Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'update.exe'

malicious

Threat Score: 100/100 AV Detection: 42% Labeled as: Trojan.Generic

update.exe

This report is generated from a file or URL submitted to this webservice on September 26th 2016 04:56:08 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v5.20 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before Show Similar Samples Request Report Deletion

Incident Response

Risk Assessment

Persistence: Modifies auto-execute functionality by setting/creating a value in the registry
Fingerprint: Reads the active computer name
Reads the cryptographic machine GUID
Spreading: Opens the MountPointManager (often used to detect additional infection locations)

Additional Context

Related Sandbox Artifacts

Associated URLs: hxxp://ticketmart.jp/update.exe
hxxp://amidadou.net/update.exe

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 6
Environment Awareness
- The input sample contains a known anti-VM trick
  
  details
  
  "Found VM detection artifact "CPUID trick" in "1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin" (Offset: 90495)
  
  source
  
  Extracted File
  
  relevance
  
  5/10
External Systems
- Sample was identified as malicious by a large number of Antivirus engines
  
  details
  
  32/57 Antivirus vendors marked sample as malicious (56% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  32/57 Antivirus vendors marked sample as malicious (56% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
Installation/Persistance
- Writes a PE file header to disc
  
  details
  
  "<Input Sample>" wrote 65536 bytes starting with PE header signature to file "%PROGRAMFILES%\D8zVTO.exe": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...
  
  source
  
  API Call
  
  relevance
  
  1/10
Unusual Characteristics
- Entrypoint in PE header is within an uncommon section
  
  details
  
  "1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin" has an entrypoint in section "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  5/10
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Suspicious Indicators 15
Anti-Detection/Stealthyness
- Queries kernel debugger information
  
  details
  
  "<Input Sample>" at 00023286-00003152-00000105-54636994
  
  source
  
  API Call
  
  relevance
  
  6/10
Anti-Reverse Engineering
- PE file has unusual entropy sections
  
  details
  
  UPX1 with unusual entropies 7.90398682856
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- PE file is packed with UPX
  
  details
  
  "1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin" has a section named "UPX0"
  "1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin" has a section named "UPX1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to query CPU information
  
  details
  
  cpuid from 1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Reads the active computer name
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  
  source
  
  Registry Access
  
  relevance
  
  5/10
- Reads the cryptographic machine GUID
  
  details
  
  "<Input Sample>" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
Installation/Persistance
- Drops executable files
  
  details
  
  "D8zVTO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"
  
  source
  
  Extracted File
  
  relevance
  
  10/10
- Modifies auto-execute functionality by setting/creating a value in the registry
  
  details
  
  "<Input Sample>" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN")
  "<Input Sample>" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "ENC"; Value: "%PROGRAMFILES%\D8zVTO.exe")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
System Destruction
- Opens file with deletion access rights
  
  details
  
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\AssetLibrary.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\DocumentRepository.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\MySharePoints.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\MySite.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointPortalSite.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointTeamSite.ico" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\guest.bmp" with delete access
  "<Input Sample>" opened "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\user.bmp" with delete access
  
  source
  
  API Call
  
  relevance
  
  7/10
Unusual Characteristics
- Imports suspicious APIs
  
  details
  
  RegCloseKey
  GetProcAddress
  LoadLibraryA
  VirtualAlloc
  VirtualProtect
  ShellExecuteA
  
  source
  
  Static Parser
  
  relevance
  
  1/10
- Installs hooks/patches the running process
  
  details
  
  "<Input Sample>" wrote bytes "4053077758580877186a0877653c09770000000000bfd5760000000056ccd576000000007ccad57600000000376833756a2c0977d62d097700000000206933750000000029a6d57600000000a48d337500000000f70ed57600000000" to virtual address "0x759A1000" (part of module "NSI.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
- Reads information about supported languages
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
Hiding 3 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Informative 7
Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  SetUnhandledExceptionFilter@KERNEL32.DLL from 1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
General
- Creates a writable file in a temporary directory
  
  details
  
  "<Input Sample>" created file "%TEMP%\encA497.tmp"
  
  source
  
  API Call
  
  relevance
  
  1/10
Installation/Persistance
- Connects to LPC ports
  
  details
  
  "<Input Sample>" connecting to "\ThemeApiPort"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Dropped files
  
