Loading... Additional Content is being loaded
Analysis Report Vkdr225E85
Overview
General Information
| Sample Name: | Vkdr225E85 (renamed file extension from none to exe) |
| Analysis ID: | 359443 |
| MD5: | ff932f457521b993feffc92d662166e6 |
| SHA1: | 725cc0c5e1914d3ea02674fa7278ed8b7c4f8b19 |
| SHA256: | ac8dde58d7ead58fa4b474c6627621489fdf362270147bb0e00c1a8678ba3888 |
| Tags: | HawkEye |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
HawkEye MailPassView
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected HawkEye Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM_3
Yara detected HawkEye Keylogger
Yara detected MailPassView
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
AV process strings found (often used to terminate AV products)
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses FTP
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
AV Detection: |
  |
|---|
| Found malware configuration |
| Source: |
Malware Configuration Extractor: |
||
| Multi AV Scanner detection for submitted file |
| Source: |
Metadefender: |
Perma Link | ||
| Source: |
ReversingLabs: |
|||
| Machine Learning detection for sample |
| Source: |
Joe Sandbox ML: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Avira: |
||
| Source: |
Avira: |
||
Compliance: |
|
|---|
| Uses 32bit PE files |
| Source: |
Static PE information: |
||
| Contains modern PE file flags such as dynamic base (ASLR) or NX |
| Source: |
Static PE information: |
||
| Binary contains paths to debug symbols |
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
Spreading: |
|
|---|
| May infect USB drives |
| Source: |
Binary or memory string: |
||
| Source: |
Binary or memory string: |
||
| Source: |
Binary or memory string: |
||
| Source: |
Binary or memory string: |
||
| Source: |
Code function: |
6_2_00406EC3 | |
| Source: |
Code function: |
7_2_00408441 | |
| Source: |
Code function: |
7_2_00407E0E | |
Software Vulnerabilities: |
|
|---|
| Found inlined nop instructions (likely shell or obfuscated code) |
| Source: |
Code function: |
1_2_091BB598 | |
| Source: |
Code function: |
4_2_073F9958 | |
| Source: |
Code function: |
4_2_073F9958 | |
| Source: |
Code function: |
4_2_073FA6B7 | |
| Source: |
Code function: |
4_2_073F26D9 | |
| Source: |
Code function: |
4_2_073FA308 | |
| Source: |
Code function: |
4_2_073FA308 | |
| Source: |
Code function: |
4_2_073FA3F2 | |
| Source: |
Code function: |
4_2_073FA3F2 | |
| Source: |
Code function: |
4_2_073F326B | |
| Source: |
Code function: |
4_2_073FB1A5 | |
| Source: |
Code function: |
4_2_073FB0BB | |
| Source: |
Code function: |
4_2_073F2B99 | |
| Source: |
Code function: |
4_2_073FA9DC | |
| Source: |
Code function: |
4_2_073F2835 | |
| Source: |
Code function: |
4_2_0776039E | |
| Source: |
Code function: |
4_2_07760207 | |
Networking: |
|
|---|
| Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) |
| Source: |
Snort IDS: |
||
| Detected TCP or UDP traffic on non-standard ports |
| Source: |
TCP traffic: |
||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Internet Provider seen in connection with other malware |
| Source: |
ASN Name: |
||
| Uses FTP |
| Source: |
FTP traffic detected: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: |
||
| Source: |
String found in binary or memory: | ||