Infosec Binary Analisys. dew.fgh
|
|
|
- Tobias Weaver
- 5 years ago
- Views:
Transcription
1 dew.fgh MalFamily: Malicious MalScore: 100 File type: File size: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive KB ( bytes) Compile time: :40:10 MD5: SHA1: Import hash: f18c551067ba312f0dfe25519 fd8c3a1bc6ecf8abeaf1bedcb5f9db76c612b4e1 e160ef8e55bb9d162da4e266afd9eef3 Submitted: :36:14 URL(s) file hosting Antivirus Report Report date Detection Ratio Permalink No report available Import library VERSION.dll GDI32.dll ADVAPI32.dll KERNEL32.dll Page 1 Date: :05:34
2 SHELL32.dll ole32.dll USER32.dll comctl32.dll 13 Behaviors detected by system signatures Created network traffic indicative of malicious activity - signature: ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group signature: Traffico Anomalo: Traffico verso host malevolo, metodo GET HTTP Content, downloader (Soc-Rule) - signature: ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 52 - signature: ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group signature: ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group signature: ET TOR Known Tor Exit Node Traffic group 52 Collects information to fingerprint the system Harvests information related to installed mail clients - key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem\MSMapiApps Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ Messaging Subsystem\Profiles\Outlook\7d19c9e894f20d4780a31c9a9f17da11 Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \POP3 Messaging Subsystem\Profiles\Outlook Summary\POP3 Messaging Subsystem\Profiles\Outlook\192e64c97bf3a54488a039619c Messaging Subsystem\Profiles\Outlook\00471e98b7a362469ed97e3915fd4111 Messaging Subsystem\Profiles\Outlook\{D9734F19-8CFB-411D-BC59-833E334FCB5E} Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings Messaging Subsystem\Profiles\Outlook\9207f3e0a3b b08002b2a56c2 Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \IMAP Messaging Subsystem\Profiles\Outlook\32a3dc9c400a4b448b60ab7fe553a392 Page 2 Date: :05:34
3 Summary Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676 Messaging Subsystem\Profiles\Outlook\ d76624c419a828607e2a54604 Messaging Subsystem\Profiles\Outlook\818ecc2f310b344f807e8af5dc Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \POP3 Summary\IMAP Messaging Subsystem\Profiles\Outlook\43e0bb79f0f2d84db98ff4f730d23d24 Messaging Subsystem\Profiles\Outlook\7760e b47946c9c80fa097f15 Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a Messaging Subsystem\Profiles\Outlook\6a50d9bd87f9a a1591a6c2 Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e Messaging Subsystem\Profiles\Outlook\10b0e4d6eb1de34dabd532a0806a0fec Messaging Subsystem\Profiles\Outlook\0a0d c Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \SMTP Summary\SMTP Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \POP3 Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \IMAP Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \SMTP Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \IMAP Messaging Subsystem\Profiles\Outlook\9375CFF d3B88A00104B2A6676\ \SMTP Messaging Subsystem\Profiles\Outlook\ c key: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts - key: HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\ key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\(Default) - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\MSIComponentID - key: HKEY_LOCAL_MACHINE\Software\Clients\Mail - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\MSIOfficeLCID - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\PreFirstRun - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\MSIApplicationLCID - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\DLLPathEx - key: HKEY_CURRENT_USER\Software\Clients\Mail Page 3 Date: :05:34