  details
  
  "encA497.tmp" has type "PC bitmap Windows 3.x format 128 x 128 x 24"
  "guest.bmp" has type "data"
  "D8zVTO.exe" has type "empty "
  "guest.bmp" has type "empty "
  "user.bmp" has type "empty "
  "SharePointPortalSite.ico" has type "data"
  "DocumentRepository.ico" has type "data"
  "D8zVTO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"
  "MySite.ico" has type "data"
  "user.bmp" has type "data"
  "SharePointTeamSite.ico" has type "data"
  "AssetLibrary.ico" has type "data"
  "MySharePoints.ico" has type "data"
  
  source
  
  Extracted File
  
  relevance
  
  3/10
- Touches files in the Windows directory
  
  details
  
  "<Input Sample>" touched file "%WINDIR%\system32\rsaenh.dll"
  "<Input Sample>" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls"
  "<Input Sample>" touched file "%WINDIR%\sysnative\cmd.exe"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "r, licensed3Dinkumware.Lt"
  Heuristic match: "co,puter.To"
  Heuristic match: "co_puter.To"
  
  source
  
  String
  
  relevance
  
  10/10
System Security
- Opens the Kernel Security Device Driver (KsecDD) of Windows
  
  details
  
  "<Input Sample>" opened "\Device\KsecDD"
  
  source
  
  API Call
  
  relevance
  
  10/10

File Details

All Details:

update.exe

Filename: update.exe
Size: 424KiB (434176 bytes)
Type: peexe executable
Description: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Architecture
: WINDOWS
SHA256
: 1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371
MD5
: f33f662d124288da3d4bee72b81695f9
SHA1
: 2e4753dc9e5d53412bc904a9183b31254f5f4b4d
ssdeep
: 12288:VYq1JXEB4HJtXuxtdVYa5byrJ3k+WENLL4p:dbJ+XOCbytcs
imphash
: 938005788f71b4ebecc890d1890d068f
authentihash
: 6c225426f50bad9212ad6b3988a0732ead1a5da695c5b6cb836423dd693e2b3f
Compiler/Packer
: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

Resources

Language
: JAPANESE
Icon

Visualization

Input File (PortEx)

Classification (TrID)

46.5% (.EXE) UPX compressed Win32 Executable
40.4% (.EXE) Win32 EXE Yoda's Crypter
6.8% (.EXE) Win32 Executable (generic)
3.0% (.EXE) Generic Win/DOS Executable
3.0% (.EXE) DOS Executable Generic

File Sections

Details	Name	Entropy	Virtual Address	Virtual Size	Raw Size	MD5
Name UPX0 Entropy 0 Virtual Address 0x1000 Virtual Size 0x9d000 Raw Size 0x0 MD5 d41d8cd98f00b204e9800998ecf8427e	UPX0	0	0x1000	0x9d000	0x0	d41d8cd98f00b204e9800998ecf8427e
Name UPX1 Entropy 7.90398682856 Virtual Address 0x9e000 Virtual Size 0x3e000 Raw Size 0x3dc00 MD5 ee96c1367cfad0af17c3f54c72eca5ed	UPX1	7.90398682856	0x9e000	0x3e000	0x3dc00	ee96c1367cfad0af17c3f54c72eca5ed
Name .rsrc Entropy 3.80394038404 Virtual Address 0xdc000 Virtual Size 0x2c000 Raw Size 0x2c000 MD5 df065ffacd91181cf46d1961505140da	.rsrc	3.80394038404	0xdc000	0x2c000	0x2c000	df065ffacd91181cf46d1961505140da

File Imports

RegCloseKey

FillRgn

ExitProcess

GetProcAddress

LoadLibraryA

VirtualAlloc

VirtualFree

VirtualProtect

ShellExecuteA

EndPaint

htons (Ordinal #9)

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 1 process in total (System Resource Monitor).

Input Sample (PID: 3152)

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

This report was generated with enabled TOR analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.

Extracted Strings

Download All Memory Strings (1.3KiB)

!!!!._tteutiou!!!!

Ansi based on Image Processing (screen_3.png)

!"#$%&'()*+,

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

!This program cannot be run in DOS mode.$

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

" #

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

"LoGe

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

#B-[\]^_`?Z

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

$<00,4@J$,

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

&S>;$V039

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

''j_J

Ansi based on Image Processing (screen_5.png)

',_0__.

