Antivirus scan for f8744b262be9a94fc28a8f8c455f6a84cf34cc44f976c9c037cafbf6ea9d138b at 2017-02-17 03:01:20 UTC

Antivirus	Result	Update
Ad-Aware	Gen:Variant.Razy.132897	20170217
AegisLab	Troj.Ransom.W32.Zerber!c	20170217
AhnLab-V3	Trojan/Win32.Cerber.C1784797	20170216
ALYac	Gen:Variant.Razy.132897	20170217
Antiy-AVL	Trojan[Ransom]/Win32.Zerber	20170217
Arcabit	Trojan.Razy.D20721	20170217
Avast	Win32:Malware-gen	20170217
AVG	Crypt7.GOR	20170216
Avira (no cloud)	TR/AD.Cerber.raegb	20170216
AVware	Trojan.Win32.Generic!BT	20170216
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20170216
BitDefender	Gen:Variant.Razy.132897	20170216
CrowdStrike Falcon (ML)	malicious_confidence_100% (W)	20170130
Emsisoft	Gen:Variant.Razy.132897 (B)	20170217
Endgame	malicious (high confidence)	20170216
ESET-NOD32	a variant of Win32/Kryptik.FOIR	20170217
F-Secure	Gen:Variant.Razy.132897	20170217
Fortinet	W32/Kryptik.FODX!tr	20170217
GData	Gen:Variant.Razy.132897	20170217
Sophos ML	trojandropper.win32.sality.au	20170203
K7GW	Trojan ( 005051541 )	20170217
Kaspersky	Trojan-Ransom.Win32.Zerber.cegc	20170217
Malwarebytes	Ransom.Cerber	20170217
McAfee	Ransomware-FMJ!088ADBA19E7E	20170217
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.dc	20170216
Microsoft	Trojan:Win32/Dynamer!ac	20170217
eScan	Gen:Variant.Razy.132897	20170217
Panda	Trj/Genetic.gen	20170216
Qihoo-360	Win32/Trojan.Ransom.108	20170217
Rising	Malware.Generic.2!tfe (thunder:2:RPMHuNYptGP)	20170217
Symantec	Packed.Generic.493	20170216
TrendMicro	Possible_Cerber-20	20170217
TrendMicro-HouseCall	Possible_Cerber-20	20170217
VIPRE	Trojan.Win32.Generic!BT	20170217
Alibaba		20170216
CAT-QuickHeal		20170216
ClamAV		20170217
CMC		20170216
Comodo		20170216
Cyren		20170217
DrWeb		20170217
F-Prot		20170217
Ikarus		20170216
Jiangmin		20170217
K7AntiVirus		20170216
Kingsoft		20170217
NANO-Antivirus		20170217
nProtect		20170217
Sophos AV		20170217
SUPERAntiSpyware		20170217
Tencent		20170217
TheHacker		20170215
TotalDefense		20170216
Trustlook		20170217
VBA32		20170216
ViRobot		20170217
Webroot		20170217
WhiteArmor		20170215
Yandex		20170215
Zillya		20170216
Zoner		20170217

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2021-01-27 11:31:12

Entry Point 0x00007029

Number of sections 3

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 250810 250880 7.77 0b8ccf11db58e2c6b9832d67a775bfb3

.data 258048 13473 13824 0.10 5c4b8b0df9f669a75cbd07645e6594e3

.rsrc 274432 8000 8192 5.37 f34e92db8eef16ce398834900746fb7a

Overlays

MD5 ff72bce22bef859fdcad2950ad0bbc15

File type data

Offset 273920

Size 809

Entropy 7.11

PE imports

Number of PE resources by type

RT_MESSAGETABLE 4

OR 1

Number of PE resources by language

NEUTRAL 5

PE resources

08d0b6d99cbdedf12f8fd36cbc718b127b34b06c581e8de219969f52ff0733e8 data

aef54a3045a004d4ba4f7a95a6e21c446a0d5c0817a767154adbafdf7216537d raw G3 data, byte-padded

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Wed Jan 27 11:31:12 2021 251800 34 Bytes

ExifTool file metadata

MIMEType

application/octet-stream

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

FileTypeExtension

exe

TimeStamp

2021:01:27 12:31:12+01:00

FileType

Win32 EXE

PEType

PE32

CodeSize

250880

LinkerVersion

5.5

EntryPoint

0x7029

InitializedDataSize

22016

SubsystemVersion

4.0

ImageVersion

5.1

OSVersion

5.1

UninitializedDataSize

File identification

MD5 088adba19e7e41083b6cf81c0ce6fec8

SHA1 4263145f9934756298687fc47886f95bfa7f0096

SHA256 f8744b262be9a94fc28a8f8c455f6a84cf34cc44f976c9c037cafbf6ea9d138b

ssdeep

6144:ax80T1TWIpJcMWPooe3HifFIDc91q+WRpoVTsyhNnrExaEJB:aG0kIpJcMWwoeGOY1URpghLg

authentihash 1790df73184eb210b69672c67e6b5623edb79307110779c1ff8e9c7e28fcaac5

imphash 8b11f9ba9734618eeafa262705153bf9

File size 268.3 KB ( 274729 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable (generic) (52.9%) Generic Win/DOS Executable (23.5%) DOS Executable Generic (23.5%)

VirusTotal metadata

First submission 2017-02-16 09:33:55 UTC ( 2 years ago )

Last submission 2017-02-16 09:33:55 UTC ( 2 years ago )

File names

066e647b8f2a0f7388a3c23b178d50a03e29a96d

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\f8744b262be9a94fc28a8f8c455f6a84cf34cc44f976c9c037cafbf6ea9d138b (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\fabbc6a1\c573.tmp (failed)