4 - key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\MSIInstallOnWTS Creates a copy of itself - copy: C:\Windows\irywilat.exe Attempts to modify browser security settings Attempts to identify installed AV products by registry key - key: HKEY_LOCAL_MACHINE\SOFTWARE\Doctor Web Installs itself for autorun at Windows startup - key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hcojuzys - data: "C:\Windows\irywilat.exe" Behavior consistent with a dropper attempting to download the next stage. - File: /topic.php was requested from hosts: ymedihe.fusterst.net, eniwajypes.fusterst.net, utopedut.fusterst.net, eqeruceqamq.fusterst.net, amos.fusterst.net, yvdf.fusterst.net Executed a process and injected code into it, probably while unpacking - Injection: dew.fgh(2276) -> dew.fgh(2656) Performs some HTTP requests - url: Reads data out of its own binary image - self_read: process: dew.fgh, pid: 2276, offset: 0x , length: 0x self_read: process: dew.fgh, pid: 2276, offset: 0x c, length: 0x0004d797 - self_read: process: dew.fgh, pid: 2276, offset: 0x , length: 0x self_read: process: dew.fgh, pid: 2656, offset: 0x , length: 0x d Creates RWX memory Attempts to connect to a dead IP:Port (4 unique times) - IP: :9001 (Austria) - IP: :80 - IP: :9001 (United States) - IP: :9001 (Latvia) 1 HTTP Request(s) detected tl.cab Hostname: IP Address: Port: 80 Count: 6 4 Host(s) detected Page 4 Date: :05:34
5 IP Address Hostname Reverse DNS ip dataclub.biz static.edis.at pool washdc.fios.verizon.net rev.cloud.scaleway.com. 4 Countr(y ies) detected Hosts Country 1 United Kingdom 1 United States 1 Austria 1 Latvia Page 5 Date: :05:34
Infosec Binary Analisys. amd6.exe
amd6.exe MalScore: 100 File type: File size: PE32 executable (GUI) Intel 80386, for MS Windows 2507.29 KB (2567464 bytes) Compile time: 2018-05-02 17:08:30 MD5: SHA1: Import hash: c64b759c1022c22eaf2e4825eca431df
Infosec Binary Analisys. amd4.exe
amd4.exe MalScore: 100 File type: File size: PE32 executable (GUI) Intel 80386, for MS Windows 2559.79 KB (2621224 bytes) Compile time: 2018-05-02 17:08:30 MD5: SHA1: Import hash: 25705698d4403963b89432c39ee4eeed
Infosec Binary Analisys. Order_2018[10].jar
![Infosec Binary Analisys. Order_2018[10].jar](/thumbs/94/121873534.jpg "Infosec Binary Analisys. Order_2018[10].jar")
Order_2018[10].jar MalFamily: Adwind MalScore: 100 File type: File size: Java archive data (JAR) 542.88 KB (555908 bytes) Compile time: 0000-00-00 00:00:00 MD5: SHA1: 2b75faa67abae20e293334792bb48aee 9f6e3ade58140db6799fe485271d81eaeafe2425
ID: Cookbook: urldownload.jbs Time: 20:09:25 Date: 13/06/2018 Version:
ID: 3923 Cookbook: urldownload.jbs Time: 20:09:25 Date: 13/0/201 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 15:48:15 Date: 29/03/2018 Version:
ID: 52376 Cookbook: browseurl.jbs Time: 15:4:15 Date: 29/03/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: testfiletestfile.txt Cookbook: default.jbs Time: 15:24:30 Date: 06/07/2018 Version:
ID: 6045 Sample Name: testfiletestfile.txt Cookbook: default.jbs Time: 15:24:30 Date: 06/0/201 Version: 23.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection
Summary. Verdict: Malware CLASSIFICATION DETECTION SECTION HIGH LEVEL BEHAVIOR DISTRIBUTION ACTIVITY OVERVIEW
Page 1 Summary File Name: 1705011024.exe File Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows SHA1: afdb6ba117cf573fdae3bbe184a5a5cfa78fcd91 MD5: 9534643cdc33e1c6b47b9afd40ca8eb0
ID: Sample Name: MobaXterm_installer.dat Cookbook: default.jbs Time: 18:29:43 Date: 25/05/2018 Version:
ID: 1259 Sample Name: MobaXterm_installer.dat Cookbook: default.jbs Time: 1:29:43 Date: 25/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection
ID: Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/2018 Version:
ID: 42417 Cookbook: urldownload.jbs Time: 23:23:00 Date: 11/01/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Cookbook: urldownload.jbs Time: 16:41:45 Date: 23/06/2018 Version:
ID: 52 Cookbook: urldownload.jbs Time: 1:41:45 Date: 23/0/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Cookbook: browseurl.jbs Time: 11:59:06 Date: 14/05/2018 Version:
ID: 5945 Cookbook: browseurl.jbs Time: 11:59:06 Date: 14/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 13:10:41 Date: 01/04/2018 Version:
