ID: Sample Name: 5GeZNwROcB.bin Cookbook: default.jbs Time: 15:22:54 Date: 30/11/2017 Version:

Transcription

1 ID: 82 Sample Name: GeZNwROcB.bin Cookbook: default.jbs Time: 1:22:4 Date: 0/11/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Yara Overview PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs ASN Created / dropped Files Contacted /Contacted IPs Contacted Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 2 of

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 82 Start time: 1:22:4 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 0s false light GeZNwROcB.bin default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: Cookbook Comments: Warnings: Errors: MAL HCA enabled EGA enabled HDC enabled mal48.winbin@0/0@0/0 Unable to launch sample, stop analysis Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Unable to start the sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page of

4 Strategy Score Range Further Analysis Required? Threshold 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample could not be started, try setting a correct file extension or analyse on different analysis machine Signature Overview Copyright Joe Security LLC 201 Page 4 of

5 AV Detection System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section AV Detection: Antivirus detection for submitted file System Summary: Classification label Sample is known by Antivirus (Virustotal or Metascan) Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Source Detection Cloud Link GeZNwROcB.bin 1% virustotal Browse No Antivirus matches Copyright Joe Security LLC 201 Page of

6 No Antivirus matches Yara Overview PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs ASN Created / dropped Files No created / dropped files found Contacted /Contacted IPs Contacted No contacted domains info Contacted IPs Copyright Joe Security LLC 201 Page of

7 No contacted IP infos Static File Info General File type: TrID: File name: File size: 4000 MD: SHA1: SHA2: SHA12: File Content Preview: data GeZNwROcB.bin 28aa14e1482cfe b 191c4c29ee4feef22b81fcdffbce e28a4e2a94ecbd009e4b4ccfdc2d c9 e9b49bda8d1ed04 d2bc8b8ae192f8921a18be208fea01ae49a2b2a bf149f1f19f210edbd00a142a9be42dd1a0 eaceb8e2ed01d0bffe04bc0abd WGGal1Con18Yx$F1%B*T0Yitns^WWWKVSW;^N RY']v++~WFDi4+ssK0WKVt.Vw8fO']%R*S&qDptnV^G0 KWV8.mWhnl,O']fR,SyFZTi4+^sWWGKxszl Y{,*F!~l+ TTpt.VsWWGKP+m^tbxL*WY',.2~.cYI4+s^WWW0m Kh+RcO']*.fB &FDi4+V^GWWK0xGh+fD',%2SFy File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page of