Antivirus scan for e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d at 2018-04-19 15:26:39 UTC

Antivirus	Result	Update
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20180419
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20170201
Cylance	Unsafe	20180419
Endgame	malicious (high confidence)	20180402
ESET-NOD32	a variant of Win32/Kryptik.GFVP	20180419
Fortinet	W32/Kryptik.GCVH!tr	20180419
Qihoo-360	HEUR/QVM19.1.9BDD.Malware.Gen	20180419
SentinelOne (Static ML)	static engine - malicious	20180225
Sophos AV	Mal/Elenoocka-E	20180419
Ad-Aware		20180419
AegisLab		20180419
AhnLab-V3		20180419
Alibaba		20180420
ALYac		20180419
Antiy-AVL		20180418
Arcabit		20180419
Avast		20180419
Avast-Mobile		20180419
AVG		20180419
Avira (no cloud)		20180419
AVware		20180419
Babable		20180406
BitDefender		20180419
Bkav		20180410
CAT-QuickHeal		20180418
ClamAV		20180419
CMC		20180419
Comodo		20180419
Cybereason		20180225
Cyren		20180419
DrWeb		20180419
eGambit		20180419
Emsisoft		20180419
F-Prot		20180419
F-Secure		20180419
GData		20180419
Ikarus		20180419
Sophos ML		20180120
Jiangmin		20180419
K7AntiVirus		20180419
K7GW		20180419
Kaspersky		20180419
Kingsoft		20180419
Malwarebytes		20180419
MAX		20180419
McAfee		20180419
McAfee-GW-Edition		20180419
Microsoft		20180419
eScan		20180419
NANO-Antivirus		20180419
nProtect		20180419
Palo Alto Networks (Known Signatures)		20180419
Panda		20180419
Rising		20180419
SUPERAntiSpyware		20180419
Symantec		20180419
Symantec Mobile Insight		20180418
Tencent		20180419
TheHacker		20180415
TotalDefense		20180419
TrendMicro		20180419
TrendMicro-HouseCall		20180419
Trustlook		20180419
VBA32		20180419
VIPRE		20180419
ViRobot		20180419
Webroot		20180419
Yandex		20180419
Zillya		20180419
ZoneAlarm by Check Point		20180419
Zoner		20180418

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2015-04-17 18:24:07

Entry Point 0x00006E17

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 38692 38912 4.08 05396c455fe215e4b664301cb8d63fe1

.xml 45056 2180 2560 6.77 03512b27ad17c524f07b73f09e822eb6

.data 49152 1270 1536 4.39 92d572693cb15302c323e26db8c9b4ba

.rsrc 53248 341079 341504 6.93 e3e29440f61f7d2d0cbc5d447d1e7ca2

Overlays

MD5 5a1081e05193ed8272504dad2518c8c4

File type data

Offset 385536

Size 7880

Entropy 7.50

PE imports

PE exports

bert

vefd

Number of PE resources by type

RT_ICON 9

Struct(18) 2

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 10

NEUTRAL 2

PE resources

38ccb1ec442427754e242c36d879bcef601eff64ee45990205d95135420bcfdc data

51ceece3e327d5489aca29e4fe7dcbc72bb591b282732f5725b58fc979e63f3a data

5465279a42ff3898e814a7ffa952d340c9b7db6914ad599759bccda049894955 raw G3 data, byte-padded

787f5f08893ac7d913e22f8e37781d55bf5d8bc98b97cd7bf25f0074cedcfb0f data

83bc5a5464a88f9b7f18a2e1405a7c9eb2a296df33e2969c9a2e08a3a67a2793 data

8da81c7643bc22256239b252653057e6c541eb897092135e704b219d02ebe1fe data

9dc2812ddf7492ef3b4cbfdea126e0cd292380dc2e36dbd2b09247f6d00e8416 data

aa1d37841538726c4c40e108e365e9257a106c96f4ee519dd639f5c5d4a83b34 data

b181894ee02377c3294959c754eb1d9162dab12c17c020c4e3cff9b9a31feae0 data

c88d8bdddb1ff8e2ded494dbf7644f024178745d6ff645946c09fe8a9e5f7b10 data

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

TimeStamp

2015:04:17 19:24:07+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

38912

LinkerVersion

6.0

ImageFileCharacteristics

No relocs, Executable, No line numbers, No symbols, 32-bit, No debug

FileTypeExtension

exe

InitializedDataSize

344064

SubsystemVersion

4.0

EntryPoint

0x6e17

OSVersion

4.0

ImageVersion

0.0

UninitializedDataSize

File identification

MD5 937f215fb6a74a12df281bc14988d9a4

SHA1 faf3b1e6655eed1cd3667370aca1d71efc11109c

SHA256 e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d

ssdeep

6144:eNZmQ/kIIEsurmEZlzlF11ayaOb1JtS2RS1Wdq:VokIIRkZlH11VaObVS0u0

authentihash 9fcd92d900cb8652f34264646faeafb3e2a30b7a735a0d7026a76f04d8ee67c2

imphash 7bbae4121ffe0a74bf361105e4993e0b

File size 384.2 KB ( 393416 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Dynamic Link Library (generic) (34.2%) Win32 Executable (generic) (23.4%) Win16/32 Executable Delphi generic (10.7%) OS/2 Executable (generic) (10.5%) Generic Win/DOS Executable (10.4%)

VirusTotal metadata

First submission 2018-04-19 15:26:39 UTC ( 10 months ago )

Last submission 2018-04-20 00:08:04 UTC ( 10 months ago )

File names

E89G.tmp.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\Ip (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\Tasks\MsNetValidator.job (failed)

C:\WINDOWS\Tasks\MsNetValidator.job (successful)

client_id (failed)

Read files

C:\e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

data (successful)

Written files

C:\WINDOWS\Tasks\MsNetValidator.job (successful)

data (successful)

file (successful)

Copied files

SRC: C:\e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d
DST: C:\Documents and Settings\<USER>\Application Data\NetDefender\e14fd9204439089ebec2d3ee294af46092b69b31793239a77149433e84f9ab4d (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\NetDefender\e14fd9204439089ebec2d3ee294af46092b69b31793239a77149433e84f9ab4d (successful)

Created mutexes

D8F153864E1832960 (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

kernel32.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

shlwapi.dll (successful)

advapi32.dll (successful)

ole32.dll (successful)

user32.dll (successful)

oleaut32.dll (successful)

msvcrt.dll (successful)

winhttp.dll (successful)

HTTP requests

URL: http://ipecho.net/plain
TYPE: GET
USER AGENT: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0

DNS requests

ipecho.net (146.255.36.1)

TCP connections

146.255.36.1:80

137.74.151.148:443

62.109.26.208:443

SHA256:	e14fd9204439079ebec2d3ee284af45092b58b31693239a66148433e74f8ab4d
File name:	E89G.tmp.exe
Detection ratio:	9 / 69
Analysis date:	2018-04-19 15:26:39 UTC ( 10 months ago ) View latest

Ciphered bundle