ID: 52775 Cookbook: browseurl.jbs Time: 13:10:41 Date: 01/04/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: Dxd1yOZMU1.bin Cookbook: defaultwindowsofficecookbook.jbs Time: 09:43:59 Date: 21/10/2017 Version:
ID: 34788 Sample Name: Dxd1yOZMU1.bin Cookbook: defaultwindowsofficecookbook.jbs Time: 0:43:5 Date: 21/10/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information
ID: Cookbook: browseurl.jbs Time: 17:39:02 Date: 22/03/2018 Version:
ID: 5139 Cookbook: browseurl.jbs Time: 17:39:02 Date: 22/03/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: urldownload.jbs Time: 08:25:02 Date: 29/10/2018 Version: Fire Opal
ID: Cookbook: urldownload.jbs Time: 0:25:02 Date: 29//201 Version: 24.0.0 Fire Opal Table of Contents Table of Contents Analysis Report http://15.1..14/neko.sh Overview General Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 15:46:38 Date: 29/03/2018 Version:
ID: 52374 Cookbook: browseurl.jbs Time: 15:46:3 Date: 29/03/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 13:46:19 Date: 09/05/2018 Version:
ID: 5702 Cookbook: browseurl.jbs Time: 13:46:19 Date: 09/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: PO xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03:13:36 Date: 08/01/2018 Version:
ID: 41861 Sample Name: PO65445465.xls Cookbook: defaultwindowsofficecookbook.jbs Time: 03::36 Date: 08/01/2018 Version: 20.0.0 Table of Contents Analysis Report Overview Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 12:58:02 Date: 02/04/2018 Version:
ID: 5253 Cookbook: browseurl.jbs Time: 12:5:02 Date: 02/04/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: urldownload.jbs Time: 20:47:24 Date: 09/12/2017 Version:
ID: 0 Cookbook: urldownload.jbs Time: 20:4:24 Date: 0/12/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/08/2018 Version:
ID: 153 Cookbook: urldownload.jbs Time: 20:31:22 Date: 09/0/201 Version: 23.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: image002 Cookbook: default.jbs Time: 18:19:28 Date: 18/05/2018 Version:
ID: 0309 Sample Name: image002 Cookbook: default.jbs Time: 1:19:2 Date: 1/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification
ID: Sample Name: quzpecasrh Cookbook: default.jbs Time: 16:55:54 Date: 07/10/2017 Version:
ID: 3393 Sample Name: quzpecasrh Cookbook: default.jbs Time: 1:55:54 Date: 0//201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification
ID: Cookbook: urldownload.jbs Time: 02:55:04 Date: 01/02/2018 Version:
ID: 4441 Cookbook: urldownload.jbs Time: 02:55:04 Date: 01/02/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:17:42 Date: 12/04/2018 Version:
ID: 54295 Sample Name: 11youtube3.com Cookbook: default.jbs Time: 08:1:42 Date: 12/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Cookbook: urldownload.jbs Time: 16:10:39 Date: 07/12/2017 Version:
ID: 94 Cookbook: urldownload.jbs Time: 1:10:9 Date: 0/12/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Cookbook: urldownload.jbs Time: 19:58:34 Date: 02/05/2018 Version:
ID: 57706 Cookbook: urldownload.jbs Time: 19:5:34 Date: 02/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 18:05:31 Date: 26/12/2017 Version:
ID: 41000 Cookbook: browseurl.jbs Time: 1:05:31 Date: 26/12/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: ff2c8cadaa0fd8da6138cce6fce37e001f53a5d9ceccd67945b15ae273f4d751.evaljs.js Cookbook: default.jbs Time: 16:44:00 Date:
ID: 33355 Sample Name: ff2c8cadaa0fd8da138ccefce3e001f53a5dceccd45b15ae23f4d51.evaljs.js Cookbook: default.jbs Time: 1:44:00 Date: 04//201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report
ID: Cookbook: urldownload.jbs Time: 22:46:20 Date: 19/02/2018 Version:
ID: 4706 Cookbook: urldownload.jbs Time: 22:46:20 Date: 1/02/201 Version: 21.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Sample Name: test.txt Cookbook: default.jbs Time: 13:18:36 Date: 31/03/2018 Version:
ID: 5250 Sample Name: test.txt Cookbook: default.jbs Time: 13:18:3 Date: 31/03/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: Payment_Remittance#.xps Cookbook: defaultwindowsofficecookbook.jbs Time: 01:35:46 Date: 20/09/2018 Version: 23.0.
