Antivirus scan for aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d at 2016-04-06 22:43:07 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Razy.37488	20160406
AegisLab	Troj.Dropper.W32.Agent.lsik	20160406
Arcabit	Trojan.Razy.D9270	20160406
Avast	Win32:Malware-gen	20160406
AVG	Crypt5.AVNX	20160406
Avira (no cloud)	TR/Crypt.Xpack.pofg	20160406
Baidu	Win32.Trojan.WisdomEyes.151026.9950.9999	20160405
BitDefender	Gen:Variant.Razy.37488	20160406
Bkav	HW32.Packed.EE85	20160406
Emsisoft	Gen:Variant.Razy.37488 (B)	20160406
ESET-NOD32	Win32/Qbot.BK	20160406
Kaspersky	Trojan.Win32.Bublik.egyg	20160406
Malwarebytes	Trojan.KeyLogger.INJ	20160406
McAfee	W32/PinkSbot-BS!BDF43C8CEDB2	20160406
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.dc	20160406
Panda	Trj/GdSda.A	20160406
Qihoo-360	HEUR/QVM20.1.0000.Malware.Gen	20160406
Rising	PE:Malware.XPACK-LNR/Heur!1.5594 [F]	20160406
Sophos AV	Mal/Qbot-N	20160406
Tencent	Win32.Trojan.Bp-generic.Ixrn	20160406
AhnLab-V3		20160406
Alibaba		20160406
ALYac		20160406
Antiy-AVL		20160406
AVware		20160406
Baidu-International		20160406
CAT-QuickHeal		20160406
ClamAV		20160405
CMC		20160404
Comodo		20160406
Cyren		20160406
DrWeb		20160406
F-Prot		20160406
F-Secure		20160406
Fortinet		20160404
GData		20160406
Ikarus		20160406
Jiangmin		20160406
K7AntiVirus		20160406
K7GW		20160404
Kingsoft		20160406
Microsoft		20160406
eScan		20160406
NANO-Antivirus		20160406
nProtect		20160406
SUPERAntiSpyware		20160406
Symantec		20160331
TheHacker		20160405
TotalDefense		20160406
TrendMicro		20160406
TrendMicro-HouseCall		20160406
VBA32		20160406
VIPRE		20160406
ViRobot		20160406
Yandex		20160406
Zillya		20160406
Zoner		20160406

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows command line subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2016-04-05 12:40:49

Entry Point 0x00007450

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 30896 32768 5.82 76c2b854e667cd1638672abe5e75fd93

.data 36864 97072 98304 7.58 fdf20c85592c9407ec01e0ff570308f3

.edata 135168 109157 110592 7.78 8416827e73e35583b2eec12e401bb5db

INIT 245760 1959 4096 4.64 e288a5704421b90823799b86babbe176

CODE 249856 8492 12288 6.15 62e4c36713398269cf6327cddb96c59e

PE imports

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows command line

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2016:04:05 13:40:49+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

32768

LinkerVersion

6.0

EntryPoint

0x7450

InitializedDataSize

225280

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

UninitializedDataSize

File identification

MD5 bdf43c8cedb2f8d124ff7aff76dd8c4b

SHA1 fc8d0450403b8d125f1150ff695e9e37c2bfba6e

SHA256 aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d

ssdeep

6144:PCjUqSNmZNCwylJmSy2nIBsYb5quICT45+fH:GRSNmZmy2nIRw95+v

authentihash a081de918b657c5568731550a841091acd88c9a11bd2a3ae99e5ccfe6f9b430a

imphash 0598d36cbc0de063e21cda61465cb304

File size 256.0 KB ( 262144 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (console) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (43.5%) Win32 Executable (generic) (29.8%) Generic Win/DOS Executable (13.2%) DOS Executable Generic (13.2%)

VirusTotal metadata

First submission 2016-04-06 22:43:07 UTC ( 2 years, 10 months ago )

Last submission 2016-09-12 08:27:16 UTC ( 2 years, 5 months ago )

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\PIPE\lsarpc (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegak.dll (successful)

C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\PIPE\samr (successful)

\\.\PIPE\wkssvc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

\\.\MountPointManager (successful)

Read files

C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\cmd.exe (successful)

Written files

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegak.dll (successful)

Copied files

SRC: C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d
DST: C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegaki.exe (successful)

Deleted files

C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d (failed)

C:\AA8F81~1 (failed)

Created processes

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegaki.exe (successful)

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\WINDOWS\\System32\\autoconv.exe" > "C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d" & del /F /Q "C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d"" (successful)

C:\WINDOWS\explorer.exe (successful)

C:\WINDOWS\system32\ping.exe ping.exe -n 6 127.0.0.1 (successful)

Shell commands

((null)) cmd.exe /c ping.exe -n 6 127.0.0.1 & type C:\WINDOWS\\System32\\autoconv.exe" > "C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d" & del /F /Q "C:\aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d"" [(null)] (successful)

Created mutexes

aa8f8120021ad82eaddbb958f34073da (successful)

sswjvoi (successful)

Global\akiegaki (successful)

akiegakia (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

userenv.dll (successful)

shlwapi.dll (successful)

ole32.dll (successful)

shell32.dll (successful)

setupapi.dll (successful)

kernel32.dll (successful)

advapi32.dll (successful)

netapi32.dll (successful)

msvcrt.dll (successful)

wintrust.dll (successful)

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d
File name:	aa8f8120021ad82eaddbb958f34073d98fbd3de48c0256f768eac16617e2c03d
Detection ratio:	20 / 57
Analysis date:	2016-04-06 22:43:07 UTC ( 2 years, 10 months ago ) View latest

Ciphered bundle