Ansi based on Image Processing (screen_5.png)

'1r%Wr234Wr%W567*Wr%89m

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

'mX^{

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

'u"GZZb^Naddr17

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

( 8PX*700WPE

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

(HPh@?R

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

(null)

Ansi based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

(Press Retry to debug the application - JIT must be enabled)

Unicode based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

)+u|K2p

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

)_,s(.y&9

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

)fabwmodf

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

+&Dr

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

,)_tsp`w:

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

,,_,,__,,,,

Ansi based on Image Processing (screen_0.png)

,.,__,____nENnoN

Ansi based on Image Processing (screen_3.png)

,.,__,___AnENno_

Ansi based on Image Processing (screen_5.png)

,:`L HP0<<,4,pk

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

,e,o,_,_

Ansi based on Image Processing (screen_5.png)

,t;,_;,us

Ansi based on Image Processing (screen_5.png)

-HnotFnsh

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

.;.;._.;

Ansi based on Image Processing (screen_5.png)

.=GenuunD

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

.?AV_Locimp

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

._i__00i'____

Ansi based on Image Processing (screen_3.png)

.ed.G5ha

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

.rsrc

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

.taWt't&Df\

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

/"abcdefghijklmnopqr

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

/pg)([|X>H1

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

0#n8XV?'OPiM

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

0_'__08____

Ansi based on Image Processing (screen_3.png)

0_-ourpersoualr_lesareeucn._teJ.

Ansi based on Image Processing (screen_5.png)

0________0

Ansi based on Image Processing (screen_5.png)

1#IND

Ansi based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

1#INF

Ansi based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

1#QNAN

Ansi based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

1#SNAN

Ansi based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

16LEUNICODE

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

1rrrr2345rrrr6789

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

4B(>B.v4(0D<5?Tp>9

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

5+@8F@Td367C

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

5lAZebx(E$

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

6*L<X`J(;

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

60123456789

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

6il add

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

7LocalTime^opyEW1Y

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

7n3nms

Ansi based on Image Processing (screen_5.png)

9!'(e@#9!

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9$".#8$B%

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

90A8C@DHF

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

99sbntar'

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9DrNsXtbu

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9NhEaC[:s@

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9rDrNsXtbu

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9rJYTZ^[h\

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9rL&V'`(j)

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9SgV8cR8ujYs7ZcK2l38:

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

9ZAdBnCxD

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

:PK<_t<<$t8

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

:tO/%/t<Mi|f

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

; >,?8@#G

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

;P8aM*0B##

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

;PtB+

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

<0@hnh(/ig wfnwv<

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

<:+{OT"Vu

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='requireAdministrator' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

Unicode based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

=\^XJ4]$

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

=D<=n16YY>

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

=J`57?+T;

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

?'F'n\V{_2

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

?^_a,____,

Ansi based on Image Processing (screen_0.png)

?PKCS_PZI)

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

?UnhgdBjp

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

@qCa<

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

\0\D%`

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

\Sessions\1\Windows\ApiPort

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

\ThemeApiPort

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

^8<pay)IfM

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

^`!TDT

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

^evicOst4mcou`

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

_'________

Ansi based on Image Processing (screen_5.png)

_,,,,q,,,_,

Ansi based on Image Processing (screen_0.png)

_,,_____

Ansi based on Image Processing (screen_3.png)

_,.b__c

Ansi based on Image Processing (screen_5.png)

_,00____

Ansi based on Image Processing (screen_0.png)

_,____

Ansi based on Image Processing (screen_5.png)

_,_________,

Ansi based on Image Processing (screen_5.png)

_-our

Ansi based on Image Processing (screen_3.png)

_00____

Ansi based on Image Processing (screen_5.png)

_0__0____

Ansi based on Image Processing (screen_5.png)

_0__0____00__

Ansi based on Image Processing (screen_5.png)

_0__0_____

Ansi based on Image Processing (screen_5.png)

_0_____

Ansi based on Image Processing (screen_5.png)

_0_l___i

Ansi based on Image Processing (screen_3.png)

__,,,0,,_0,,

Ansi based on Image Processing (screen_0.png)

__,_,

Ansi based on Image Processing (screen_0.png)

