Edit tour
Windows
Analysis Report
2.9.9.2_Setup.exe
Overview
General Information
Detection
Score: | 4 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 40% |
Signatures
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
Analysis Advice
Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox |
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior |
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") |
- System is w10x64
- 2.9.9.2_Setup.exe (PID: 4176 cmdline:
"C:\Users\ user\Deskt op\2.9.9.2 _Setup.exe " MD5: F0E6780D07064D41CCB45735EC99D408) - 2.9.9.2_Setup.tmp (PID: 1516 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-NNN BK.tmp\2.9 .9.2_Setup .tmp" /SL5 ="$2044E,4 6868961,72 1408,C:\Us ers\user\D esktop\2.9 .9.2_Setup .exe" MD5: 84DB4B4205F705DA71471DC6ECC061F5) - StagePlotPro_2.9.9.2_Win.exe (PID: 5952 cmdline:
"C:\Progra m Files (x 86)\StageP lotPro\Sta gePlotPro_ 2.9.9.2_Wi n.exe" MD5: 012374ADF03F852AF607253D39FDCBC8)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
Source: | Static PE information: |
Source: | Window detected: |