ID: Sample Name: owaauth.dll Cookbook: default.jbs Time: 06:38:57 Date: 27/04/2018 Version:

Transcription

1 ID: 593 Sample Name: owaauth.dll Cookbook: default.jbs Time: 0:3:5 Date: 2/04/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking: System Summary: Anti Debugging: Malware Analysis System Evasion: Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Authenticode Signature Entrypoint Preview Data Directories Sections Resources Imports Exports Version Infos Possible Origin Network Behavior Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 2 of 12

3 Copyright Joe Security LLC 201 Page 3 of 12

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 593 Start time: 0:3:5 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m 10s false light owaauth.dll default.jbs Analysis system description: Windows SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 1, Flash 2, Java ) Number of analysed new started processes analysed: 1 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Warnings: Errors: HCA enabled EGA enabled HDC enabled Timeout UNKNOWN unknown0.windll@0/0@0/0 Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.dll Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Nothing to analyse, Joe Sandbox has not found any analysis process or sample Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 12

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 12

6 Networking System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section Networking: Urls found in memory or binary data System Summary: Classification label PE file has an executable.text section and no other executable section Sample is known by Antivirus (Virustotal or Metascan) PE file has a high image base, often used for DLLs PE file contains a mix of data directories often seen in goodware Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols PE file contains a valid data directory to section mapping Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Scanner Label Link owaauth.dll 0% virustotal Browse Dropped Files Copyright Joe Security LLC 201 Page of 12

7 No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Created / dropped Files No created / dropped files found Copyright Joe Security LLC 201 Page of 12

8 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (bit): PE32+ executable (DLL) (GUI) x-4, for MS Windows TrID: Win4 Dynamic Link Library (generic) (102004/3).54% Java Script embedded in Visual Basic Script (000/0) 5.15% Java Script (4500/0) 3.% Generic Win/DOS Executable (2004/3) 1.2% DOS Executable Generic (2002/1) 1.2% File name: File size: 949 MD5: SHA1: SHA25: SHA512: File Content Preview: owaauth.dll f9f a9f1aed1f2aeff324e efeeb0fd53995f20153bdfd002aab0c4d9051 b5a40c40e14eaaa9ab0cba3c22d b13 01a403a011b4dc fe4e4e5ccb3dfb022a5bfb94ba242c3b439cf43ad9 d0c5a19ef519adcdad0d912cb1b04fdd5499b2c 1d29d4a5de3f195cffa1c9415a is program cannot be run in DOS mode...$......h2...h2...h2...h p.f rich... File Icon Static PE Info General Entrypoint: 0x1000a014 Entrypoint Section:.text Digitally signed: true Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE DLL Characteristics: DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA Time Stamp: 0x59429B02 [Thu Jun 15 14:34: UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: OS Version Minor: 0 File Version Major: File Version Minor: 0 Subsystem Version Major: Subsystem Version Minor: 0 Import Hash: 3dfd5593abcfeb43bb21d51f9 Authenticode Signature Signature Valid: true Copyright Joe Security LLC 201 Page of 12

9 Signature Issuer: Signature Validation Error: Error Number: 0 Not Before, Not After Subject Chain Version: 3 Thumbprint: Serial: CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US The operation completed successfully /1/201 10:1:1 PM 11/2/201 9:1:1 PM CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US 9ED99AD020C54923BDF25E9AC019DF A9EE05FECC Entrypoint Preview Instruction mov dword ptr [esp+0h], ebx mov dword ptr [esp+10h], esi push edi sub esp, 20h dec ecx mov edi, eax mov ebx, edx mov esi, ecx cmp edx, 01h jne 0000F9DACF3B4Eh call 0000F9DACF3BC0h dec esp mov eax, edi mov edx, ebx mov ecx, esi mov ebx, dword ptr [esp+30h] mov esi, dword ptr [esp+3h] add esp, 20h pop edi jmp 0000F9DACF3B4Eh int3 int3 int3 mov eax, esp mov dword ptr [eax+0h], ebx mov dword ptr [eax+10h], esi mov dword ptr [eax+1h], edi inc ecx push esi sub esp, 30h dec ecx mov esi, eax mov edi, edx dec esp mov esi, ecx mov ebx, h mov dword ptr [eax-1h], ebx mov dword ptr [0000FF1h], edx Copyright Joe Security LLC 201 Page 9 of 12