__,_,0,?____,__,_?__qo__0_0______?_l_____0_,_,_,0?___,

Ansi based on Image Processing (screen_0.png)

__,_____o___00,0__',_00,0,,,

Ansi based on Image Processing (screen_3.png)

__0_0__________

Ansi based on Image Processing (screen_5.png)

__0____

Ansi based on Image Processing (screen_3.png)

___,_,,,

Ansi based on Image Processing (screen_0.png)

_____0____q0____

Ansi based on Image Processing (screen_5.png)

______

Ansi based on Image Processing (screen_5.png)

______0______0_

Ansi based on Image Processing (screen_5.png)

_______

Ansi based on Image Processing (screen_0.png)

________0

Ansi based on Image Processing (screen_5.png)

_________0__

Ansi based on Image Processing (screen_5.png)

__________,_ios

Ansi based on Image Processing (screen_5.png)

_____________

Ansi based on Image Processing (screen_5.png)

___i__

Ansi based on Image Processing (screen_3.png)

__be_

Ansi based on Image Processing (screen_5.png)

__d_.

Ansi based on Image Processing (screen_5.png)

__dL________________p_0__m___________

Ansi based on Image Processing (screen_5.png)

_bicb

Ansi based on Image Processing (screen_3.png)

_eli.

Ansi based on Image Processing (screen_5.png)

_iiES

Ansi based on Image Processing (screen_5.png)

_J@9@rw

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

_raLe?type_

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

_tteut

Ansi based on Image Processing (screen_5.png)

_yill

Ansi based on Image Processing (screen_5.png)

`\??\Volume{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

`\??\Volume{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

`\??\Volume{8177f4e8-b53f-11e4-a9c2-806e6f6e6963}

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

`Lfv4

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

`VC/

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

a9rrrbefgz

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

ADVAPI32.dll

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

AlwaysShowExt

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

ArepApisANSI

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

Assertion failed!

Unicode based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

Assertion failed: %Ts, file %Ts, line %d

Unicode based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

atte_pt

Ansi based on Image Processing (screen_3.png)

Attributes

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

autiiirus

Ansi based on Image Processing (screen_3.png)

AutoCheckSelect

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

ba__e_oeueluDsaa_u_eJJsoeuuJourpse__er_

Ansi based on Image Processing (screen_5.png)

belp_Jcr_le.ht''

Ansi based on Image Processing (screen_3.png)

BI*OIN

Ansi based on Memory/File Scan (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe.bin)

BrowseInPlace

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

c0mputerrmana_9ement

Ansi based on Image Processing (screen_5.png)

%PROGRAMFILES%\D8zVTO.exe

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

%USERPROFILE%\documents\cryptopp563\secblock.h

Unicode based on Hybrid Analysis (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe , 00023286-00003152.00000002.29778.009A0000.00000002.mdmp)

Calculat0r

Ansi based on Image Processing (screen_5.png)

CallForAttributes

Unicode based on Runtime Data (1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe )

Extracted Files

Displaying 10 extracted file(s). The remaining 3 file(s) are available in the full version and XML/JSON reports.

Informative 10
- encA497.tmp
  
  Download Disabled Hash Seen Before
  
  Size
  341KiB (348974 bytes)
  
  Type
  PC bitmap, Windows 3.x format, 128 x 128 x 24
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  f9cdeb671fcea3bb1d167b569143803d
  
  SHA1
  
  9185294b065108ba7de5fc3bdc5d250f70a33fbb
  
  SHA256
  
  4b54ccd8fc1106a1bcb85be257c240bd22c53a4a7d0efc3ca73b37e482cb09c4
- D8zVTO.exe
  
  Download Disabled Hash Seen Before
  
  Size
  424KiB (434176 bytes)
  
  Type
  PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  f33f662d124288da3d4bee72b81695f9
  
  SHA1
  
  2e4753dc9e5d53412bc904a9183b31254f5f4b4d
  
  SHA256
  
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371
- user.bmp
  
  Download Disabled Hash Seen Before
  
  Size
  48KiB (49472 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  3ec6b2b7485c38a5cf37290cf0205a4e
  
  SHA1
  
  ea84dd37b3cda49baf67ed93cdf1ae93fbafecc6
  
  SHA256
  
  5c6c15f740d8ca7fed01796bebe5dba171852ba4c0dc42d0470b170ee73f066e
- SharePointPortalSite.ico
  
