Antivirus scan for cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942 at 2016-06-14 03:48:58 UTC

Antivirus	Result	Update
Ad-Aware	Trojan.Zbot.5852	20160614
AegisLab	Troj.Dropper.W32.Autoit.lVxD	20160613
AhnLab-V3	Spyware/Win32.Zbot	20160613
ALYac	Trojan.Zbot.5852	20160613
Arcabit	Trojan.Zbot.D16DC	20160613
Avast	AutoIt:MalOb-BZ [Trj]	20160613
AVG	Autoit	20160613
Avira (no cloud)	TR/Dropper.Gen	20160613
AVware	Trojan.Win32.Autoit.bjn (v)	20160613
Baidu	AutoIt.Worm.Agent.c	20160612
Baidu-International	Trojan.Win32.Dropper.adzuv	20160606
BitDefender	Trojan.Zbot.5852	20160613
ClamAV	Win.Trojan.8740072-1	20160613
CMC	Trojan.Win32.Generic!O	20160613
Cyren	W32/Trojan.FVBG-7880	20160613
DrWeb	Trojan.MulDrop4.46259	20160613
Emsisoft	Trojan.Zbot.5852 (B)	20160613
ESET-NOD32	Win32/Autoit.KE	20160613
F-Prot	W32/Trojan2.ORIG	20160613
F-Secure	Trojan.Zbot.5852	20160613
Fortinet	W32/Inject.EYEW!tr	20160613
GData	Trojan.Zbot.5852	20160613
Ikarus	Worm.Win32.AutoIt	20160613
Jiangmin	Trojan.MSIL.aeui	20160613
K7AntiVirus	Trojan ( 700000111 )	20160613
K7GW	Trojan ( 700000111 )	20160613
Kaspersky	Trojan-Dropper.Win32.FrauDrop.adzuv	20160613
McAfee	Artemis!AFE2A5435273	20160613
McAfee-GW-Edition	BehavesLike.Win32.Spyware.fc	20160613
Microsoft	Worm:Win32/Jenxcus.N	20160613
eScan	Trojan.Zbot.5852	20160613
NANO-Antivirus	Trojan.Script.Agent.debwym	20160613
nProtect	Trojan.Zbot.5852	20160613
Panda	Trj/CI.A	20160613
Qihoo-360	HEUR/QVM11.1.Malware.Gen	20160614
Sophos AV	Mal/Generic-S	20160613
SUPERAntiSpyware	Trojan.Agent/Gen-Injector	20160613
TheHacker	Backdoor/Poison.evjc	20160612
TrendMicro	TROJ_SPNR.03AR14	20160613
VBA32	Trojan.Autoit.Wirus	20160611
ViRobot	Trojan.Win32.Z.Zbot.358912.B[h]	20160614
Alibaba		20160613
Antiy-AVL		20160614
Bkav		20160613
CAT-QuickHeal		20160613
Comodo		20160613
Kingsoft		20160614
Tencent		20160614
TotalDefense		20160613
Yandex		20160612

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

File version 3, 3, 8, 1

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2012-01-29 21:32:28

Entry Point 0x000B88B0

Number of sections 3

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

UPX0 4096 479232 0 0.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 483328 274432 273408 7.93 304e0baccbed44e3e266b24d0218b5c2

.rsrc 757760 32768 29184 5.90 b7524582aa5184906490cedccfc92565

Overlays

MD5 261eb87a5e1407da3d2b767f6c49a382

File type data

Offset 303616

Size 55296

Entropy 7.99

PE imports

Number of PE resources by type

RT_ICON 12

RT_STRING 7

RT_GROUP_ICON 4

RT_DIALOG 1

RT_MANIFEST 1

RT_MENU 1

RT_VERSION 1

Number of PE resources by language

ENGLISH UK 25

ENGLISH US 2

PE resources

0d774eac487e6093c266fdd0bb5d4a106f2329cad029c58b40127bac3f1dc07c data

10d8d1d5d34a6d375fe241ef289d303f40e59680b8c33b0307325f03a3f2185e data

3799616d9ad49f5a11e979655bcfb26eba706819a7fe956e53278fc0654752e7 data

3beadf2cf64cbd321f31a554775f7839eebc911a695a7815731f9933cd873a71 data

3ccf11dcaa1cf648671c0a61204699290d3395387097fab1151094d5c4e618b9 data

4c78e116fb08293b0883a8d1fa1a8b58c1c08fbd1c2aa89d1a41951632d18c0e data

5d62d392a0f454a05c957c41003db41c4faabf09156725ca8ce9d6622b22ca71 data

617e134c4e4ab10dc301c468c62390725d3f2c536030128dab2336cbd0629690 data

6e9b3a9d2bda4e4479269bd80dead4e53042616daea5688d3e5da73234c6695b data

6f7343f8d9ab51857d775e2803b608941c89d8e8f7bd372552d79deba5681a28 data

ExifTool file metadata

UninitializedDataSize

479232

LinkerVersion

10.0

ImageVersion

0.0

FileVersionNumber

3.3.8.1

LanguageCode

English (British)