ID: 25 Sample Name: Payment_Remittance#.xps Cookbook: defaultwindowsofficecookbook.jbs Time: 01:35:4 Date: 20/09/201 Version: 23.0.0 Table of Contents Table of Contents Analysis Report Payment_Remittance#.xps
ID: Sample Name: Serial.txt Cookbook: default.jbs Time: 02:59:20 Date: 07/05/2018 Version:
ID: 58133 Sample Name: Serial.txt Cookbook: default.jbs Time: 02:5:20 Date: 0/05/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: NEW ORDER LIST.jar Cookbook: default.jbs Time: 10:19:47 Date: 19/02/2018 Version:
ID: 47020 Sample Name: NEW ORDER LIST.jar Cookbook: default.jbs Time: :19:47 Date: 19/02/201 Version: 21.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence
Infosec Binary Analisys. updatewin2.exe
updatewin2.exe MalScore: 100 File type: File size: PE32 executable (GUI) Intel 80386, for MS Windows 274.50 KB (281088 bytes) Compile time: 2017-11-21 07:08:45 MD5: SHA1: Import hash: 996ba35165bb62473d2a6743a5200d45
ID: Sample Name: text_0.txt Cookbook: default.jbs Time: 16:20:15 Date: 12/01/2018 Version:
ID: 4253 Sample Name: text_0.txt Cookbook: default.jbs Time: 1:20:15 Date: 12/01/2018 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: js.jar Cookbook: defaultwindowsfilecookbook.jbs Time: 10:01:15 Date: 26/09/2018 Version:
ID: 80115 Sample Name: js.jar Cookbook: defaultwindowsfilecookbook.jbs Time: 10:01:15 Date: 26/09/2018 Version: 23.0.0 Table of Contents Table of Contents Analysis Report js.jar Overview General Information
ID: Cookbook: urldownload.jbs Time: 18:48:38 Date: 19/06/2018 Version:
ID: 64646 Cookbook: urldownload.jbs Time: 1:4:3 Date: 19/06/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature
ID: Cookbook: browseurl.jbs Time: 16:58:45 Date: 04/06/2018 Version:
ID: 62529 Cookbook: browseurl.jbs Time: 16:58:45 Date: 04/06/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: E DA5e8a0c01b.txt Cookbook: default.jbs Time: 15:35:01 Date: 18/04/2018 Version:
ID: 55401 Sample Name: E203182DA5e8a0c01b.txt Cookbook: default.jbs Time: 15:35:01 Date: 18/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection
ID: Sample Name: SSI Set Details.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 01:14:07 Date: 13/04/2018 Version: 22.0.