  Download Disabled Hash Seen Before
  
  Size
  25KiB (25472 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  098cf8fb5ed8458393a2824348fde122
  
  SHA1
  
  d161cc0dc258ebc3c891000e75d7d9a0a4abf9b5
  
  SHA256
  
  595fb51afb9e2453598170ed604997c6a5c131c2ae23bf1ca707a926931bc201
- DocumentRepository.ico
  
  Download Disabled Hash Seen Before
  
  Size
  25KiB (25472 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  b6b6f27df0d369481815a5d661252ebe
  
  SHA1
  
  a6cbbc5abdd3688e13e88c08dea6f97d22684e0f
  
  SHA256
  
  c4531abc1950c9b0d0eb5e5f3155905b5781088892585195fdc2f901b578ffac
- MySite.ico
  
  Download Disabled Hash Seen Before
  
  Size
  25KiB (25472 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  bcd2e130d8b347fe1d863a82a8a23f80
  
  SHA1
  
  e3550eb378ef2ef45743915f15554e78e5191f5a
  
  SHA256
  
  617d5beb9c709d88581afe64c74f242bc3b9ad17dd8f18457d3c3629f53abaa0
- SharePointTeamSite.ico
  
  Download Disabled Hash Seen Before
  
  Size
  25KiB (25472 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  9009a4517cc20ace40e164c6c6d0c846
  
  SHA1
  
  9a72f243fea7dfa14517aaa096f92ddd45362c1e
  
  SHA256
  
  e97578a5c45bb8eee2948326a0f7cfccb573dd763297cf19011d363bd45ce75b
- AssetLibrary.ico
  
  Download Disabled Hash Seen Before
  
  Size
  5.6KiB (5696 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  4f0346acc58091156561731ad620706a
  
  SHA1
  
  8edc367cc12d3af6bbd08e0dc697a33e485879b9
  
  SHA256
  
  fe8d209e720cce13bddfa27c660b0d89df57cc94152db4cb15b8b91bc5ce920b
- MySharePoints.ico
  
  Download Disabled Hash Seen Before
  
  Size
  341KiB (349232 bytes)
  
  Type
  data
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)
  
  MD5
  
  337e2cc398e3a5728dbd90b31a636ff8
  
  SHA1
  
  b55437584595d11aa85b56e6579fa0f2a0162026
  
  SHA256
  
  5176aeee3aff5b0b05a8c7e4070138b042d94ac2138b1648b1db420829eee7c6
- guest.bmp
  
  Download Disabled
  
  Size
  Unknown (0 bytes)
  
  Type
  empty
  
  Runtime Process
  1e3473ed19a31431a6ac10f2cd2518a02165f06bb4dff47cb89a008d685b5371.exe (PID: 3152)

update.exe

Incident Response

Risk Assessment

Additional Context

Related Sandbox Artifacts

Indicators

Malicious Indicators 6

Suspicious Indicators 15

Informative 7

File Details

update.exe

Resources

Visualization

Classification (TrID)

File Sections

File Imports

Screenshots

Hybrid Analysis

Network Analysis

DNS Requests

Contacted Hosts

HTTP Traffic

Extracted Strings

Extracted Files

Informative 10

encA497.tmp

D8zVTO.exe

user.bmp

SharePointPortalSite.ico

DocumentRepository.ico

MySite.ico

SharePointTeamSite.ico

AssetLibrary.ico

MySharePoints.ico

guest.bmp

Notifications

Runtime

Community

update.exe

Incident Response

Risk Assessment

Additional Context

Related Sandbox Artifacts

Indicators

Malicious Indicators 6

Suspicious Indicators 15

Informative 7

File Details

update.exe

Resources

Visualization

Classification (TrID)

File Sections

File Imports

Screenshots

System Resource Monitor

Hybrid Analysis

Network Analysis

DNS Requests

Contacted Hosts

HTTP Traffic

Extracted Strings

Extracted Files

Informative 10

encA497.tmp

D8zVTO.exe

user.bmp

SharePointPortalSite.ico

DocumentRepository.ico

MySite.ico

SharePointTeamSite.ico

AssetLibrary.ico

MySharePoints.ico

guest.bmp

Notifications

Runtime

Community

Vetting required

Request Report Deletion

Link