ID: Sample Name: QhSXTPahQj Cookbook: default.jbs Time: 07:55:34 Date: 20/06/2018 Version:

Transcription

1 ID: 434 Sample Name: QhSXTPahQj Cookbook: default.jbs Time: 0:55:34 Date: 20/0/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Possible Origin Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 2018 Page 2 of 12

3 Copyright Joe Security LLC 2018 Page 3 of 12

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 434 Start time: 0:55:34 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m s false light QhSXTPahQj (renamed file extension from none to dll) default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Warnings: Errors: HCA enabled EGA enabled HDC enabled Timeout UNKNOWN unknown0.windll@0/0@0/0 Adjust boot time Correcting counters for adjusted boot time Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 4 of 12

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 2018 Page 5 of 12

6 Networking System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Classification label PE file has an executable.text section and no other executable section PE file has a high image base, often used for DLLs PE file contains a mix of data directories often seen in goodware Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory PE file contains a valid data directory to section mapping Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files Copyright Joe Security LLC 2018 Page of 12

7 No Antivirus matches Domains No Antivirus matches URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page of 12

8 Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE32+ executable (DLL) (GUI) x8-4, for MS Windows Entropy (8bit): Copyright Joe Security LLC 2018 Page 8 of 12

9 General TrID: Win4 Dynamic Link Library (generic) (102004/3) 9.21% Generic Win/DOS Executable (2004/3) 1.89% DOS Executable Generic (2002/1) 1.89% Autodesk FLIC Image File (extensions: flc, fli, cel) (/3) 0.01% File name: File size: 152 MD5: SHA1: SHA25: SHA512: File Content Preview: QhSXTPahQj.dll ad1424e1c33aca95eb5b92b923c511 edbaf035c4f43c155e319e004d18ffe85c8 58a9c2c31cdf045f2ccccba30bd2dfee2a9c43c0 421c53593e493fbc a29c88e49cc1a3bbd33f1c9ca ca835 ecb14c0d1a4b4e94859cdd0b2d58284b4b949c f01a2af8ed2bfca0ff0a4dbdfd91bd is program cannot be run in DOS mode...$...u..l...l...l...~.j....:...}.a...h.m...wj..d...wj..q...wj..]...d.o...l...j..i...jp.m...l...m...j..m...richl.. File Icon Static PE Info General Entrypoint: 0x Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE DLL Characteristics: DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA Time Stamp: 0x5B14993 [Mon Jun 4 01:32: UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: OS Version Minor: 0 File Version Major: File Version Minor: 0 Subsystem Version Major: Subsystem Version Minor: 0 Import Hash: 2013af ab98cb2d8b0b1a2e Entrypoint Preview Instruction mov dword ptr [esp+08h], ebx mov dword ptr [esp+10h], esi push edi sub esp, 20h dec ecx mov edi, eax mov ebx, edx mov esi, ecx cmp edx, 01h jne 0000F9B0E85DAh call 0000F9B0E8338h dec esp mov eax, edi mov edx, ebx Copyright Joe Security LLC 2018 Page 9 of 12

10 Instruction mov ecx, esi mov ebx, dword ptr [esp+30h] mov esi, dword ptr [esp+38h] add esp, 20h pop edi jmp 0000F9B0E85C1Ch jmp 0000F9B0E8B8Ch inc eax push ebx sub esp, 20h mov ebx, ecx mov eax, edx lea ecx, dword ptr [00010D41h] mov dword ptr [ebx], ecx lea edx, dword ptr [ebx+08h] xor ecx, ecx mov dword ptr [edx], ecx mov dword ptr [edx+08h], ecx lea ecx, dword ptr [eax+08h] call 0000F9B0E880CDh lea eax, dword ptr [00010D51h] mov dword ptr [ebx], eax mov eax, ebx add esp, 20h pop ebx ret xor eax, eax mov dword ptr [ecx+10h], eax lea eax, dword ptr [00010D4h] mov dword ptr [ecx+08h], eax lea eax, dword ptr [00010D2Ch] mov dword ptr [ecx], eax mov eax, ecx ret Copyright Joe Security LLC 2018 Page 10 of 12

11 Instruction inc eax push ebx sub esp, 20h mov ebx, ecx mov eax, edx lea ecx, dword ptr [00010CE1h] mov dword ptr [ebx], ecx Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x x28.rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2c000 0x1e0.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x x114.pdata IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x2d000 0x40.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x x38.rdata IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x x94.rdata IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x x28.rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x x18000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0x xab14 0xac00 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_READ.data 0x x4198 0x1000 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.pdata 0x x114 0x1800 False PEX Binary Archive IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_READ.gfids 0x2b000 0xc0 0x200 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_READ.rsrc 0x2c000 0x1e0 0x200 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_READ.reloc 0x2d000 0x40 0x800 False data IMAGE_SCN_CNT_INITIALIZED_ DATA, IMAGE_SCN_MEM_DISCARDAB LE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_MANIFEST 0x2c00 0x1d XML 1.0 document text English United States Imports DLL Import Copyright Joe Security LLC 2018 Page 11 of 12

12 DLL KERNEL32.dll Import lstrlena, lstrcata, Sleep, LoadLibraryA, lstrcpya, GetProcAddress, FileTimeToLocalFileTime, GetTickCount, CloseHandle, CreateThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlPcToFileHeader, EncodePointer, RaiseException, RtlUnwindEx, InterlockedFlushSList, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, HeapFree, HeapAlloc, GetACP, GetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, HeapSize, HeapReAlloc, WriteFile, GetConsoleCP, GetConsoleMode, SetFilePointerEx, FlushFileBuffers, WriteConsoleW, CreateFileW Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 2018 Page 12 of 12