ID: Sample Name: 2017_w2.exe Cookbook: default.jbs Time: 17:03:04 Date: 09/02/2018 Version:

Size: px

Start display at page:

Download "ID: Sample Name: 2017_w2.exe Cookbook: default.jbs Time: 17:03:04 Date: 09/02/2018 Version:"

Louise Stella Webster
6 years ago
Views:

1 ID: 4572 Sample Name: 2017_w2.exe Cookbook: default.jbs Time: 17:03:04 Date: 0/02/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Networking: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Code Manipulations Copyright Joe Security LLC 201 Page 2 of

3 Statistics Behavior System Behavior Analysis Process: 2017_w2.exe PID: 3212 Parent PID: 24 General Registry Activities Key Created Key Value Modified Analysis Process: explorer.exe PID: 326 Parent PID: 3212 General Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of

Analysis Report Overview General Information Joe Sandbox Version: 20.0.0 Analysis ID: 4572 Start time: 17:03:04 Joe Sandbox Product: CloudBasic Start date: 0.02.

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: 4572 Start time: 17:03:04 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 2m 30s false light 2017_w2.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal56.evad.winexe@3/0@0/0 HCA Information: Successful, ratio: 51% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Cookbook Comments: Warnings: Failed Adjust boot time Found application associated with file extension:.exe Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of

malicious malicious malicious Evader Phishing

clean Exploiter Banker Spyware Trojan / Bot

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Signature Overview Copyright Joe Security LLC 201 Page 5 of

6 Software Vulnerabilities Networking Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Click to jump to signature section Software Vulnerabilities: Found inlined nop instructions (likely shell or obfuscated code) Networking: Urls found in memory or binary data Data Obfuscation: Entry point lies outside standard sections PE file contains an invalid checksum Uses code obfuscation techniques (call, push, ret) System Summary: Executable creates window controls seldom found in malware Found graphical window changes (likely an installer) Classification label Launches a second explorer.exe instance Parts of this applications are using Borland Delphi (Probably coded in Delphi) Reads software policies Spawns processes PE file has section (not.text) which is very likely to contain packed code (zlib compression ratio < 0.011) PE file contains an invalid data directory PE file has a writable.reloc section Detected potential crypto function Found potential string decryption / allocating functions PE file contains strange resources Sample file is different than original file name gathered from version info Sample reads its own file content PE file contains more sections than normal PE file has a writeable.text section HIPS / PFW / Operating System Protection Evasion: Injects code into the Windows Explorer (explorer.exe) Anti Debugging: Copyright Joe Security LLC 201 Page 6 of

Checks for debuggers (devices) Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Tries to detect sandboxes and other

7 Checks for debuggers (devices) Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Tries to detect sandboxes and other dynamic analysis tools (process name) Behavior Graph Behavior Graph ID: 4572 Sample: 2017_w2.exe Startdate: 0/02/201 Architecture: WINDOWS Score: 56 Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files PE file contains more sections than normal PE file has a writeable.text section Tries to detect sandboxes and other dynamic analysis tools (process name) Visual Basic started Delphi Java.Net C# or VB.NET 2017_w2.exe C, C++ or other language Is malicious Injects code into the Windows Explorer (explorer.exe) started explorer.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Copyright Joe Security LLC 201 Page 7 of

No Antivirus matches Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches

8 No Antivirus matches Dropped Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Startup System is w7 2017_w2.exe (PID: 3212 cmdline: 'C:\Users\user\Desktop\2017_w2.exe' MD5: 3AF43F5CF2FBF733F23C726CEBA34) explorer.exe (PID: 326 cmdline: unknown MD5: 6DDCA324434FFA506CF7DC4E51DB735) cleanup Copyright Joe Security LLC 201 Page of

9 Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (bit): PE32 executable (GUI) Intel 036, for MS Windows TrID: Win32 Executable (generic) a ( /4).4% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: 2017_w2.exe File size: 1640 MD5: SHA1: SHA256: SHA512: File Content Preview: 3af43f5cf2fbf733f23c726ceba34 c537bbf62af4342fa766c2d2a56f21e4f 76bf2cef defe23ae2b17424e12d7bc0f 1f4d2e15474c6c d a1a204c25b6c2a35c5556aaac42ebe46 d06e a71dffddcde61c40b6de71f436 cda1d1f05efe3a4c2ed07124abdc5b4 MZP...@...!..L.!.. This program must be run under Win32..$ File Icon Static PE Info General Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 0x54001.data false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI 0x2A425E1 [Fri Jun 1 22:22:17 12 UTC] Copyright Joe Security LLC 201 Page of

