Antivirus scan for 9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857 at 2018-06-01 21:35:44 UTC

Antivirus	Result	Update
AegisLab	Uds.Dangerousobject.Multi!c	20180601
AVG	Win32:MdeClass	20180601
Baidu	Multi.Threats.InArchive	20180601
Endgame	malicious (moderate confidence)	20180507
Kaspersky	UDS:DangerousObject.Multi.Generic	20180601
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc	20180601
Panda	PUP/Generic	20180601
Symantec	ML.Attribute.HighConfidence	20180601
Webroot	W32.Adware.Gen	20180601
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180601
Ad-Aware		20180601
AhnLab-V3		20180601
Alibaba		20180601
ALYac		20180601
Antiy-AVL		20180601
Arcabit		20180601
Avast		20180601
Avast-Mobile		20180601
Avira (no cloud)		20180601
AVware		20180601
Babable		20180406
BitDefender		20180601
Bkav		20180601
CAT-QuickHeal		20180601
ClamAV		20180601
CMC		20180601
Comodo		20180601
CrowdStrike Falcon (ML)		20180202
Cybereason		None
Cylance		20180601
Cyren		20180601
DrWeb		20180601
eGambit		20180601
Emsisoft		20180601
ESET-NOD32		20180601
F-Prot		20180601
F-Secure		20180601
Fortinet		20180601
GData		20180601
Ikarus		20180601
Sophos ML		20180601
Jiangmin		20180601
K7AntiVirus		20180601
K7GW		20180601
Kingsoft		20180601
Malwarebytes		20180601
MAX		20180601
McAfee		20180601
Microsoft		20180601
eScan		20180601
NANO-Antivirus		20180601
nProtect		20180601
Palo Alto Networks (Known Signatures)		20180601
Qihoo-360		20180601
Rising		20180601
SentinelOne (Static ML)		20180225
Sophos AV		20180601
SUPERAntiSpyware		20180601
Symantec Mobile Insight		20180601
Tencent		20180601
TheHacker		20180531
TotalDefense		20180601
TrendMicro		20180601
TrendMicro-HouseCall		20180601
Trustlook		20180601
VBA32		20180601
VIPRE		20180601
ViRobot		20180601
Yandex		20180529
Zillya		20180601
Zoner		20180601

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

Packers identified

F-PROT NSIS

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-01-27 12:19:23

Entry Point 0x000033E9

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 25152 25600 6.42 1a752074fcd11165f6f148ea63ebe068

.rdata 32768 6346 6656 4.88 7eb0899a4b6211f8bc545228417d92ad

.data 40960 419452 512 1.36 b0b1d7c362f8cc76541b7fce5014e602

.ndata 462848 1282048 0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rsrc 1744896 16905152 70656 5.58 9f0463f94ad69c9bc0791df6134a5fbd

Overlays

MD5 a392f67d91ac66854e926046a29f93ff

File type font/x-snf

Offset 104448

Size 8110004

Entropy 8.00

PE imports

Number of PE resources by type

RT_DIALOG 5

RT_ICON 1

RT_GROUP_ICON 1

RT_MANIFEST 1

Number of PE resources by language

ENGLISH US 8

PE resources

18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01 data

425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014 data

4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4 data

76a75c233808125a0de0333983a51bfbc33a7a4346269495da537ec065f894bc data

7854e8d67a11148566ad37c5d23e1534e0990fe31a160e0e7da3ca751830bb50 data

c50631fc1f8425a95fd1edcc8e730d339e193a38f18d42372c32847a5ad2c016 data

cd0991dd595a1392452a8c7ccf089e73626bc6eed1fd3f54ee4c6aa7ffbaedba ASCII text

e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf ASCII text

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2009:01:27 13:19:23+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

25600

LinkerVersion

9.0

ImageFileCharacteristics

No relocs, Executable, 32-bit

EntryPoint

0x33e9

InitializedDataSize

431104

SubsystemVersion

5.0

ImageVersion

6.0

OSVersion

5.0

UninitializedDataSize

16896

Execution parents

This file was created during the sandboxed execution of the following files.

376a60dc4b7f63bf4c1ab46f5f67327fa62c44831dab9c4a7c0294fa92f3ac2d

File identification

MD5 d785fcbe6e996bb61a8942baae953c15

SHA1 9cb031e80ae018d85458a6cbf1cdfd82ab3dbf29

SHA256 9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857

ssdeep

196608:iynwalD0J5EB4NO1uhLX6eixBws7X7xtWVvEFdyDzh9:iynZh0JaWNO1utGQs7X7xtWxedmh9

authentihash 4fcf4a69a1cd1fc6877fac98429d427c0b73def0863f20b1bd591914cff7d29b

imphash bf95d1fc1d10de18b32654b123ad5e1f

File size 7.8 MB ( 8214452 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (41.0%) Win64 Executable (generic) (36.3%) Win32 Dynamic Link Library (generic) (8.6%) Win32 Executable (generic) (5.9%) OS/2 Executable (generic) (2.6%)

VirusTotal metadata

First submission 2018-06-01 17:37:26 UTC ( 8 months, 2 weeks ago )

Last submission 2018-06-01 17:37:26 UTC ( 8 months, 2 weeks ago )

File names

update.exe
update.exe
yxwnfjsombo.exe
Setup2.exe
update.exe
update.exe
r2pmgbkjntc.exe
s2s.exe
y0s13fukq0r.exe
bnw203gubyv.exe
update.exe
Setup.exe?REDACTED
update.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsd3.tmp (successful)

C:\9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\tep.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\PDTTukkLNSM.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\HquNQahAeRe.dll (successful)

\\.\Ip (successful)

\\.\WMIDataDevice (successful)

Read files

C:\9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\tep.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc6.tmp (successful)

C:\WINDOWS\system32\wscript.exe (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\dYJFiqxMbEA.js (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\dYJFiqxMbEA.js (successful)

C:\WINDOWS\system32\scrrun.dll (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\tep.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\PDTTukkLNSM.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\HquNQahAeRe.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\dYJFiqxMbEA.js (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\wJhvZCDFglH.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc6.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\System.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\md5dll.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\brh.dat (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\nsExec.dll (successful)

Copied files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\nsExec.dll
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\ns8.tmp (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsd3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsn5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\HquNQahAeRe.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\PDTTukkLNSM.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\tep.gif (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp\wJhvZCDFglH.dll (failed)

Created processes

wscript.exe C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\dYJFiqxMbEA.js" "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsh4.tmp" "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\dYJFiqxMbEA.js"" (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsc7.tmp\ns8.tmp" sc create -- binPath= ""C:\9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857" /wl 1"" (successful)

Created mutexes

__PDH_PLA_MUTEX__ (successful)

oleacc-msaa-loaded (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

shfolder (successful)

ole32.dll (successful)

setupapi.dll (successful)

rpcrt4.dll (successful)

shell32.dll (successful)

c:\windows\system32\imm32.dll (successful)

oleaut32.dll (successful)

kernel32.dll (successful)

kbdus.dll (successful)

version.dll (successful)

SHA256:	9339b09324b5726870be4ed0765b0393a24f37f8f6e01099b8318ae8bdc40857
File name:	Setup.exe?REDACTED
Detection ratio:	10 / 66
Analysis date:	2018-06-01 21:35:44 UTC ( 8 months, 2 weeks ago ) View latest

Ciphered bundle

Packers identified

PE header basic information

PE sections

Overlays

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

Execution parents

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Deleted files

Created processes

Created mutexes

Opened mutexes

Runtime DLLs

Recover your password

Join VirusTotal Community

Sign in