Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

inquiry.pdf.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.668579935043723
Filename:	inquiry.pdf.exe
Filesize:	686592
MD5:	6236e43da1b2c6279760e6b2b7e2d40f
SHA1:	a24221417ff9c0d169bf17b7f242824fe61d3b72
SHA256:	b4056e17199edd889d2b77c02865136c47ab29566717c2f86ae8911c02e2994a
SHA512:	88c121e4bb4274c71e6b9989ed4729f6a970cd5fdd28e08cec99d7b3fbdcdcf11884f1815a69fb91ffd425ff633ae731686bb6d2b1e715a7d3d575612ee679cd
SSDEEP:	12288:1DSdV3qBgQeAnkclIfVfhWQBIJ0bnaQZPyIlEnuHCW:sdV3HQeAnN+F3FbEu
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.9N..............P..n............... ........@.. ....................................`................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Masquerading
Antivirus / Scanner detection for submitted sample	AV Detection
Contains functionality to hide user accounts	Hooking and other Techniques for Hiding and Protection	Hidden Users
Machine Learning detection for sample	AV Detection
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Uses 32bit PE files	Compliance, System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Enables debug privileges	Anti Debugging
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities	Obfuscated Files or Information
Installs a raw input device (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sample file is different than original file name gathered from version info	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Sample is known by Antivirus	System Summary
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Masquerading Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
SQL strings found in memory and binary data	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
URLs found in memory or binary data	Networking
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Reads the hosts file	System Summary	Remote System Discovery
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inquiry.pdf.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\inquiry.pdf.exe.log
Category:	dropped
Dump:	inquiry.pdf.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\inquiry.pdf.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.355304211458859
Encrypted:	false
Ssdeep:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
Size:	1216
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe
Category:	dropped
Dump:	jhFFFffkl.exe.18.dr
ID:	dr_7
Target ID:	18
Process:	C:\Users\user\AppData\Roaming\glonkjhg.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	4.369296705546591
Encrypted:	false
Ssdeep:	768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
Size:	78336
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Machine Learning detection for dropped file	AV Detection
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\glonkjhg.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\glonkjhg.exe
Category:	dropped
Dump:	glonkjhg.exe.13.dr
ID:	dr_3
Target ID:	13
Process:	C:\Windows\SysWOW64\cmd.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.668579935043723
Encrypted:	false
Ssdeep:	12288:1DSdV3qBgQeAnkclIfVfhWQBIJ0bnaQZPyIlEnuHCW:sdV3HQeAnN+F3FbEu
Size:	686592
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Access Token Manipulation
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Uses reg.exe to modify the Windows registry	System Summary	Modify Registry
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads the hosts file	System Summary	Remote System Discovery
Spawns processes	System Summary	Process Injection
Uses an in-process (OLE) Automation server	System Summary

C:\Users\user\AppData\Roaming\glonkjhg.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Roaming\glonkjhg.exe:Zone.Identifier
Category:	modified
Dump:	glonkjhg.exe_Zone.Identifier.13.dr
ID:	dr_2
Target ID:	13
Process:	C:\Windows\SysWOW64\cmd.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Hides that the sample has been downloaded from the Internet (zone.identifier)	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for dropped file	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Access Token Manipulation
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads the hosts file	System Summary	Remote System Discovery
Spawns processes	System Summary	Process Injection
Uses an in-process (OLE) Automation server	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jhFFFffkl.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jhFFFffkl.exe.log
Category:	dropped
Dump:	jhFFFffkl.exe.log.23.dr
ID:	dr_8
Target ID:	23
Process:	C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.343186145897752
Encrypted:	false
Ssdeep:	24:ML9E4Ks2eE4O1lEE4UVwPKDE4KhK3VZ9pKhuE4IWUAE4KI6no84j:MxHKXeHKlEHU0YHKhQnouHIW7HKjovj
Size:	1362
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\jhFFFffkl.txt

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\jhFFFffkl.txt
Category:	dropped
Dump:	jhFFFffkl.txt.18.dr
ID:	dr_6
Target ID:	18
Process:	C:\Users\user\AppData\Roaming\glonkjhg.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.780272863587716
Encrypted:	false
Ssdeep:	3:nvm1WXp5cViEaKC5R61C1:vIWXp+NaZ5R6I1
Size:	54
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

\Device\Null

ASCII text, with CRLF line terminators

dropped

Details

File:	\Device\Null
Category:	dropped
Dump:	Null.17.dr
ID:	dr_5
Target ID:	17
Process:	C:\Windows\SysWOW64\PING.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.849820620027152
Encrypted:	false
Ssdeep:	12:PKMRJpTeTeTeTeTeTeTeTeTeTeTeT0sQpAFSkIrxMVlmJHaVzvv:/JdAokItULVDv
Size:	823
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\inquiry.pdf.exe

C:\Windows\SysWOW64\cmd.exe

cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe,

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 7

C:\Windows\SysWOW64\cmd.exe

cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\user\Desktop\inquiry.pdf.exe" "C:\Users\user\AppData\Roaming\glonkjhg.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\user\AppData\Roaming\glonkjhg.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 12

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe,"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 12

C:\Users\user\AppData\Roaming\glonkjhg.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe

"C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe"

C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe

"C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe"

C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe

"C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe"

C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe

"C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

There are 6 hidden processes, click here to show them.

URLs

Name

Malicious

hannoyputa.giize.com

http://www.fontbureau.com/designersG

unknown

http://www.founder.com.cn/cnQ

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.carterandcone.comize

unknown

http://www.founder.com.cn/cn/bThe

unknown

http://www.fontbureau.com/designers?

unknown

http://www.founder.com.cn/cnT

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://www.fontbureau.com/designersZ

unknown

http://www.goodfont.co.kr

unknown

http://www.carterandcone.com

unknown

http://www.fontbureau.comrz

unknown

http://www.sajatypeworks.com

unknown

http://www.fontbureau.com/designers/frere-jones.html4j-

unknown

http://www.founder.com.cn/cnt-b

unknown

http://www.typography.netD

unknown

https://www.google.com

unknown

http://www.fontbureau.comony/O

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.jiyu-kobo.co.jp/Y0f

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
inquiry.pdf.exe

Files

Processes

URLs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportinquiry.pdf.exe

Files

Processes

URLs

IOC Report
inquiry.pdf.exe