Antivirus scan for 7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b at 2017-10-26 14:06:14 UTC

Antivirus	Result	Update
CrowdStrike Falcon (ML)	malicious_confidence_100% (W)	20171016
Cylance	Unsafe	20171026
eGambit	Unsafe.AI_Score_99%	20171026
Endgame	malicious (high confidence)	20171024
Fortinet	W32/Kryptik.FXUX!tr	20171026
Palo Alto Networks (Known Signatures)	generic.ml	20171026
Qihoo-360	HEUR/QVM20.1.C357.Malware.Gen	20171026
SentinelOne (Static ML)	static engine - malicious	20171019
Ad-Aware		20171026
AegisLab		20171026
AhnLab-V3		20171026
Alibaba		20170911
ALYac		20171026
Antiy-AVL		20171026
Arcabit		20171026
Avast		20171026
Avast-Mobile		20171026
AVG		20171026
Avira (no cloud)		20171026
AVware		20171026
Baidu		20171026
BitDefender		20171026
Bkav		20171025
CAT-QuickHeal		20171026
ClamAV		20171026
CMC		20171026
Comodo		20171026
Cybereason		20170628
Cyren		20171026
DrWeb		20171026
Emsisoft		20171026
ESET-NOD32		20171026
F-Prot		20171026
F-Secure		20171026
GData		20171026
Ikarus		20171026
Sophos ML		20170914
Jiangmin		20171026
K7AntiVirus		20171026
K7GW		20171026
Kaspersky		20171026
Kingsoft		20171026
Malwarebytes		20171026
MAX		20171026
McAfee		20171026
McAfee-GW-Edition		20171026
Microsoft		20171026
eScan		20171026
NANO-Antivirus		20171026
nProtect		20171026
Panda		20171026
Rising		20171026
Sophos AV		20171026
SUPERAntiSpyware		20171026
Symantec		20171026
Symantec Mobile Insight		20171026
Tencent		20171026
TheHacker		20171024
TrendMicro		20171026
TrendMicro-HouseCall		20171026
Trustlook		20171026
VBA32		20171026
VIPRE		20171026
ViRobot		20171026
Webroot		20171026
WhiteArmor		20171024
Yandex		20171025
Zillya		20171026
ZoneAlarm by Check Point		20171026
Zoner		20171026

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2015-07-22 15:49:55

Entry Point 0x000139A0

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 159248 159744 6.66 778e35f0737ef46f0d6c61cb9d893633

.rdata 163840 94810 95232 5.98 a06306b8f30ab41bc4674a733152701c

.data 262144 42088 40960 6.40 24286b45af3be9c6a87d6922f9914e1b

.rsrc 307200 133480 133632 6.78 d2a6652769e64dea49a65b1607a87ee2

PE imports

[+] KERNEL32.dll

[+] MSVCRT.dll

[+] USER32.dll

Number of PE resources by type

RT_STRING 1

Number of PE resources by language

ENGLISH US 1

PE resources

6affcd48ce8e7e006dd21d3286fa6700b1882fe613ccad2c4c6c4e9415d63a13 ASCII text

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2015:07:22 16:49:55+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

159744

LinkerVersion

8.0

ImageFileCharacteristics

No relocs, Executable, 32-bit

EntryPoint

0x139a0

InitializedDataSize

271360

SubsystemVersion

5.1

ImageVersion

0.0

OSVersion

5.1

UninitializedDataSize

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

2a212a6446b056218afc179efe0aa3ebb832199f65ae7f83b9dec5535d74a027

557a45a4e9861f31cc478d8ca2c09c1f6b413359b742e7bdbac01b363eeb7dd9

File identification

MD5 a345b680aff502a574ad92cbb9fcd138

SHA1 2a2a33df15eb8301796406f97ad4b52e25c4a888

SHA256 7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b

ssdeep

6144:1CUX78BiWAR4Oq6lefdAXZKCJQMpLdJKtezXXV3g8I6gJHKVTb:1LL8gu8qdAaMpxJKOhg8IP2Tb

authentihash b13b33172483ba57ffab66bf5a8afe5f8a1251af6c184f690ed85119efee46b8

imphash 3ad99fef9c347f1ef21e722596762b80

File size 420.5 KB ( 430592 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (41.0%) Win64 Executable (generic) (36.3%) Win32 Dynamic Link Library (generic) (8.6%) Win32 Executable (generic) (5.9%) OS/2 Executable (generic) (2.6%)

VirusTotal metadata

First submission 2017-10-26 13:51:45 UTC ( 1 year, 3 months ago )

Last submission 2017-11-28 10:13:59 UTC ( 1 year, 2 months ago )

File names

VirusShare_a345b680aff502a574ad92cbb9fcd138
sorbanaro.png
ect.exe
a345b680aff502a574ad92cbb9fcd138.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

cv43.tmp (failed)

C:\7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\Ip (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\Tasks\services update.job (failed)

C:\WINDOWS\Tasks\services update.job (successful)

Read files

C:\7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

client_id (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

Written files

C:\WINDOWS\Tasks\services update.job (successful)

client_id (successful)

group_tag (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

Copied files

SRC: C:\7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b
DST: C:\Documents and Settings\<USER>\Application Data\winapp\7eae6fg442g7d6f63a2898e744af5e9a0ce009eg0dg3c8aaaae4e3c78f285c0c (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\winapp\7eae6fg442g7d6f63a2898e744af5e9a0ce009eg0dg3c8aaaae4e3c78f285c0c (successful)

svchost.exe (successful)

Terminated processes

svchost.exe (failed)

Created mutexes

D8F153864E1832960 (successful)

RasPbFile (failed)

Opened mutexes

ShimCacheMutex (successful)

RasPbFile (successful)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

CryptSvc (successful)

RASMAN (successful)

Runtime DLLs

kernel32.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

shlwapi.dll (successful)

advapi32.dll (successful)

secur32.dll (successful)

ole32.dll (successful)

oleaut32.dll (successful)

msvcrt.dll (successful)

winhttp.dll (successful)

HTTP requests

URL: http://wtfismyip.com/text
TYPE: GET
USER AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

wtfismyip.com (158.69.26.138)

www.download.windowsupdate.com (8.253.93.237)

TCP connections

158.69.26.138:80

181.211.34.154:449

8.253.93.228:80

37.60.177.199:447

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	7dad6ef331f7c5e52a1898d733ae4d9a0bd009df0cf2b8aaaad3d2b78e184b0b
Detection ratio:	8 / 67
Analysis date:	2017-10-26 14:06:14 UTC ( 1 year, 3 months ago ) View latest

Ciphered bundle

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

Compressed bundles

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Deleted files

Created processes

Terminated processes

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in