ID: Sample Name: meterpreter64bit.exe Cookbook: default.jbs Time: 16:01:45 Date: 24/11/2017 Version:

Transcription

1 ID: 0 Sample Name: meterpreter4bit.exe Cookbook: default.jbs Time: 1:01:4 Date: 24/11/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Data Directories Sections Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 2 of

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 0 Start time: 1:01:4 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 0s false light meterpreter4bit.exe default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: Cookbook Comments: Warnings: Errors: MAL HCA enabled EGA enabled HDC enabled mal4.winexe@0/0@0/0 Found application associated with file extension:.exe Unable to launch sample, stop analysis Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Unable to start the sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page of

4 Strategy Score Range Further Analysis Required? Threshold 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample requires a 4bit OS, try executing the sample on a 4bit version of Windows Signature Overview Copyright Joe Security LLC 201 Page 4 of

5 AV Detection System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section AV Detection: Antivirus detection for submitted file System Summary: PE file has a high image base, often used for DLLs Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a valid data directory to section mapping Classification label PE file has an executable.text section and no other executable section Sample is known by Antivirus (Virustotal or Metascan) PE file does not import any functions PE file overlay found Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Cloud Link meterpreter4bit.exe % virustotal Browse Copyright Joe Security LLC 201 Page of

6 No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Copyright Joe Security LLC 201 Page of

7 Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE2+ executable (DLL) (GUI) x-4, for MS Windows TrID: Win4 Dynamic Link Library (generic) (102004/) 9.0% DOS Executable Generic (2002/1) 1.92% File name: File size: MD: SHA1: SHA2: SHA12: File Content Preview: meterpreter4bit.exe b2cb0d19bdb1ba2b90bb9ea f40ab2fe2df219c0cb142a02e4 aaaaa009c2de9e1a00fa21adf904b9b192 bc14f102dbbb 229bb2e4cab1ca4d2f20adedf1dd 4daec1ef1a9e1c01ee9d4de4dfa0ca1c9af1444c 009b0ea2b912cecbcabcd MZARUH..H.....H...H..0K...H..I..h...Z..A...Vh...Z......!..L.!This program cannot be run in DOS mode...$....l.rz..rz..rz...vz...(z...xz..4...z..[...]z..rz...z..4...rz..4...sz..4...sz..4...sz..richrz...pe..d...n..w... File Icon Static PE Info General Entrypoint: 0x1001be00 Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE DLL Characteristics: DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA Time Stamp: 0xDCA4E [Sat Sep 1 02:11:2 201 UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: OS Version Minor: 2 File Version Major: File Version Minor: 2 Subsystem Version Major: Subsystem Version Minor: 2 Import Hash: Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x4e0 0x2.rdata IMAGE_DIRECTORY_ENTRY_IMPORT 0x0fc 0xa0.rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x4d000 0x1e0.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x4b000 0x1b4.pdata IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x4e000 0x0c.reloc Copyright Joe Security LLC 201 Page of

8 Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x40 0x0.rdata IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x2.rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x20b 0x2200 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0x2000 0xf2 0xf00 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ.data 0x000 0x122c 0x200 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.pdata 0x4b000 0x1b4 0x1c00 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ.rsrc 0x4d000 0x1e0 0x200 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ.reloc 0x4e000 0xf 0x1000 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ Network Behavior No network behavior found Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page of