ID: 54478 Sample Name: SSI Set Details.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 01:14:07 Date: /04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection Confidence
ID: Sample Name: fly.jse Cookbook: default.jbs Time: 18:17:26 Date: 11/11/2017 Version:
ID: 371 Sample Name: fly.jse Cookbook: default.jbs Time: 1:17:2 Date: 11/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification
ID: Sample Name: 21PO jpg...js Cookbook: default.jbs Time: 14:32:06 Date: 21/11/2017 Version:
ID: 371 Sample Name: 21PO201745.jpg...js Cookbook: default.jbs Time: 14:32:0 Date: 21/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence
ID: Sample Name: FsQHOWXph8.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:31:13 Date: 16/03/2018 Version:
ID: 50648 Sample Name: FsQHOWXph8.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 20:31: Date: 16/03/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 20:27:59 Date: 16/03/2018 Version:
ID: 50646 Cookbook: browseurl.jbs Time: 20:27:59 Date: 16/03/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: maintools.js Cookbook: default.jbs Time: 15:43:35 Date: 17/02/2018 Version:
ID: 48 Sample Name: maintools.js Cookbook: default.jbs Time: 1:43:3 Date: 1/02/2018 Version: 21.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: oq5wdjgk2r.exe Cookbook: default.jbs Time: 20:25:47 Date: 22/11/2017 Version:
ID: 388 Sample Name: oq5wdjgk2r.exe Cookbook: default.jbs Time: 20:25:4 Date: 22/11/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: Luxus.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 10:22:08 Date: 09/01/2018 Version:
ID: 42035 Sample Name: Luxus.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 10:22:08 Date: 09/01/2018 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection
ID: Cookbook: urldownload.jbs Time: 11:39:45 Date: 07/04/2018 Version:
ID: 53619 Cookbook: urldownload.jbs Time: 11:39:45 Date: 07/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: test.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 18:57:54 Date: 12/04/2018 Version:
ID: 54427 Sample Name: test.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 18:57:54 Date: /04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection Confidence Classification
ID: Cookbook: browseurl.jbs Time: 14:54:22 Date: 05/09/2018 Version:
ID: 75522 Cookbook: browseurl.jbs Time: 14:54:22 Date: 05/09/2018 Version: 23.0.0 Table of Contents Table of Contents 2 Analysis Report http://www.springdwnld2.com/download/? d=0&h=1&pnid=4&domain=hmapsanddrivingdirection.com&implementation_id=maps_spt_&source=g-ccc7-lp0-
ID: Sample Name: 11#Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.exe Cookbook: default.jbs Time: 09:47:21 Date: 02/02/2018 Version: 20.0.
ID: 4457 Sample Name: #Ucb#Uae#Uc4#Ube#Ue5#Ubb#UaafNOnOJTVYQ.exe Cookbook: default.jbs Time: 09:47:21 Date: 02/02/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General
ID: Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:46:31 Date: 01/02/2018 Version:
ID: 44491 Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:4:31 Date: 01/02/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: Coss, Daniel.vcf Cookbook: default.jbs Time: 15:16:47 Date: 21/06/2018 Version:
ID: 6467 Sample Name: Coss, Daniel.vcf Cookbook: default.jbs Time: 15:16:47 Date: 21/06/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: process.0xfffffa8004b x dmp Cookbook: default.jbs Time: 22:45:59 Date: 02/12/2017 Version: 20.0.
ID: 38941 Sample Name: process.0xfffffa8004b120.0x480000.dmp Cookbook: default.jbs Time: 22:4:9 Date: 02/12/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information
ID: Sample Name: FD-1 Phase Out Notice.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 14:36:29 Date: 04/05/2018 Version: 22.0.
