Antivirus scan for 98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb at 2019-01-10 17:52:47 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Ursu.258767	20190110
AhnLab-V3	Malware/Win32.Generic.C2651489	20190110
ALYac	Gen:Variant.Ursu.258767	20190110
Antiy-AVL	Trojan/Win32.Inject	20190110
Arcabit	Trojan.Ursu.D3F2CF	20190110
Avast	Win32:Malware-gen	20190110
AVG	Win32:Malware-gen	20190110
Avira (no cloud)	TR/Crypt.XPACK.Gen	20190110
BitDefender	Gen:Variant.Ursu.258767	20190110
ClamAV	Win.Packed.Trickbot-6622060-0	20190110
CrowdStrike Falcon (ML)	malicious_confidence_100% (W)	20181023
Cybereason	malicious.45f1d4	20190109
Cylance	Unsafe	20190110
Cyren	W32/Trojan.GLIK-5061	20190110
DrWeb	Trojan.Trick.46146	20190110
Emsisoft	Gen:Variant.Ursu.258767 (B)	20190110
Endgame	malicious (high confidence)	20181108
ESET-NOD32	a variant of Win32/Kryptik.GJAZ	20190110
F-Secure	Gen:Variant.Ursu.258767	20190110
Fortinet	W32/GenKryptik.CFOA!tr	20190110
GData	Gen:Variant.Ursu.258767	20190110
Sophos ML	heuristic	20181128
Jiangmin	Trojan.Generic.cprpj	20190110
K7AntiVirus	Trojan ( 005386ab1 )	20190110
K7GW	Trojan ( 005386ab1 )	20190110
Kaspersky	HEUR:Trojan.Win32.Generic	20190110
Malwarebytes	Trojan.MalPack	20190110
MAX	malware (ai score=85)	20190110
McAfee	Trojan-FPOJ!B06374F45F1D	20190110
McAfee-GW-Edition	BehavesLike.Win32.Malware.gh	20190110
eScan	Gen:Variant.Ursu.258767	20190110
NANO-Antivirus	Trojan.Win32.Inject.ffpdfa	20190110
Panda	Trj/Genetic.gen	20190109
Qihoo-360	HEUR/QVM07.1.754D.Malware.Gen	20190110
Rising	Trojan.Kryptik!8.8 (RDM+:cmRtazo6kN0/S/zMvnrcGzYpNeBp)	20190110
SentinelOne (Static ML)	static engine - malicious	20181223
Sophos AV	Mal/EncPk-ANZ	20190110
Symantec	ML.Attribute.HighConfidence	20190110
TACHYON	Trojan/W32.Inject.500736.H	20190110
Trapmine	malicious.moderate.ml.score	20190103
TrendMicro	TrojanSpy.Win32.TRICKBOT.SMB	20190110
TrendMicro-HouseCall	TrojanSpy.Win32.TRICKBOT.SMB	20190110
VBA32	BScope.Trojan.Inject	20190110
Zillya	Trojan.Kryptik.Win32.1477689	20190109
ZoneAlarm by Check Point	HEUR:Trojan.Win32.Generic	20190110
Acronis		20190110
AegisLab		20190110
Alibaba		20180921
Avast-Mobile		20190110
AVware		20180925
Babable		20180918
Baidu		20190110
Bkav		20190108
CAT-QuickHeal		20190110
CMC		20190110
Comodo		20190110
eGambit		20190110
F-Prot		20190110
Ikarus		20190110
Kingsoft		20190110
Microsoft		20190110
Palo Alto Networks (Known Signatures)		20190110
SUPERAntiSpyware		20190109
Tencent		20190110
TheHacker		20190106
TotalDefense		20190110
Trustlook		20190110
VIPRE		20190110
ViRobot		20190110
Webroot		20190110
Yandex		20190110
Zoner		20190110

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2017-09-16 00:36:20

Entry Point 0x00032D30

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 247974 248320 6.65 2b793c5e2071a0a881e3c8c6c7f4bbb2

