Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 3

• External Systems
  • Sample was identified as malicious by a large number of Antivirus engines

    details

    11/55 Antivirus vendors marked sample as malicious (20% detection rate)

    source

    External System

    relevance

    10/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    11/55 Antivirus vendors marked sample as malicious (20% detection rate)

    source

    External System

    relevance

    8/10

• Hiding 1 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 9

• Anti-Detection/Stealthyness
  • Queries kernel debugger information

    details

    "<Input Sample>" at 00220453-00002916-77BB61F8-467158

    source

    API Call

    relevance

    6/10

• Anti-Reverse Engineering
  • Creates guarded memory regions (anti-debugging trick to avoid memory dumping)

    details

    Creates guarded memory regions (anti-debugging trick to avoid memory dumping)

    source

    API Call

    relevance

    10/10

  • PE file has unusual entropy sections

    details

    .text with unusual entropies 7.98795884888

    source

    Static Parser

    relevance

    10/10

• Environment Awareness
  • Queries volume information

    details

    "<Input Sample>" queries volume information of "\192.168.56.1\VM12\Dailymotion_Video_Link_Scraper_By_Vinyl_v1.1.exe" at 00220453-00002916-77BB6268-223546

    source

    API Call

    relevance

    2/10

  • Tries to sleep for a long time (more than two minutes)

    details

    "<Input Sample>" sleeping for "1566804069" milliseconds

    source

    API Call

    relevance

    10/10

• General
  • Reads configuration files

    details

    "<Input Sample>" read file "%WINDIR%\win.ini"

    source

    API Call

    relevance

    4/10

• Installation/Persistance
  • Creates/touches files in windows directory

    details

    "<Input Sample>" created file "%WINDIR%\system32\rsaenh.dll"

    source

    API Call

    relevance

    7/10

• Unusual Characteristics
  • Installs hooks/patches the running process

    details

    "<Input Sample>" wrote bytes "448899E0" to virtual address "0x6B3B2AFC" (part of module "CLR.DLL")

    source

    Hook Detection

    relevance

    10/10

  • Reads information about supported languages

    details

    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE", Key: "00000409")
    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN")
    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN")

    source

    Registry Access

    relevance

    3/10

• Informative 5

• General
  • Loads modules at runtime

    details

    "<Input Sample>" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77CB0000
    "<Input Sample>" loaded module "ADVAPI32.DLL" at base 77700000
    "<Input Sample>" loaded module "CRYPTSP.DLL" at base 75740000
    "<Input Sample>" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 754E0000

    source

    API Call

    relevance

    1/10

  • Loads rich edit control libraries

    details

    "<Input Sample>" loaded module "%WINDIR%\system32\RichEd20.DLL" at 68AF0000

    source

    Loaded Module

  • Loads the .NET runtime environment

    details

    "<Input Sample>" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll" at 6A3F0000

    source

    Loaded Module

  • Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)

    details

    "LookupAccountNameLocalW@sechost.dll"
    "EventUnregister@ADVAPI32.dll"
    "LookupAccountSidW@ADVAPI32.dll"
    "LookupAccountSidLocalW@sechost.dll"
    "CryptAcquireContextW@CRYPTSP.dll"
    "CPAcquireContext@rsaenh.dll"

    source

    API Call

    relevance

    1/10

• Installation/Persistance
  • Contains ability to lookup the windows account name

    details

    LookupAccountNameLocalW@SECHOST.DLL at 00220453-00002916-77BD228D-466845

    source

    Hybrid Analysis Technology

    relevance

    5/10

File Sections

File Resources

File Imports

• mscoree.dll

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.