ID: Sample Name: SKYDIGITAL- NEW PO.exe Cookbook: default.jbs Time: 15:55:01 Date: 15/01/2018 Version:

Transcription

1 ID: Sample Name: SKYDIGITAL- NEW PO.exe Cookbook: default.jbs Time: 15:55:01 Date: 15/01/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Code Manipulations Copyright Joe Security LLC 201 Page 2 of

3 Statistics System Behavior Analysis Process: SKYDIGITAL-NEW PO.exe PID: 310 Parent PID: 20 General File Activities Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:55:01 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 9m 44s false light SKYDIGITAL-NEW PO.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 17, Flash 2, Java ) Number of analysed new started processes analysed: Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal4.winexe@1/0@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): svchost.exe, WmiApSrv.exe, WerFault.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: SKYDIGITAL-NEW PO.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of

6 AV Detection Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for submitted file Data Obfuscation: PE file contains an invalid checksum System Summary: Found graphical window changes (likely an installer) Classification label Creates temporary files PE file has an executable.text section and no other executable section Parts of this applications are using VB runtime library.0 (Probably coded in Visual Basic) Reads software policies Sample is known by Antivirus (Virustotal or Metascan) PE file contains strange resources Sample file is different than original file name gathered from version info HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Checks if the current process is being debugged Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 201 Page of

7 Hide Legend Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped ID: Is Windows Process Sample: SKYDIGITAL-NEW PO.exe Number of created Registry Values Number of created Files Startdate: 15/01/201 Architecture: WINDOWS Score: 4 Visual Basic Delphi Java.Net C# or VB.NET Antivirus detection for submitted file started C, C++ or other language Is malicious SKYDIGITAL-NEW PO.exe 1 Simulations Behavior and APIs Time Type Description 15:55:50 API Interceptor 1x Sleep call for process: SKYDIGITAL-NEW PO.exe modified from: 2000ms to: 100ms Antivirus Detection Initial Sample Source Detection Cloud Link SKYDIGITAL-NEW PO.exe 20% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of

9 Startup System is w7 SKYDIGITAL-NEW PO.exe (PID: 310 cmdline: 'C:\Users\user\Desktop\SKYDIGITAL-NEW PO.exe' MD5: E1DE72CC5D7DEAFF92C027F470DD) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of

10 Static File Info General File type: Entropy (bit): PE32 executable (GUI) Intel 03, for MS Windows TrID: Win32 Executable (generic) a ( /4) 99.15% Win32 Executable Microsoft Visual Basic (2127/2) 0.1% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: MD5: SHA1: SHA25: SHA512: File Content Preview: SKYDIGITAL-NEW PO.exe e1de72cc5d7deaff92c027f470dd 99acbd773c3df90bcb50f339fdd1fb4544a1a a5ec1f37d0a4d1d9e4d172a0227a47f0af7a22ed7 597dfcf5a50ab29 292c90bc5dce5b5921b702c9eca20cf73faa73dae5d9 75c54f33bad74935ab022f d7f232fdf 4c045ab5d3947ceb330be7a7f04 MZ...@...!..L.!Th is program cannot be run in DOS mode...$...#...b...b...b..l^...b...`...b...d...b..rich.b...pe..l...u\z......p...x......@... File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x407.text false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x5A5C557F [Mon Jan 15 07:17: UTC] 75c5f043be24fb05fcb49547f1e49a Entrypoint Preview Instruction push h call 00007FE74FE4E05h xor byte ptr [eax], al inc eax Copyright Joe Security LLC 201 Page 10 of

11 Instruction add byte ptr [edx], al xor dword ptr [3D229CD7h], edi inc edi xchg eax, edi rol dword ptr [eax+3cdbdd73h], 1 test byte ptr [eax], al add byte ptr [ecx], al add byte ptr [ebp+74h], dl jc 00007FE74FE4E77h insd imul ebp, dword ptr [ebp+5h], 35C172h add byte ptr [edi], al add byte ptr [ebp+ebx+40h], dh add byte ptr [edi], al add byte ptr [eax], ah sbb eax, h int3 sbb al, 40h add byte ptr [edi], al add byte ptr [esp+ebx+40h], dh add byte ptr [ecx], al add byte ptr [ecx], al add byte ptr [eax h], bh add bh, bh Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x70bc4 0x2.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x x3b7a.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x22 0x20 IMAGE_DIRECTORY_ENTRY_IAT 0x1000 0x154.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics Copyright Joe Security LLC 201 Page 11 of

12 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x700b 0x71000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.data 0x xa9 0x1000 False data 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x x3b7a 0x4000 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x x12 FoxPro FPT, blocks size 0, next free block index RT_ICON 0x74aa 0xca data RT_ICON 0x x3 GLS_BINARY_LSB_FIRST RT_ICON 0x7349a 0x10a data RT_GROUP_ICON 0x7345c 0x3e MS Windows icon resource - 4 icons, 4x4, 25- colors RT_VERSION 0x7310 0x2dc data English United States Imports DLL MSVBVM0.DLL Import _CIcos, _adj_fptan, vbavarmove, vbafreevar, vbastrvarmove, vbalenbstr, vbafreevarlist, _adj_fdiv_m4, _adj_fprem1, vbasetsystemerror, vbalenbstrb, vbahresultcheckobj, _adj_fdiv_m32, vbaarydestruct, vbaobjset, _adj_fdiv_m1i, _adj_fdivr_m1i, _CIsin, vbachkstk, EVENT_SINK_AddRef, vbastrcmp, vbaaryconstruct2, vbai2i4, DllFunctionCall, _adj_fpatan, vbaredim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, vbaexcepthandler, _adj_fprem, _adj_fdivr_m4, vbafpexception, vbadatevar, vbai2var, _CIlog, vbaerroroverflow, vbanew2, vbainstr, _adj_fdiv_m32i, _adj_fdivr_m32i, vbastrcopy, _adj_fdivr_m32, vbarvar, _adj_fdiv_r, vbai4var, vbavardup, vbafpi4, _CIatan, vbastrmove, _allmul, _CItan, _CIexp, vbafreeobj, vbafreestr Version Infos Description Data Translation 0x0409 0x04b0 LegalCopyright bastpass InternalName Alshain1 FileVersion 1.01 CompanyName IVore Gae LegalTrademarks emsisoft amva ProductName HaVasoft ProductVersion 1.01 FileDescription ZaTOnsoFt Gab. OriginalFilename Alshain1.exe Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 201 Page 12 of

13 Statistics System Behavior Analysis Process: SKYDIGITAL-NEW PO.exe PID: 310 Parent PID: 20 General Start time: 15:55:19 Start date: 15/01/201 Path: Wow4 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\SKYDIGITAL-NEW PO.exe false 'C:\Users\user\Desktop\SKYDIGITAL-NEW PO.exe' 0x755c bytes E1DE72CC5D7DEAFF92C027F470DD Visual Basic low File Activities File Path Access Attributes Options Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page of