.rdata 253952 69956 70144 6.13 c82477dd8e7bfff35cc796c671b88412

.data 327680 63740 62464 5.81 18257971f86879424ee61454ca2748bb

.rsrc 393216 118328 118784 6.60 005c509ee496cef7bc8f7d235be74331

PE imports

Number of PE resources by type

RT_BITMAP 4

RT_ICON 2

RT_DIALOG 1

RT_MANIFEST 1

RT_VERSION 1

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 10

PE resources

4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df ASCII text

6c647015054bfb46e1d67c6d338e1cfedad52911669b2c5516babbfc73382323 data

873a2980457a65c18d22a4d8a0cbdef4ec47ca9a40f699fc02688f4b3a8fb9d0 data

b10e28a32eddb2ab20a46ceae59d9c0786911eb20f0c8dd2a28421f226ea2b8b data

bf763501e16f639d5223f88427789665cb0baa9af8877e2e83c65e16016ab8b1 data

c0ede68a98bd2bc58c78564dfb42f1640dc29766d3ab2782ab8b5ed28c6fd414 data

c58566baa5b3acf7104456a538743dcf762fd9ce1a68021ec88d5b21ffb54062 data

d3a24b5c6721ce2e951d9328e18c8460dca7d2dc8e0cfff7d847c0577a5543ea data

e6b2f28591b4d66ce87e892b8a2dca58d0652dbf8ef8ea4125f3ea73adeb077e data

f8e1696801fe89b88936ac4226cea03bfa5aa345aa33ca982822ae7fbc6557e2 data

ExifTool file metadata

UninitializedDataSize

LinkerVersion

2.25

ImageVersion

6.0

FileSubtype

FileVersionNumber

1.0.0.6

LanguageCode

Unknown (3013)

FileFlagsMask

0x0000

FileDescription

Xanif Ltd. Gui application

ImageFileCharacteristics

No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi

CharacterSet

Unknown (B090)

InitializedDataSize

252928

EntryPoint

0x32d30

OriginalFileName

Xanif

MIMEType

application/octet-stream

LegalCopyright

FileVersion

1.0.0.6

TimeStamp

2017:09:16 01:36:20+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

Xanifer

ProductVersion

1.0.0.6

SubsystemVersion

4.0

OSVersion

1.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Xanif Ltd.

CodeSize

248320

ProductName

Xanif Inform

ProductVersionNumber

1.0.0.6

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 b06374f45f1d4dd69d536391c7406f5d

SHA1 3db96f5320df711f6f16f93ef9a6f4f50496e78c

SHA256 98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb

ssdeep

12288:sqVYpCC6bzyEkODldNDYJLhF4VQTTQSVrS:tYv6beEHljYm+I0

authentihash 302c50d66976832a423d9b24a33463920f9fc28db04558de2d5fc9dc1eb62575

imphash 0bfa28a641de99832990b204da98eb11

File size 489.0 KB ( 500736 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable (generic) (35.7%) Win16/32 Executable Delphi generic (16.4%) OS/2 Executable (generic) (16.0%) Generic Win/DOS Executable (15.8%) DOS Executable Generic (15.8%)

VirusTotal metadata

First submission 2019-01-10 17:52:47 UTC ( 1 month, 1 week ago )

Last submission 2019-01-10 17:52:47 UTC ( 1 month, 1 week ago )

File names

b06374f45f1d4dd69d536391c7406f5d.virus

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\vbscript.dll\3 (failed)

C:\WINDOWS\system32\vbscript.dll (successful)

C:\FAQ (failed)

C:\98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\Ip (successful)

\\.\PIPE\lsarpc (successful)

Read files

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\vbscript.dll (successful)

C:\98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

FAQ (successful)

Written files

C:\WINDOWS\Tasks\MsSystemWatcher.job (successful)

FAQ (successful)

README.md (successful)

Copied files

SRC: C:\98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb
DST: C:\Documents and Settings\<USER>\Application Data\msnet\99843faa9c3bb71402a9b4309f4b989aea4b816bcb79f23dd36bfd7c9716e9bb (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\msnet\99843faa9c3bb71402a9b4309f4b989aea4b816bcb79f23dd36bfd7c9716e9bb (successful)

Created mutexes

Global\D8F153864E1832960 (successful)

Opened mutexes

ShimCacheMutex (successful)

Searched windows

CLASS: LoWindow
NAME: LoWindowApp 1.0

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

WinDefend (failed)

MBAMService (failed)

SAVService (failed)

Runtime DLLs

clbcatq.dll (successful)

kernel32.dll (successful)

sxs.dll (successful)

oleaut32.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

shlwapi.dll (successful)

advapi32.dll (successful)

ole32.dll (successful)

rpcrt4.dll (successful)

HTTP requests

URL: http://icanhazip.com/
TYPE: GET
USER AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

DNS requests

icanhazip.com (147.75.40.2)

TCP connections

147.75.40.2:80

138.34.32.218:443

SHA256:	98743faa9c3bb61402a8b4308f4b879aea4b715bcb69f23dd35bfd6c9615e9bb
File name:	b06374f45f1d4dd69d536391c7406f5d.virus
Detection ratio:	45 / 72
Analysis date:	2019-01-10 17:52:47 UTC ( 1 month, 1 week ago ) View latest

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Created processes

Created mutexes

Opened mutexes

Searched windows

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

Recover your password

Join VirusTotal Community

Sign in