Antivirus scan for a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca at 2017-10-02 22:50:28 UTC

Antivirus	Result	Update
AegisLab	Gen.Variant.Strictor!c	20171002
ALYac	Gen:Variant.Strictor.148415	20171002
Arcabit	Trojan.Strictor.D243BF	20171002
Avira (no cloud)	TR/Crypt.ZPACK.jkrmk	20171002
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9838	20170930
CrowdStrike Falcon (ML)	malicious_confidence_100% (W)	20170804
Emsisoft	Gen:Variant.Strictor.148415 (B)	20171002
F-Secure	Gen:Variant.Strictor.148415	20171002
Ikarus	Trojan.Win32.Krypt	20171002
Kaspersky	Trojan.Win32.Mansabo.ni	20171002
McAfee-GW-Edition	BehavesLike.Win32.PUPXAQ.gc	20171002
Palo Alto Networks (Known Signatures)	generic.ml	20171002
Panda	Trj/GdSda.A	20171002
VIPRE	Trojan.Win32.Generic!BT	20171002
ZoneAlarm by Check Point	Trojan.Win32.Mansabo.ni	20171002
Antiy-AVL		20171002
AVware		20171002
Bkav		20170928
ClamAV		20171002
CMC		20171002
Sophos ML		20170914
Jiangmin		20171002
Kingsoft		20171002
Malwarebytes		20171002
Qihoo-360		20171002
Symantec Mobile Insight		20170928
Trustlook		20171002
Zillya		20171002
Zoner		20171002

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2015-12-21 11:37:47

Entry Point 0x00011340

Number of sections 3

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 191670 192000 6.71 aa42d468e2b45022b9e9181d394347ee

.data 196608 108682 109056 6.05 53f24bfcb607e907a17842869a2cf0b4

.rsrc 307200 192368 192512 6.94 d170ee688757978c7e832cd4f75ab220

PE imports

Number of PE resources by type

RT_MENU 1

Number of PE resources by language

ENGLISH US 1

PE resources

87d34c698b0283b68adcda3a2be4237fc03b7705ae2ce3d9c1b6feb0027d6b72 data

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2015:12:21 12:37:47+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

192000

LinkerVersion

7.0

ImageFileCharacteristics

No relocs, Executable, No line numbers, No symbols, 32-bit

EntryPoint

0x11340

InitializedDataSize

301568

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

UninitializedDataSize

File identification

MD5 a61bc96793f35f9abe6e0a8b3ee03278

SHA1 e223a1a17259d8b7af8524ec2d4e06a2bdf9d758

SHA256 a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca

ssdeep

6144:VWPiE1MGnID0N04WVlrbWHyLmmBSayt+pWtoubNDmFBG/CoJFE5AdKCsC+bkQa4c:VWF1Ut9zyHyBB4CG/hJ+5A9Bd4

authentihash 19df1052b7bbf255c4d57de807e6c9cf3016ff5af58e659301a6ca1feb795833

imphash 44bdbfeaa3ab75d72786b08de3256c69

File size 483.0 KB ( 494592 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (41.0%) Win64 Executable (generic) (36.3%) Win32 Dynamic Link Library (generic) (8.6%) Win32 Executable (generic) (5.9%) OS/2 Executable (generic) (2.6%)

VirusTotal metadata

First submission 2017-10-01 09:10:09 UTC ( 1 year, 4 months ago )

Last submission 2018-10-24 07:22:23 UTC ( 3 months, 4 weeks ago )

File names

a61bc96793f35f9abe6e0a8b3ee03278.vir
a61bc96793f35f9abe6e0a8b3ee03278.vir
a61bc96793f35f9abe6e0a8b3ee03278.vir
setup.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

tmp3.txt (failed)

C:\a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\Ip (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\Tasks\services update.job (failed)

C:\WINDOWS\Tasks\services update.job (successful)

Read files

C:\a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

client_id (successful)

C:\WINDOWS\system32\dssenh.dll (successful)

c:\autoexec.bat (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

Written files

C:\WINDOWS\Tasks\services update.job (successful)

client_id (successful)

group_tag (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (successful)

Copied files

SRC: C:\a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca
DST: C:\Documents and Settings\<USER>\Application Data\winapp\a3g82g7388500a7ede455460f27gd5ag32df0gc50g7f92gde746f2c63c4600da (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab1.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar2.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab3.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar4.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Cab5.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\Tar6.tmp (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\winapp\a3g82g7388500a7ede455460f27gd5ag32df0gc50g7f92gde746f2c63c4600da (successful)

svchost.exe (successful)

Terminated processes

svchost.exe (failed)

Created mutexes

Global\VLock (successful)

RasPbFile (failed)

Opened mutexes

ShimCacheMutex (successful)

RasPbFile (successful)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

CryptSvc (successful)

RASMAN (successful)

Runtime DLLs

kernel32.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

shlwapi.dll (successful)

advapi32.dll (successful)

secur32.dll (successful)

ole32.dll (successful)

oleaut32.dll (successful)

msvcrt.dll (successful)

winhttp.dll (successful)

HTTP requests

URL: http://ipinfo.io/ip
TYPE: GET
USER AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

ipinfo.io (216.239.38.21)

www.download.windowsupdate.com (92.122.122.162)

TCP connections

216.239.36.21:80

194.87.238.53:443

92.122.122.162:80

195.133.147.205:447

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	a2f81f7288400a7dcd344350e17fc4af21ce0fb40f7e91fcd736e1b62b3500ca
File name:	a61bc96793f35f9abe6e0a8b3ee03278
Detection ratio:	15 / 27
Analysis date:	2017-10-02 22:50:28 UTC ( 1 year, 4 months ago ) View latest

Ciphered bundle

PE header basic information

PE sections

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Deleted files

Created processes

Terminated processes

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

HTTP requests

DNS requests

TCP connections

UDP communications

Recover your password

Join VirusTotal Community

Sign in