\\.\PIPE\lsarpc (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\fabbc6a1\4ea0.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\fabbc6a1\c573.tmp (successful)

\\.\MountPointManager (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\Documents and Settings\<USER>\Recent\32Bit.lnk (successful)

C:\Documents and Settings\<USER>\Recent\AUTORUN.lnk (successful)

Read files

C:\WINDOWS\system32\rsaenh.dll (successful)

C:\f8744b262be9a94fc28a8f8c455f6a84cf34cc44f976c9c037cafbf6ea9d138b (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\Documents and Settings\<USER>\Recent\32Bit.lnk (successful)

C:\Documents and Settings\<USER>\Recent\CD Drive.lnk (successful)

C:\Documents and Settings\<USER>\Recent\Readme.lnk (successful)

c:\documents and settings\<USER>\cookies\index.dat (successful)

c:\eula.1028.txt (successful)

c:\eula.1033.txt (successful)

c:\python27\include\abstract.h (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\fabbc6a1\4ea0.tmp (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\fabbc6a1\c573.tmp (successful)

C:\WINDOWS\system32\WBEM\Logs\wbemprox.log (successful)

c:\documents and settings\<USER>\cookies\index.dat (successful)

c:\documents and settings\<USER>\cookies\_HELP_HELP_HELP_G6P8Q4YT_.hta (successful)

c:\documents and settings\<USER>\cookies\_HELP_HELP_HELP_WEO1L_.png (successful)

c:\eula.1028.txt (successful)

c:\eula.1033.txt (successful)

c:\python27\include\abstract.h (successful)

c:\python27\include\bytes_methods.h (successful)

Moved files

SRC: c:\documents and settings\<USER>\cookies\index.dat
DST: c:\documents and settings\<USER>\cookies\8ka-5FzfKw.9ca1 (successful)

SRC: c:\eula.1028.txt
DST: c:\mDApRdCQQP.9ca1 (successful)

SRC: c:\eula.1031.txt
DST: c:\ERfAQJyjl4.9ca1 (successful)

SRC: c:\eula.1033.txt
DST: c:\GiClaXs5Pn.9ca1 (successful)

SRC: c:\eula.1036.txt
DST: c:\XU7Vst9eM0.9ca1 (successful)

SRC: c:\eula.1040.txt
DST: c:\-uXpZym8c2.9ca1 (successful)

SRC: c:\eula.1042.txt
DST: c:\BLf-KaGupB.9ca1 (successful)

SRC: c:\eula.2052.txt
DST: c:\I3qs4QhGkZ.9ca1 (successful)

SRC: c:\eula.3082.txt
DST: c:\vctg3uwc1Z.9ca1 (successful)

SRC: c:\python27\include\abstract.h
DST: c:\python27\include\meeEzobNaF.9ca1 (successful)

Created processes

C:\WINDOWS\system32\mshta.exe C:\WINDOWS\system32\mshta.exe" "c:\documents and settings\<USER>\desktop\_HELP_HELP_HELP_99KJNW_.hta" " (successful)

C:\WINDOWS\system32\rundll32.exe rundll32.exe" C:\WINDOWS\system32\shimgvw.dll (successful)

Shell commands

(open) c:\documents and settings\<USER>\desktop\_HELP_HELP_HELP_99KJNW_.hta(null) [c:\documents and settings\<USER>\desktop] (successful)

(open) c:\documents and settings\<USER>\desktop\_HELP_HELP_HELP_KE5QH_.png(null) [c:\documents and settings\<USER>\desktop] (successful)

Code injections in the following processes

rundll32.exe (successful)

Created mutexes

shell.{68499996-A8AE-CB84-6152-55EC191E7C03} (successful)

HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_Voices_Tokens_MSSam_Mutex (successful)

HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_PhoneConverters_Tokens_Chinese_Mutex (successful)

HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_PhoneConverters_Tokens_English_Mutex (successful)

HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_PhoneConverters_Tokens_Japanese_Mutex (successful)

HKEY_CURRENT_USER_SOFTWARE_Microsoft_Speech_CurrentUserLexicon_Mutex (successful)

30F1B4D6-EEDA-11d2-9C23-00C04F8EF87C (successful)

{7E1D1894-F207-481D-8314-E836A706B8EB} (successful)

{2784FF6C-F335-470F-8752-3D1B0DC05664} (successful)

HKEY_LOCAL_MACHINE_SOFTWARE_Microsoft_Speech_Voices_Tokens_MSSam_Lex_Mutex (successful)

Opened mutexes

ShimCacheMutex (successful)

Searched windows

CLASS: HTML Application Host Window Class
NAME: (null)

CLASS: ShImgVw:CPreviewWnd
NAME: (null)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

WebClient (successful)

AudioSrv (successful)

Runtime DLLs

asycfilt.dll (successful)

gqycfilt.dll (failed)

rsaenh.dll (successful)

rpcrt4.dll (successful)

c:\windows\system32\mswsock.dll (successful)

hnetcfg.dll (successful)

c:\windows\system32\wshtcpip.dll (successful)

ws2_32.dll (successful)

ole32.dll (successful)

setupapi.dll (successful)

UDP communications

<MACHINE_DNS_SERVER>:53

91.119.56.0:6892

91.119.56.1:6892

91.119.56.2:6892

91.119.56.3:6892

91.119.56.4:6892

91.119.56.5:6892

91.119.56.6:6892

91.119.56.7:6892

91.119.56.8:6892

SHA256:	f8744b262be9a94fc28a8f8c455f6a84cf34cc44f976c9c037cafbf6ea9d138b
File name:	066e647b8f2a0f7388a3c23b178d50a03e29a96d
Detection ratio:	34 / 58
Analysis date:	2017-02-17 03:01:20 UTC ( 2 years ago )

Ciphered bundle