Antivirus scan for d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f at 2016-04-11 22:03:26 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Razy.37488	20160411
AegisLab	Troj.W32.Gen.ltlT	20160411
AhnLab-V3	Malware/Gen.Generic	20160411
ALYac	Gen:Variant.Razy.37488	20160411
Antiy-AVL	Trojan/Win32.TSGeneric	20160411
Arcabit	Trojan.Razy.D9270	20160411
Avast	Win32:Malware-gen	20160411
AVG	Crypt5.AVRR	20160411
AVware	Trojan.Win32.Generic!BT	20160411
BitDefender	Gen:Variant.Razy.37488	20160411
Bkav	HW32.Packed.9DB4	20160411
Cyren	W32/Trojan.BTSX-0234	20160411
DrWeb	Trojan.Inject2.19310	20160411
Emsisoft	Gen:Variant.Razy.37488 (B)	20160411
ESET-NOD32	a variant of Win32/Kryptik.ETIW	20160411
F-Prot	W32/S-11ee5b68!Eldorado	20160411
F-Secure	Gen:Variant.Razy.37488	20160411
Fortinet	W32/Dridex.M!tr	20160404
GData	Gen:Variant.Razy.37488	20160411
Ikarus	Trojan.Win32.Crypt	20160411
Kaspersky	HEUR:Trojan.Win32.Generic	20160411
Malwarebytes	Trojan.Dridex	20160411
McAfee	W32/PinkSbot-BS!389A633AA595	20160411
McAfee-GW-Edition	BehavesLike.Win32.Expiro.dc	20160411
Microsoft	Backdoor:Win32/Qakbot.T	20160411
eScan	Gen:Variant.Razy.37488	20160411
NANO-Antivirus	Trojan.Win32.Kryptik.eblpdm	20160411
Panda	Trj/GdSda.A	20160411
Qihoo-360	HEUR/QVM20.1.0000.Malware.Gen	20160411
Rising	PE:Malware.XPACK-LNR/Heur!1.5594 [F]	20160411
Sophos AV	Mal/Qbot-N	20160411
Tencent	Win32.Trojan.Kryptik.Llhq	20160411
TrendMicro	TROJ_GEN.R00YC0DDB16	20160411
VIPRE	Trojan.Win32.Generic!BT	20160411
Alibaba		20160411
Avira (no cloud)		20160411
Baidu		20160411
Baidu-International		20160411
CAT-QuickHeal		20160411
ClamAV		20160408
CMC		20160408
Comodo		20160411
Jiangmin		20160411
K7AntiVirus		20160411
K7GW		20160404
Kingsoft		20160411
nProtect		20160411
SUPERAntiSpyware		20160411
Symantec		20160411
TheHacker		20160411
TotalDefense		20160411
TrendMicro-HouseCall		20160411
VBA32		20160410
ViRobot		20160411
Yandex		20160411
Zillya		20160411
Zoner		20160411

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows command line subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2016-04-06 07:45:51

Entry Point 0x00007150

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 30284 32768 5.75 2e8ac413acf3058c67baed604a6395cd

.data 36864 97276 98304 7.59 0aa3912022e1cbf5a973284a5c2363c3

.edata 135168 108404 110592 7.79 afc01f9df2f260a9c2aa214e816eb03d

INIT 245760 1944 4096 4.65 3aa92d1d7849bb5c1139fa1d6dbe9821

CODE 249856 8436 12288 6.13 ca4e4ccb061e4cf1c70472a0d68ebe3d

PE imports

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows command line

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2016:04:06 08:45:51+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

32768

LinkerVersion

6.0

EntryPoint

0x7150

InitializedDataSize

225280

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

UninitializedDataSize

File identification

MD5 389a633aa5958626d84f637b7b2ac71b

SHA1 4fe8d0e97e94db2468004e0a605d8edc5b9da265

SHA256 d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f

ssdeep

3072:jQ244FNFZmHAOlasRi1ImSwOyMyhTxU/0BRu7jTRySiPdlbN8Oq4Rz2SqPVZPu4y:ck9kH/aWiumSUMyhuVUSiPbrB2SSIJ

authentihash 8c7448300a0da055cb53528a9a6fa1805fd3a2a727928bc0286bff3b0618fcd0

imphash 40a234203b295822bded07c23539f680

File size 256.0 KB ( 262144 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (console) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (43.5%) Win32 Executable (generic) (29.8%) Generic Win/DOS Executable (13.2%) DOS Executable Generic (13.2%)

VirusTotal metadata

First submission 2016-04-11 22:03:26 UTC ( 2 years, 10 months ago )

Last submission 2016-04-11 22:03:26 UTC ( 2 years, 10 months ago )

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

\\.\PIPE\lsarpc (successful)

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegak.dll (successful)

C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\PIPE\samr (successful)

\\.\PIPE\wkssvc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

\\.\MountPointManager (successful)

Read files

C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\cmd.exe (successful)

Written files

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegak.dll (successful)

Copied files

SRC: C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f
DST: C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegaki.exe (successful)

Deleted files

C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\Microsoft\Akiegakik\akiegaki.exe (successful)

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\WINDOWS\\System32\\autoconv.exe" > "C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f" & del /F /Q "C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f"" (successful)

C:\WINDOWS\explorer.exe (successful)

C:\WINDOWS\system32\ping.exe ping.exe -n 6 127.0.0.1 (successful)

Shell commands

((null)) cmd.exe /c ping.exe -n 6 127.0.0.1 & type C:\WINDOWS\\System32\\autoconv.exe" > "C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f" & del /F /Q "C:\d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f"" [(null)] (successful)

Created mutexes

d7bd83b1d90cf748dc7768eb0d5e1c8a (successful)

sswjvoi (successful)

Global\akiegaki (successful)

akiegakia (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

userenv.dll (successful)

shlwapi.dll (successful)

ole32.dll (successful)

shell32.dll (successful)

setupapi.dll (successful)

kernel32.dll (successful)

advapi32.dll (successful)

netapi32.dll (successful)

msvcrt.dll (successful)

wintrust.dll (successful)

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	d7bd83b1d90cf748dc7768eb0d5e1c84f71847a0a4997ade51ddeeb134e7ae8f
File name:	389a633aa5958626d84f637b7b2ac71b
Detection ratio:	34 / 57
Analysis date:	2016-04-11 22:03:26 UTC ( 2 years, 10 months ago ) View latest

Ciphered bundle

PE header basic information

PE sections

PE imports

ExifTool file metadata

File identification

VirusTotal metadata

Leave your comment...

Opened files

Read files

Written files

Copied files

Deleted files

Created processes

Shell commands

Created mutexes

Opened mutexes

Runtime DLLs

UDP communications

Recover your password

Join VirusTotal Community

Sign in