ID: 5762 Sample Name: FD-1 Phase Out Notice.doc Cookbook: defaultwindowsofficecookbook.jbs Time: :36:2 Date: 04/05/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection
ID: Cookbook: urldownload.jbs Time: 19:53:36 Date: 07/03/2018 Version:
ID: 49 Cookbook: urldownload.jbs Time: 19:: Date: 0/0/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice
ID: Cookbook: browseurl.jbs Time: 16:56:06 Date: 13/02/2018 Version:
ID: 46296 Cookbook: browseurl.jbs Time: 16:56:06 Date: 13/02/2018 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 20:07:02 Date: 11/07/2018 Version:
ID: 67658 Cookbook: browseurl.jbs Time: 20:07:02 Date: 11/07/2018 Version: 23.0.0 Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview
ID: Cookbook: browseurl.jbs Time: 18:45:10 Date: 08/10/2018 Version: Fire Opal
ID: 82913 Cookbook: browseurl.jbs Time: 18:45:10 Date: 08/10/2018 Version: 24.0.0 Fire Opal Table of Contents Table of Contents Analysis Report http://www.learningtoolkit.club Overview General Information
ID: Sample Name: tesseract-ocrsetup exe. Cookbook: default.jbs Time: 16:44:15 Date: 12/02/2018 Version:
ID: 46161 Sample Name: tesseract-ocrsetup-3.05.01.exe Cookbook: default.jbs Time: 16:44:15 Date: 12/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence
AhnLab-V AntiVir Antiy-AVL Avast
VT Community Sign in Languages Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus
ID: Sample Name: INDUSTRIAL.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 02:35:30 Date: 25/04/2018 Version: 22.0.
ID: 56519 Sample Name: 20180542 INDUSTRIAL.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 02:35:30 Date: 25/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview Information
ID: Cookbook: browseurl.jbs Time: 22:12:09 Date: 17/11/2017 Version:
ID: 37366 Cookbook: browseurl.jbs Time: 22:12:09 Date: 17/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: MacKeeper.dmg Cookbook: default.jbs Time: 11:09:32 Date: 02/06/2018 Version:
ID: 22 Sample Name: MacKeeper.dmg Cookbook: default.jbs Time: 11:0:2 Date: 02/0/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc Cookbook: defaultwindowsofficecookbook.
ID: 63341 Sample Name: TO_HM_CROWN PR#U0130NCE MOHAMMED B#U0130N SALMAN - Dear Prime Minister.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 08:43:14 Date: 10/06/2018 Version: 22.0.0 Table of Contents
ID: Sample Name: MSM- 24_Supply_List RU_518.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 17:15:48 Date: 19/06/2018 Version: 22.0.
ID: 64635 Sample Name: MSM- 24_Supply_List RU_518.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 17::48 Date: 1/06/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection
ID: Cookbook: browseurl.jbs Time: 20:56:26 Date: 03/07/2018 Version:
ID: 66665 Cookbook: browseurl.jbs Time: 20:56:26 Date: 03/07/2018 Version: 23.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: Commercial Card Services CTO Quality Control Checklist v9.docm Cookbook: defaultwindowsofficecookbook.jbs Time: 15:55:50 Date:
ID: 244 Sample Name: Commercial Card Services CTO Quality Control Checklist v9.docm Cookbook: defaultwindowsofficecookbook.jbs Time: 15:55:50 Date: 05/10/201 Version: 24.0.0 Fire Opal Table of Contents
ID: Sample Name: scan00.html Cookbook: default.jbs Time: 22:21:27 Date: 16/12/2017 Version:
ID: 40269 Sample Name: scan00.html Cookbook: default.jbs Time: 22:21:27 Date: 16/12/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 14:46:55 Date: 31/08/2018 Version:
ID: 74919 Cookbook: browseurl.jbs Time: 14:46:55 Date: 31/08/2018 Version: 23.0.0 Table of Contents Table of Contents Analysis Report http://tiny.cc/34aqxy Overview General Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 10:12:02 Date: 15/01/2018 Version:
ID: 42670 Cookbook: browseurl.jbs Time: 10:12:02 Date: 15/01/2018 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: faktury_pdf.rar Cookbook: default.jbs Time: 12:24:33 Date: 15/12/2017 Version:
ID: 4019 Sample Name: faktury_pdf.rar Cookbook: default.jbs Time: 12:24: Date: 1/12/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: Liste1.jar Cookbook: default.jbs Time: 23:20:23 Date: 02/11/2017 Version:
