ID: Sample Name: process.0xfffffa8004b x dmp Cookbook: default.jbs Time: 22:45:59 Date: 02/12/2017 Version: 20.0.

Transcription

1 ID: Sample Name: process.0xfffffa8004b120.0x dmp Cookbook: default.jbs Time: 22:4:9 Date: 02/12/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Networking: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Domains Yara Overview Initial Sample PCAP (Network Traffic) Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Screenshot Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 2 of 11

3 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 22:4:9 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 2s false light process.0xfffffa8004b120.0x dmp (renamed file extension from dmp to dll) default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 4, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: Cookbook Comments: Warnings: Errors: MAL HCA enabled EGA enabled HDC enabled mal2.evad.windll@0/0@0/0 Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 3 of 11

4 Strategy Score Range Further Analysis Required? Threshold 0- false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample is a resource Dll without any import or exported function, cannot be analyzed Signature Overview Copyright Joe Security LLC 201 Page 4 of 11

5 AV Detection Networking System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section AV Detection: Antivirus detection for submitted file Networking: Urls found in memory or binary data Found Tor onion address System Summary: PE file has a high image base, often used for DLLs Classification label PE file has an executable.text section and no other executable section Sample is known by Antivirus (Virustotal or Metascan) PE file does not import any functions Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Copyright Joe Security LLC 201 Page of 11

6 Source Detection Cloud Link process.0xfffffa8004b120.0x48000.dll 28% virustotal Browse No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context No context Screenshot Copyright Joe Security LLC 201 Page of 11

7 Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE32+ executable (DLL) (GUI) x8-4, for MS Windows Copyright Joe Security LLC 201 Page of 11

8 General TrID: Win4 Dynamic Link Library (generic) (102004/3) 94.8% Generic Win/DOS Executable (2004/3) 1.8% DOS Executable Generic (2002/1) 1.8% Java Script embedded in Visual Basic Script (100/0) 1.40% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.01% File name: File size: 1204 MD: SHA1: SHA2: SHA12: File Content Preview: process.0xfffffa8004b120.0x48000.dll 33f9cd99c2080a e eb4dccf8420a b2f03d139c0c31d4dae9 1fcfb4ba1d3c30ab290e0b11dd332cdeafc4fe3cf 2b4b1b3cd029fb dee14dd1e9e440db8c3d0ca9c9390de13bfe a41b911fc3e181b9180c bc3042c13 e3bc3f09001a18acb1bf21 is program cannot be run in DOS mode...$...1d.u..d u..du..d }Edx..d }Sdt..dR..dt..dR.Fdt..dkWBdv..dR..dr..du..d...d }Od?..d }Tdt..d }Wdt..dRichu..d...PE..d...Y... File Icon Static PE Info General Entrypoint: 0x Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE DLL Characteristics: Time Stamp: 0x98B00C [Wed Aug 9 12:0: UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: OS Version Minor: 2 File Version Major: File Version Minor: 2 Subsystem Version Major: Subsystem Version Minor: 2 Import Hash: Entrypoint Preview Instruction Copyright Joe Security LLC 201 Page 8 of 11

9 Instruction Copyright Joe Security LLC 201 Page 9 of 11

10 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x3b0 0x33.rdata IMAGE_DIRECTORY_ENTRY_IMPORT 0x3aa0 0x0.rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x0 0x0 IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3b000 0x14.pdata IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x3f000 0x34.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x x38.rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x34e28 0x1e0.rdata IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x2fc2 0x2fe00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0x xb93 0xc00 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ.data 0x x20c8 0x1a00 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.pdata 0x3b000 0x14 0x1800 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ.bss 0x3d000 0x19de 0x1a00 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.reloc 0x3f000 0x1000 0xc00 False data IMAGE_SCN_CNT_INITIALIZED_DA TA, IMAGE_SCN_MEM_READ Network Behavior No network behavior found Code Manipulations Copyright Joe Security LLC 201 Page 10 of 11

11 Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 11 of 11