FileFlagsMask

0x0017

CharacterSet

Unicode

InitializedDataSize

32768

EntryPoint

0xb88b0

MIMEType

application/octet-stream

FileVersion

3, 3, 8, 1

TimeStamp

2012:01:29 22:32:28+01:00

FileType

Win32 EXE

PEType

PE32

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

CompiledScript

AutoIt v3 Script: 3, 3, 8, 1

MachineType

Intel 386 or later, and compatibles

CodeSize

274432

FileSubtype

ProductVersionNumber

3.3.8.1

FileTypeExtension

exe

ObjectFileType

Unknown

File identification

MD5 afe2a5435273e6c2a389c9d14c8ceeaf

SHA1 da7abbeda5f22f0528a5bad7b7aef830f6379e6a

SHA256 cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942

ssdeep

6144:sAFELV9WkhHnkpPlxhPG+hxHLjdw/4NzNXn85R7Iuyuy8wFto3xfIYLRjhtUOVdy:sA6bf5Ud3rjdJzxVuy8WohNRfxV

authentihash 664f363399c3a6b47c21abc8ca7889107cbea8a576e2c20a966985cd7387d846

imphash 890e522b31701e079a367b89393329e6

File size 350.5 KB ( 358912 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	AutoIt3 compiled script executable (87.6%) UPX compressed Win32 Executable (5.2%) Win32 EXE Yoda's Crypter (4.5%) Win32 Dynamic Link Library (generic) (1.1%) Win32 Executable (generic) (0.7%)

VirusTotal metadata

First submission 2015-10-13 18:17:34 UTC ( 3 years, 4 months ago )

Last submission 2016-06-14 03:48:58 UTC ( 2 years, 8 months ago )

File names

isheriff_afe2a5435273e6c2a389c9d14c8ceeaf.bin

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942 (successful)

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

\\.\PIPE\wkssvc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\nj.exe (successful)

C:\WINDOWS\system32\netsh.exe (successful)

C:\WINDOWS\system32\xpob2res.dll (successful)

C:\WINDOWS\system32\xpsp2res.dll (successful)

Read files

C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942 (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\nj.exe (successful)

C:\WINDOWS\system32\netsh.exe (successful)

Copied files

SRC: C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe
DST: C:\Documents and Settings\<USER>\Start Menu\Programs\Startup\nj.exe (successful)

Deleted files

C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942 (successful)

Created processes

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe" "del" C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942" (successful)

C:\WINDOWS\system32\netsh.exe C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe" "nj.exe" ENABLE" (successful)

Shell commands

() C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exedel" C:\cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942" [(null)] (successful)

() netshfirewall add allowedprogram C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nj.exe" "nj.exe" ENABLE" [] (successful)

Created mutexes

tempnj.exe (successful)

Opened mutexes

ShimCacheMutex (successful)

Opened service managers

MACHINE: localhost
DATABASE: ServicesActive (successful)

Opened services

NapAgent (successful)

Runtime DLLs

kernel32.dll (successful)

advapi32.dll (successful)

comctl32.dll (successful)

comdlg32.dll (successful)

gdi32.dll (successful)

mpr.dll (successful)

ole32.dll (successful)

oleaut32.dll (successful)

psapi.dll (successful)

shell32.dll (successful)

Additional details

The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.

DNS requests

hattouma12.no-ip.biz (204.95.99.86)

TCP connections

204.95.99.86:1888

SHA256:	cf352976323bd8683e8ec5728eb1282def49fbd4dc58ab5748a2747243177942
File name:	isheriff_afe2a5435273e6c2a389c9d14c8ceeaf.bin
Detection ratio:	41 / 50
Analysis date:	2016-06-14 03:48:58 UTC ( 2 years, 8 months ago )

Ciphered bundle

FileVersionInfo properties

PE header basic information

PE sections

Overlays

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Copied files

Deleted files

Created processes

Shell commands

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

Additional details

DNS requests

TCP connections

Recover your password

Join VirusTotal Community

Sign in