ID: 35936 Sample Name: Liste1.jar Cookbook: default.jbs Time: 23:20:23 Date: 02/11/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Sample Name: DOCS.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 16:07:38 Date: 06/02/2018 Version:
ID: 45263 Sample Name: DOCS.doc Cookbook: defaultwindowsofficecookbook.jbs Time: 16:07:38 Date: 06/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview Information Detection Confidence Classification
ID: Sample Name: 2017_w2.exe Cookbook: default.jbs Time: 17:03:04 Date: 09/02/2018 Version:
ID: 4572 Sample Name: 2017_w2.exe Cookbook: default.jbs Time: 17:03:04 Date: 0/02/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 00:46:14 Date: 03/07/2018 Version:
ID: 66523 Cookbook: browseurl.jbs Time: 00:46:14 Date: 03/07/2018 Version: 23.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 19:21:50 Date: 15/10/2017 Version:
ID: 34266 Cookbook: browseurl.jbs Time: 19:21:50 Date: 15/10/2017 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: 5GeZNwROcB.bin Cookbook: default.jbs Time: 15:22:54 Date: 30/11/2017 Version:
ID: 82 Sample Name: GeZNwROcB.bin Cookbook: default.jbs Time: 1:22:4 Date: 0/11/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
ID: Cookbook: browseurl.jbs Time: 20:04:11 Date: 14/06/2018 Version:
ID: 64085 Cookbook: browseurl.jbs Time: 20:04:11 Date: 14/06/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 23:36:16 Date: 10/04/2018 Version:
ID: 54075 Cookbook: browseurl.jbs Time: 23:36:16 Date: 10/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 20:07:43 Date: 27/09/2018 Version:
ID: 80599 Cookbook: browseurl.jbs Time: 20:07:43 Date: 27/09/2018 Version: 23.0.0 Table of Contents Table of Contents Analysis Report http://www.qbproadvisorshelp.com Overview General Information Detection
ID: Cookbook: urldownload.jbs Time: 21:28:55 Date: 28/06/2018 Version:
ID: 6600 Cookbook: urldownload.jbs Time: 21:2:55 Date: 2/06/201 Version: 23.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview Networking:
ID: Sample Name: Commercial Card Services CTO Quality Control Checklist v9.docm Cookbook: defaultwindowsofficecookbook.jbs Time: 15:52:31 Date:
ID: 244 Sample Name: Commercial Card Services CTO Quality Control Checklist v9.docm Cookbook: defaultwindowsofficecookbook.jbs Time: 15:52:31 Date: 05/10/201 Version: 24.0.0 Fire Opal Table of Contents
Summary. Verdict: Malware CLASSIFICATION DETECTION SECTION HIGH LEVEL BEHAVIOR DISTRIBUTION ACTIVITY OVERVIEW
Page 1 Summary File Name: ExternalToolz_0.8.exe File Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows SHA1: 6c359ec1e0b099abf25c4f86dedb4df7dccaa62a MD5: d01dd75828dcc4ab7be745c15b4a8e35
ID: Sample Name: SMS_MMS_1.0_1.apk Cookbook: defaultandroidfilecookbook.jbs Time: 14:20:20 Date: 01/12/2017 Version:
ID: 38864 Sample Name: SMS_MMS_1.0_1.apk Cookbook: defaultandroidfilecookbook.jbs Time: 14:20:20 Date: 01/12/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information
ID: Sample Name: Liste_az.docx Cookbook: defaultwindowsofficecookbook.jbs Time: 00:17:54 Date: 30/12/2017 Version:
ID: 41280 Sample Name: Liste_az.docx Cookbook: defaultwindowsofficecookbook.jbs Time: 00:17:54 Date: 30/12/2017 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information
ID: Sample Name: YNtbLvNHuo Cookbook: defaultandroidfilecookbook.jbs Time: 14:44:34 Date: 12/01/2018 Version:
ID: 42511 Sample Name: YNtbLvNHuo Cookbook: defaultandroidfilecookbook.jbs Time: 14:44:34 Date: 12/01/2018 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information
McAfee Network Security Platform 9.1
9.1.7.15-9.1.5.9 Manager-NS-series Release Notes McAfee Network Security Platform 9.1 Revision A Contents About this release New features Enhancements Resolved issues Installation instructions Known issues
ID: Cookbook: urldownload.jbs Time: 22:26:00 Date: 30/12/2017 Version:
ID: 41304 Cookbook: urldownload.jbs Time: 22:26:00 Date: 30/12/2017 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview
ID: Sample Name: MobaXterm_installer_10.5.msi Cookbook: defaultwindowsmsicookbook.jbs Time: 18:29:36 Date: 25/05/2018 Version: 22.0.