10 General OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f f5c72baa0c531 Entrypoint Preview Instruction pushad call 00007F7B601CD66h nop pop ebp sub ebp, 0045AFBFh mov ebx, 0045AFBh add ebx, ebp sub ebx, dword ptr [ebp+0045c31h] cmp dword ptr [ebp+0045c2ch], h mov dword ptr [ebp+0045bff5h], ebx jne 00007F7B601DE34h lea eax, dword ptr [ebp+0045c24h] push eax call dword ptr [ebp+0045c3d0h] mov dword ptr [ebp+0045c20h], eax mov edi, eax lea ebx, dword ptr [ebp+0045c2a1h] push ebx push eax call dword ptr [ebp+0045c3cch] mov dword ptr [ebp+0045c3h], eax lea ebx, dword ptr [ebp+0045c2ach] push ebx push edi call dword ptr [ebp+0045c3cch] mov dword ptr [ebp+0045c3dh], eax mov eax, dword ptr [ebp+0045bff5h] mov dword ptr [ebp+0045c2ch], eax jmp 00007F7B601CDADh push h push h push CEh push h call dword ptr [ebp+0045c3h] mov dword ptr [ebp+0045c35h], eax lea ebx, dword ptr [ebp+0045b07dh] push eax push ebx call 00007F7B601DE57h mov ecx, eax lea edi, dword ptr [ebp+0045b07dh] mov esi, dword ptr [ebp+0045c35h] rep movsb mov eax, dword ptr [ebp+0045c35h] push h push h push eax Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x x324.data IMAGE_DIRECTORY_ENTRY_RESOURCE 0xaa000 0xdc00.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 Copyright Joe Security LLC 201 Page 10 of

11 Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x152cc 0x.data IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x153fc 0x1.data IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x3000 0x3ba00 False data IMAGE_SCN_CNT_INITIALIZED.itext 0x4000 0x1000 0x600 False data IMAGE_SCN_CNT_INITIALIZED.data 0x5000 0x3000 0x1000 False data IMAGE_SCN_CNT_INITIALIZED.bss 0x000 0x4000 0x0 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED.idata 0xc000 0x3000 0x400 False data IMAGE_SCN_CNT_INITIALIZED.tls 0xf000 0x1000 0x0 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED.rdata 0xa0000 0x1000 0x200 False dbase IV DBT of \210WI.DBF, blocks size , next free block index IMAGE_SCN_CNT_INITIALIZED.reloc 0xa1000 0x000 0x0 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED.rsrc 0xaa000 0xda000 0x33400 False data IMAGE_SCN_CNT_INITIALIZED.data 0x000 0x6f000 0x6ee00 False data IMAGE_SCN_CNT_INITIALIZED.data 0x1f3000 0x1000 0x0 False 0 empty 0.0 IMAGE_SCN_CNT_INITIALIZED Resources Name RVA Size Type Language Country RT_CURSOR 0xaa0 0x134 data English United States RT_CURSOR 0xaaab4 0x134 data English United States RT_CURSOR 0xaabe 0x134 data English United States RT_CURSOR 0xaad1c 0x134 data English United States RT_CURSOR 0xaae50 0x134 data English United States RT_CURSOR 0xaaf4 0x134 data English United States RT_CURSOR 0xab0b 0x134 data English United States RT_ICON 0x1e064 0x2e data Russian Russia RT_ICON 0x1e65c 0x4202 data RT_ICON 0x1de34 0x102 data Copyright Joe Security LLC 201 Page 11 of

