Antivirus scan for df3851ca63e57649eb222075ad067df676a009642948ba6a3d59134e31020e9b at 2018-07-19 06:29:37 UTC

Antivirus	Result	Update
AegisLab	Ml.Attribute.Gen!c	20180719
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9872	20180717
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20180530
Cybereason	malicious.e6ae74	20180225
Cylance	Unsafe	20180719
Endgame	malicious (high confidence)	20180711
Fortinet	W32/Kryptik.GIVD!tr	20180719
Sophos ML	heuristic	20180717
Kaspersky	UDS:DangerousObject.Multi.Generic	20180719
McAfee	Artemis!36B5914EB1B8	20180719
McAfee-GW-Edition	BehavesLike.Win32.Generic.dm	20180719
Palo Alto Networks (Known Signatures)	generic.ml	20180719
Qihoo-360	HEUR/QVM20.1.9963.Malware.Gen	20180719
Rising	Trojan.Emotet!8.B95 (TFE:dGZlOgFH7BQRi+Js0g)	20180719
SentinelOne (Static ML)	static engine - malicious	20180701
Symantec	ML.Attribute.HighConfidence	20180718
TrendMicro-HouseCall	Suspicious_GEN.F47V0719	20180719
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20180719
Ad-Aware		20180719
AhnLab-V3		20180719
Alibaba		20180713
ALYac		20180719
Antiy-AVL		20180719
Arcabit		20180719
Avast		20180719
Avast-Mobile		20180718
AVG		20180719
Avira (no cloud)		20180718
AVware		20180719
Babable		20180406
BitDefender		20180719
Bkav		20180718
CAT-QuickHeal		20180718
ClamAV		20180719
CMC		20180719
Comodo		20180719
Cyren		20180719
DrWeb		20180719
eGambit		20180719
Emsisoft		20180719
ESET-NOD32		20180719
F-Prot		20180719
F-Secure		20180719
GData		20180719
Ikarus		20180718
Jiangmin		20180719
K7AntiVirus		20180719
K7GW		20180718
Kingsoft		20180719
Malwarebytes		20180719
MAX		20180719
Microsoft		20180719
eScan		20180719
NANO-Antivirus		20180719
Panda		20180718
Sophos AV		20180719
SUPERAntiSpyware		20180719
TACHYON		20180719
Tencent		20180719
TheHacker		20180719
TrendMicro		20180719
Trustlook		20180719
VBA32		20180718
VIPRE		20180719
ViRobot		20180719
Webroot		20180719
Yandex		20180717
Zoner		20180718

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-09-30 17:12:08

Entry Point 0x00001809

Number of sections 7

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 9894 10240 6.12 17d52ab29ac22c5cf0a662f43cbd5a45

.rdata 16384 13062 13312 4.28 ba9b83f9bfa1cfb4e51f50b9da956dca

.data 32768 115068 111104 1.61 78dbd5af8390608f265035e69e149660

CODE 151552 85797 86016 7.49 e2de726d8c2bff8e3c48485a980a26eb

.CRT 237568 40376 40448 7.53 a65e524c203fb15b25b76f6a76a9e83e

.rsrc 278528 15992 16384 3.85 4389fd8402ed9ec8321dd4a07b84ba20

.reloc 294912 4848 5120 5.84 c4ee453ce6b088776be5691b8028ceb4

PE imports

[+] GDI32.dll

[+] KERNEL32.dll

[+] USER32.dll

Number of PE resources by type

RT_BITMAP 16

RT_STRING 16

RT_DIALOG 1

Number of PE resources by language

NEUTRAL 32

CHINESE SIMPLIFIED 1

PE resources

0d3137dd56cde6d3d1fd0a6e4aa514928ce0eb20cd0a43fdb18ab8cd0bf63b9f ASCII text

0f5248f16fe2b1e73aa9be760a6f0bef933dc09e3cc6d8a8958eae1ce0bd0f97 data

1393255f51eb7f6ba1846c66ef93761f14661368eba6f110d2e34903e3653d2e ASCII text

17b07efdaa0a29047984ccc097bbbe258ffcb76dad8ea803f14e5473ec77791c ASCII text

2cb60d7d674640457497f54b82b42afaa8a2cbd7c28a1aae35f128b4471cfaaa data

2eb32b22864492284e8e79498562d10f3ea89ea7bda27ee58b7960e8810e8ce8 ASCII text

369c5223029ea6d1b17b7f24a8d84c10f528457e79be3349a6c55efd0e8f0e02 ASCII text

3a0969803f248355c08a55fb93099ab7616142cd95b50750d3d0fb461e319448 ASCII text

3cf8dd24fcb6e2b44ee8af90436ccf5ff6876969031ee19d62ca7b6040b9675a ASCII text

4a217ca811d9c29363ead1d67b7ffa0f6e8b8e1d1a068730f4f7d557c3710b44 data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_UNKNOWN (0) Thu Jan 1 00:00:00 1970 0 0 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2009:09:30 18:12:08+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

10240

LinkerVersion

14.0

ImageFileCharacteristics

Executable, 32-bit

EntryPoint

0x1809

InitializedDataSize

276480

SubsystemVersion

5.1

ImageVersion

0.0

OSVersion

5.0

UninitializedDataSize

File identification

MD5 36b5914eb1b83306d60ddb9c8274289f

SHA1 e8042e2e6ae7471cd087b2241c8cca9e8a64685a

SHA256 df3851ca63e57649eb222075ad067df676a009642948ba6a3d59134e31020e9b

ssdeep

3072:UsYve5IluQDyanrkCU53XbickN0mPyE4VMR/vO/B02OEuovfz77RW92Lh:UsMe5I8TahNz6E4ye/ySP7RX

authentihash 786ea851cbf4d72629a20d79496f99bf557f36d0d9f030c9e564d09fdc6a17f6

imphash 2686b3c169559506ddae82d89c34f54c

File size 277.0 KB ( 283648 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (38.4%) Win32 Executable (generic) (26.3%) OS/2 Executable (generic) (11.8%) Generic Win/DOS Executable (11.6%) DOS Executable Generic (11.6%)

VirusTotal metadata

First submission 2018-07-19 02:12:53 UTC ( 7 months, 1 week ago )

Last submission 2018-10-27 20:51:23 UTC ( 3 months, 4 weeks ago )

File names

36b5914eb1b83306d60ddb9c8274289f.vir

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\df3851ca63e57649eb222075ad067df676a009642948ba6a3d59134e31020e9b (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\system32\winsock.dll (successful)

C:\WINDOWS\system32\drwtsn32.exe (successful)

C:\WINDOWS\system32\netmsg.dll (successful)

Read files

C:\WINDOWS\system32\winsock.dll (successful)

Created processes

C:\WINDOWS\system32\drwtsn32 -p 1188 -e 168 -g (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

rpcrt4.dll (successful)

shlwapi.dll (successful)

version.dll (successful)

shell32.dll (successful)

advapi32.dll (successful)

ntdll.dll (successful)

kernel32.dll (successful)

SHA256:	df3851ca63e57649eb222075ad067df676a009642948ba6a3d59134e31020e9b
File name:	df3851ca63e57649eb222075ad067df676a009642948ba6a3d59134e31020e9b
Detection ratio:	18 / 67
Analysis date:	2018-07-19 06:29:37 UTC ( 7 months, 1 week ago ) View latest

Ciphered bundle