10 Instruction test edx, edx jne 0000F9DACF3B4F4h cmp dword ptr [00000BBh], edx jne 0000F9DACF3B4ECh xor ebx, ebx mov dword ptr [eax-1h], ebx jmp 0000F9DACF3B5B0h lea eax, dword ptr [edx-01h] cmp eax, 01h jnbe 0000F9DACF3B519h mov eax, dword ptr [00005A9Ch] test eax, eax je 0000F9DACF3B4EAh call eax mov ebx, eax mov dword ptr [esp+20h], eax test ebx, ebx je 0000F9DACF3B5Dh dec esp mov eax, esi mov edx, edi dec ecx mov ecx, esi call 0000F9DACF3B1Eh mov ebx, eax mov dword ptr [esp+20h], eax test eax, eax je 0000F9DACF3B52h Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x xd9.rdata IMAGE_DIRECTORY_ENTRY_IMPORT 0x10f0 0xc.rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x x4e.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x x4.pdata IMAGE_DIRECTORY_ENTRY_SECURITY 0x x3ec0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xa4.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0xb30 0x3.rdata IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xfb0 0x0.rdata IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0xb000 0x32.rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x9efc 0xa000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0xb000 0xa9 0xc00 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ.data 0x x00 0x200 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.pdata 0x x4 0x00 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ.rsrc 0x x4e 0x00 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 10 of 12

11 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.reloc 0x x213e 0x2200 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_VERSION 0x1400 0x44 data English United States Imports DLL RPCRT4.dll ExTrace.dll MSVCR110.dll KERNEL32.dll ADVAPI32.dll ole32.dll Import RpcIfInqId, RpcStringBindingComposeA, RpcBindingFromStringBindingA, RpcBindingFree, UuidCreate, UuidFromStringA, UuidToStringA, RpcStringFreeA, NdrClientCall2 g_dwenabledtracetypes, SubmitNativeTrace, TermNativeTracing, InitNativeTracing _calloc_crt, dllonexit, _onexit, crt_debugger_hook, crtunhandledexception, _unlock, crtcapturecurrentcontext, crtcapturepreviouscontext, clean_type_info_names_internal, _lock, _initterm_e, _malloc_crt, _amsg_exit, CppXcptFilter, memcpy, C_specific_handler, iscntrl, isxdigit, memset, _snprintf_s, realloc, malloc, free, strtoul, atoi, _wcslwr, _wcsnicmp, wcschr, strstr, _strnicmp, strncmp, _stricmp, strchr, strcat_s, strcpy_s, memcpy_s, CxxFrameHandler3, _initterm, crtterminateprocess QueryPerformanceCounter, GetTickCount4, GetSystemTimeAsFileTime, IsProcessorFeaturePresent, EncodePointer, GetCurrentThreadId, CreateEventW, ResetEvent, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, LoadLibraryExW, GetProcAddress, FreeLibrary, GetCurrentProcessId, WideCharToMultiByte, QueueUserWorkItem, SleepEx, GetSystemDefaultLCID, lstrcmpa, WaitForSingleObject, GetEnvironmentVariableA, MultiByteToWideChar, WaitForMultipleObjects, DisableThreadLibraryCalls, CreateThread, OpenEventA, CreateEventA, SetEvent, DeleteCriticalSection, SetLastError, DecodePointer, GetLastError, CloseHandle, IsDebuggerPresent RegQueryValueExW, RegOpenKeyExW, RegQueryValueExA, RegOpenKeyExA, RegCloseKey CoCreateInstance, CoInitializeEx, CoUninitialize Exports Name Ordinal Address GetExtensionVersion 1 0x GetFilterVersion 2 0x10004e0 HttpExtensionProc 3 0x HttpFilterProc 4 0x10005b0 TerminateExtension 5 0x TerminateFilter 0x1000e0 Version Infos Description Data LegalCopyright 2014 Microsoft Corporation. All rights reserved. InternalName OWAAUTH FileVersion CompanyName Microsoft Corporation LegalTrademarks Microsoft is a registered trademark of Microsoft Corporation. Comments Service Pack 0 ProductName Microsoft Exchange ProductVersion FileDescription Microsoft Exchange OWA Form-Based Auth implementation for Windows NT OriginalFilename OWAAUTH.DLL Translation 0x0409 0x04b0 Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Copyright Joe Security LLC 201 Page 11 of 12

12 Code Manipulations Statistics System Behavior Disassembly Copyright Joe Security LLC 201 Page 12 of 12