Antivirus scan for e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4 at 2017-09-04 11:20:50 UTC

Antivirus	Result	Update
Avast	FileRepMalware	20170904
AVG	FileRepMalware	20170904
AVware	Trojan-Downloader.Win32.Upatre.tfl (v)	20170904
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20170831
CrowdStrike Falcon (ML)	malicious_confidence_100% (D)	20170804
Cylance	Unsafe	20170904
Endgame	malicious (high confidence)	20170821
Fortinet	W32/GenKryptik.AUKW!tr	20170904
Sophos ML	heuristic	20170822
McAfee-GW-Edition	BehavesLike.Win32.Downloader.gh	20170904
SentinelOne (Static ML)	static engine - malicious	20170806
Symantec	ML.Attribute.HighConfidence	20170904
VIPRE	Trojan-Downloader.Win32.Upatre.tfl (v)	20170904
Webroot	W32.Trojan.Gen	20170904
WhiteArmor	Malware.HighConfidence	20170829
Ad-Aware		20170904
AegisLab		20170904
AhnLab-V3		20170904
Alibaba		20170904
ALYac		20170904
Antiy-AVL		20170904
Arcabit		20170904
Avira (no cloud)		20170904
BitDefender		20170904
Bkav		20170901
CAT-QuickHeal		20170904
ClamAV		20170904
CMC		20170902
Comodo		20170904
Cyren		20170904
DrWeb		20170904
Emsisoft		20170904
ESET-NOD32		20170904
F-Prot		20170904
F-Secure		20170904
GData		20170904
Ikarus		20170904
Jiangmin		20170904
K7AntiVirus		20170904
K7GW		20170904
Kaspersky		20170904
Kingsoft		20170904
Malwarebytes		20170904
MAX		20170904
McAfee		20170904
Microsoft		20170904
eScan		20170904
NANO-Antivirus		20170904
nProtect		20170904
Palo Alto Networks (Known Signatures)		20170904
Panda		20170903
Qihoo-360		20170904
Rising		20170901
Sophos AV		20170904
SUPERAntiSpyware		20170904
Symantec Mobile Insight		20170901
Tencent		20170904
TheHacker		20170904
TotalDefense		20170904
TrendMicro		20170904
TrendMicro-HouseCall		20170904
Trustlook		20170904
VBA32		20170904
ViRobot		20170904
Yandex		20170901
Zillya		20170902
ZoneAlarm by Check Point		20170904
Zoner		20170904

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2015-11-21 14:55:50

Entry Point 0x00004FCB

Number of sections 3

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 33756 33792 6.79 c4ed852e0ff1e3066173b9ea5a4e3266

.data 40960 335296 335360 6.26 d2ca8760987c8289d039a685a5a987ac

.rsrc 376832 132192 132608 6.94 cb84cd5b29796e5b35fff4608dbf48bf

PE imports

Number of PE resources by type

RT_MENU 1

Number of PE resources by language

ENGLISH US 1

PE resources

edc55670ee17acf9d0bba8279dbcf3a46a06695de7693f8ed7b53982985c1617 data

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2015:11:21 15:55:50+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

33792

LinkerVersion

7.1

ImageFileCharacteristics

No relocs, Executable, No line numbers, No symbols, 32-bit

EntryPoint

0x4fcb

InitializedDataSize

467968

SubsystemVersion

4.0

ImageVersion

0.0

OSVersion

4.0

UninitializedDataSize

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

49372efe8a3ce9a4bffe3253be7922da2f291f87223ff6819c9c13f6296357ba

895b7eb99ef814c2ded34f6a56bd082160e02a3043b1fb853cf5bae7c3bf5dcf

ff21844bf7154041eb0f9d38a85a603ee0a27328efd89401e191c9c244aaa232

File identification

MD5 2de164e59aad8b980a3a9fac6a1e3991

SHA1 5d646b6daf59023f4ea38baf7dc5e00017424d94

SHA256 e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4

ssdeep

12288:UajiyXizKWIz9ZQ00c6WdASLhClFz4kT:UajlyK1z9ZjPAIh6zP

authentihash 174d218e5fce5af8d9d6032faf904b2ef8ed95612fea1e60df19472bfc28e1a6

imphash 7e6127f10c815a0c27e140fb7d30586b

File size 491.0 KB ( 502784 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (33.7%) Win64 Executable (generic) (29.8%) Microsoft Visual C++ compiled executable (generic) (17.8%) Win32 Dynamic Link Library (generic) (7.1%) Win32 Executable (generic) (4.8%)

VirusTotal metadata

First submission 2017-09-04 11:20:50 UTC ( 1 year, 7 months ago )

Last submission 2019-03-06 04:02:22 UTC ( 1 month, 2 weeks ago )

File names

execute.exe
ser.png
ser.png
execute.exe
dwdbtsd.exe
VirusShare_2de164e59aad8b980a3a9fac6a1e3991
execute.exe
localfile~
ser.png
dwdbtsd.exe

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\temp031.txt (failed)

C:\e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4 (successful)

C:\Documents (failed)

C:\Documents and (failed)

C:\Documents and Settings\<USER>\Application (failed)

\\.\Ip (successful)

\\.\PIPE\lsarpc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\Tasks\services update.job (failed)

C:\WINDOWS\Tasks\services update.job (successful)

Read files

C:\e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4 (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

client_id (successful)

Written files

C:\WINDOWS\Tasks\services update.job (successful)

client_id (successful)

group_tag (successful)

Copied files

SRC: C:\e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4
DST: C:\Documents and Settings\<USER>\Application Data\winapp\d1dd7b35ae28ab00e0570bdaca4036e38033aa525ca5830ecab24e1ba58b6ee3 (successful)

Created processes

C:\Documents and Settings\<USER>\Application Data\winapp\d1dd7b35ae28ab00e0570bdaca4036e38033aa525ca5830ecab24e1ba58b6ee3 (successful)

Created mutexes

Global\VLock (successful)

Opened mutexes

ShimCacheMutex (successful)

Runtime DLLs

kernel32.dll (successful)

shell32.dll (successful)

ntdll.dll (successful)

shlwapi.dll (successful)

advapi32.dll (successful)

ole32.dll (successful)

oleaut32.dll (successful)

msvcrt.dll (successful)

winhttp.dll (successful)

ws2_32.dll (successful)

HTTP requests

URL: http://ip.anysrc.net/plain/clientip
TYPE: GET
USER AGENT: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36

DNS requests

ip.anysrc.net (37.120.182.208)

TCP connections

37.120.182.208:80

195.62.53.46:443

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	e2ee8c46af39bc11f1680ceada5147f49144bb636db6941fdac35f2ca69c7ff4
File name:	ser.png
Detection ratio:	15 / 65
Analysis date:	2017-09-04 11:20:50 UTC ( 1 year, 7 months ago ) View latest

Ciphered bundle