12 Name RVA Size Type Language Country RT_ICON 0x1c0c 0x422 FoxPro FPT, blocks size 0, next free block index RT_ICON 0x x25a FoxPro FPT, blocks size 0, next free block index RT_ICON 0x165bc 0x10a data RT_ICON 0x x46 GLS_BINARY_LSB_FIRST RT_DIALOG 0x105a04 0x52 empty RT_DIALOG 0x105a5 0x52 empty RT_STRING 0x105aac 0x empty RT_STRING 0x105c30 0x3ac empty RT_STRING 0x105fdc 0xc empty RT_STRING 0x xec empty RT_STRING 0x x1a4 empty RT_STRING 0x x3f4 empty RT_STRING 0x1066fc 0x37 empty RT_STRING 0x106a74 0x3 empty RT_STRING 0x106dfc 0x41 empty RT_STRING 0x1072 0x0 empty RT_STRING 0x xcc empty RT_STRING 0x x1ec empty RT_STRING 0x10760c 0x3b0 empty RT_STRING 0x107bc 0x354 empty RT_STRING 0x107d10 0x2a4 empty RT_RCDATA 0x107fb4 0x5e550 empty RT_RCDATA 0x x103cd empty RT_RCDATA 0x176d4 0xcd1 empty RT_GROUP_CURSOR 0x131a 0x empty English United States RT_GROUP_CURSOR 0x131bc 0x empty English United States RT_GROUP_CURSOR 0x131d0 0x empty English United States RT_GROUP_CURSOR 0x131e4 0x empty English United States RT_GROUP_CURSOR 0x131f 0x empty English United States RT_GROUP_CURSOR 0x1320c 0x empty English United States RT_GROUP_CURSOR 0x x empty English United States RT_GROUP_ICON 0x160f 0x5a MS Windows icon resource - 6 icons, 256-colors RT_GROUP_ICON 0x160e4 0x MS Windows icon resource - 1 icon Russian Russia RT_VERSION 0x157 0x5c data Imports DLL kernel32.dll oleaut32.dll advapi32.dll user32.dll user32.dll msimg32.dll gdi32.dll version.dll advapi32.dll oleaut32.dll comctl32.dll shell32.dll winspool.drv comdlg32.dll Import GetProcAddress, GetModuleHandleA, LoadLibraryA SysFreeString RegQueryValueExA GetKeyboardType CreateWindowExA GradientFill UnrealizeObject VerQueryValueA RegQueryValueExA SafeArrayPtrOfIndex _TrackMouseEvent SHGetSpecialFolderLocation OpenPrinterA PrintDlgA Version Infos Description LegalCopyright InternalName Data Bernat FileVersion CompanyName LegalTrademarks Comments ProductName Adobe Photoshop CS3 Portable PortableAppZ.blogspot.com PrtableAppZ is a trademark of Bernat Allows Adobe Photoshop CS3 to be run from a removable drive. More PrtableAppZ on Adobe Photoshop CS3 Portable Copyright Joe Security LLC 201 Page 12 of

Description Data ProductVersion 1.3.0.1 FileDescription Adobe Photoshop CS3 Portable OriginalFilename PhotoshopPortable.

States Russian Russia Network Behavior No network behavior found Code Manipulations Statistics Behavior 2017_w2.exe explorer.

13 Description Data ProductVersion FileDescription Adobe Photoshop CS3 Portable OriginalFilename PhotoshopPortable.exe Translation 0x0000 0x04e4 Possible Origin Language of compilation system Country where language is spoken Map English United States Russian Russia Network Behavior No network behavior found Code Manipulations Statistics Behavior 2017_w2.exe explorer.exe Click to jump to process System Behavior Analysis Process: 2017_w2.exe PID: 3212 Parent PID: 24 Copyright Joe Security LLC 201 Page 13 of

14 General Start time: 17:03:46 Start date: 0/02/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\2017_w2.exe false 'C:\Users\user\Desktop\2017_w2.exe' 0x bytes 3AF43F5CF2FBF733F23C726CEBA34 Borland Delphi low Registry Activities Key Created Key Path Completion Count Source Address Symbol HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key success or wait 1 261A66 RegCreateKeyExA Key Value Modified Key Path Name Type Old Data New Data Completion Count HKEY_LOCAL_MACHINE\SOFT WARE\Classes\.key Source Address Symbol NULL unicode regfile success or wait 1 261C2A RegSetValueExA Analysis Process: explorer.exe PID: 326 Parent PID: 3212 General Start time: 17:04:13 Start date: 0/02/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\explorer.exe false unknown 0xc bytes 6DDCA324434FFA506CF7DC4E51DB735 C, C++ or other language high Disassembly Code Analysis Copyright Joe Security LLC 201 Page of

ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version:

ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version: ID: 54295 Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:1:42 Date: 12/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence