ID: Sample Name: vlaue.exe Cookbook: default.jbs Time: 18:54:49 Date: 26/01/2018 Version:

Transcription

1 ID: Sample Name: vlaue.exe Cookbook: default.jbs Time: 18:4:49 Date: 2/01/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Yara Overview PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs ASN Created / dropped Files Contacted /Contacted IPs Contacted Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 2018 Page 2 of

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 18:4:49 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 0m 1s false light vlaue.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Run name: Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: Cookbook Comments: Warnings: Errors: without instrumentation HCA enabled EGA enabled HDC enabled UNKNOWN unknown0.winexe@0/0@0/0 Found application associated with file extension:.exe Unable to launch sample, stop analysis Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Unable to start the sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page of

4 Strategy Score Range Further Analysis Required? Threshold 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 2018 Page 4 of

5 System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section System Summary: Classification label Sample is known by Antivirus (Virustotal or Metascan) Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Source Detection Cloud Link vlaue.exe 0% virustotal Browse vlaue.exe 0% metadefender Browse No Antivirus matches No Antivirus matches Copyright Joe Security LLC 2018 Page of

6 Yara Overview PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs ASN Created / dropped Files No created / dropped files found Contacted /Contacted IPs Contacted No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 2018 Page of

7 Static File Info General File type: Entropy (8bit): 0.0 TrID: File name: File size: 0 MD: SHA1: SHA2: SHA12: File Content Preview: empty vlaue.exe d41d8cd98f00b204e ecf842e da9aeeeb4b0d2bfef901890afd8009 eb0c44298fc1c149afbf4c899fb9242ae41e449b94 ca49991b82b8 cf8e1eefb8bdf14280dd800d20e400b1d c8f4a921dce9ce4d0d1cd8f2b0ff818d28eec 2fb91bd441a81a82af92dae File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 2018 Page of