, GetClassNameW, GetWindowThreadProcessId, SetWindowPos, ShowWindow, SetForegroundWindow, CharLowerW, CharUpperW ShellExecuteExW timebeginperiod Version Infos Description Data LegalCopyright freeware InternalName calc1.exe Copyright Joe Security LLC 2018 Page 11 of 12

12 Description Data FileVersion CompanyName fb-soft ProductName Start Windows Calculator x4 ProductVersion FileDescription Start von calc.exe x4 OriginalFilename calc1.exe Translation 0x0000 0x04b0 Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 2018 Page 12 of 12