ID: 61258 Sample Name: MobaXterm_installer_10.5.msi Cookbook: defaultwindowsmsicookbook.jbs Time: 18:29:36 Date: 25/05/2018 Version: 22.0.0 Table of Contents Analysis Report Overview Information Detection
ID: Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook: defaultwindowsofficecookbook.jbs Time: 06:35:29 Date:
ID: 41310 Sample Name: SSB SBV Daily Report - Logistics Template DEC '17 (8).xlsm Cookbook: defaultwindowsofficecookbook.jbs Time: 06:35:29 Date: 31/12/2017 Version: 20.0.0 Table of Contents Analysis Report
ID: Sample Name: emotet.exe Cookbook: defaultwindowsofficecookbook.jbs Time: 07:07:14 Date: 07/11/2017 Version:
ID: 3626 Sample Name: emotet.exe Cookbook: defaultwindowsofficecookbook.jbs Time: 0:0:14 Date: 0/11/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview Information Detection
ID: Sample Name: meterpreter64bit.exe Cookbook: default.jbs Time: 16:01:45 Date: 24/11/2017 Version:
ID: 0 Sample Name: meterpreter4bit.exe Cookbook: default.jbs Time: 1:01:4 Date: 24/11/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
McAfee Network Security Platform 8.3
8.3.7.86-8.3.7.56 Manager-Virtual IPS Release Notes McAfee Network Security Platform 8.3 Revision C Contents About this release New features Enhancements Resolved issues Installation instructions Known
ID: Sample Name: dronefly.apk Cookbook: default.jbs Time: 10:24:54 Date: 07/06/2018 Version:
ID: 001 Sample Name: dronefly.apk Cookbook: default.jbs Time: 10:24:4 Date: 0/0/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
Hacking the Packer. Introduction
Hacking the Packer I. Introduction II. Observing Code Obscurities III. Stripping Down Source Code IV. Hacking the Packer V. Producing Packed Samples VI. Possible Signature Set VII. Extended Kernel32 Resolution
Reverse Engineering Malware Dynamic Analysis of Binary Malware II
Reverse Engineering Malware Dynamic Analysis of Binary Malware II Jarkko Turkulainen F-Secure Corporation Protecting the irreplaceable f-secure.com Advanced dynamic analysis Debugger scripting Hooking
ID: Sample Name: wtf.bat Cookbook: default.jbs Time: 18:32:35 Date: 19/05/2018 Version:
ID: 6036 Sample Name: wtf.bat Cookbook: default.jbs Time: 1:32:35 Date: 19/05/201 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification
Summary. Verdict: Malware CLASSIFICATION DETECTION SECTION HIGH LEVEL BEHAVIOR DISTRIBUTION ACTIVITY OVERVIEW
Page 1 Summary File Name: LMAOBOXPREMIUM.exe File Type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows SHA1: 24b8d0208fdc46b720d6c07b71949f0ebe792442 MD5: deff401baf9df67d9731da2b98407f14