Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
86F2TnbNbZ.exe

Overview

General Information

Sample Name:86F2TnbNbZ.exe
Analysis ID:778223
MD5:0afec5fd7d329ba440836f797ed7e13b
SHA1:8be9f8a277581544c23fca3333e9f7c3bf293543
SHA256:223632c54414dc81cf566d05df729381e0a9dba4b68a4452eeb9b41239b87213
Tags:exe
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: C000007B

Detection

Score:21
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Machine Learning detection for sample
PE file overlay found
Uses 32bit PE files
PE file does not import any functions

Classification

No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: 86F2TnbNbZ.exeJoe Sandbox ML: detected
Source: 86F2TnbNbZ.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 86F2TnbNbZ.exeString found in binary or memory: http://pv.sohu.com/cityjson
Source: 86F2TnbNbZ.exeString found in binary or memory: http://www.ip138.com
Source: 86F2TnbNbZ.exeStatic PE information: Data appended to the last section found
Source: 86F2TnbNbZ.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 86F2TnbNbZ.exeStatic PE information: No import functions for PE file found
Source: 86F2TnbNbZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engineClassification label: sus21.winEXE@0/0@0/0
Source: 86F2TnbNbZ.exeStatic file information: File size 2891522 > 1048576
Source: 86F2TnbNbZ.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: 86F2TnbNbZ.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x2ae000
Source: 86F2TnbNbZ.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x928000
No Mitre Att&ck techniques found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
SourceDetectionScannerLabelLink
86F2TnbNbZ.exe100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://pv.sohu.com/cityjson86F2TnbNbZ.exefalse
    high
    http://www.ip138.com86F2TnbNbZ.exefalse
      high
      No contacted IP infos
      Joe Sandbox Version:36.0.0 Rainbow Opal
      Analysis ID:778223
      Start date and time:2023-01-05 08:19:09 +01:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 3m 2s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:86F2TnbNbZ.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:0
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:SUS
      Classification:sus21.winEXE@0/0@0/0
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Unable to launch sample, stop analysis
      • No process behavior to analyse as no analysis process or sample was found
      • Corrupt sample or wrongly selected analyzer. Details: C000007B
      • VT rate limit hit for: 86F2TnbNbZ.exe
      No simulations
      No context
      No context
      No context
      No context
      No context
      No created / dropped files found
      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):6.335202546486484
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.39%
      • UPX compressed Win32 Executable (30571/9) 0.30%
      • Win32 EXE Yoda's Crypter (26571/9) 0.26%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      File name:86F2TnbNbZ.exe
      File size:2891522
      MD5:0afec5fd7d329ba440836f797ed7e13b
      SHA1:8be9f8a277581544c23fca3333e9f7c3bf293543
      SHA256:223632c54414dc81cf566d05df729381e0a9dba4b68a4452eeb9b41239b87213
      SHA512:671b067bd91b1549b193e195ec6f76e0d5cb1f414fddd1189cf44e3fa94aed7937e0864746fd3a0008854fb2123bd088690014839ed4d854d2aaa964004ce382
      SSDEEP:49152:vqjBav1PcM+GNl3Zwqd5BJTAoebNDqUuKs6lG4ajAkvieqFlL:MmZwQ5AoexDqUuKflG4ajvvieqFd
      TLSH:77D52923E042C0A1C6592BF272B157386DB89BF66875899BEBF0CC71FD22532D76610D
      File Content Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...6...P...6..._..."...V.......u..._...X..._...........u...;...{...Y...[.......Z...o.......o...................w..
      Icon Hash:00828e8e8686b000
      Entrypoint:0x6665ae
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      DLL Characteristics:
      Time Stamp:0x63839AAB [Sun Nov 27 17:13:15 2022 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:
      Instruction
      push ebp
      mov ebp, esp
      push FFFFFFFFh
      push 00FC2290h
      push 00669994h
      mov eax, dword ptr fs:[00000000h]
      push eax
      mov dword ptr fs:[00000000h], esp
      sub esp, 58h
      push ebx
      push esi
      push edi
      mov dword ptr [ebp-18h], esp
      call dword ptr [006AF20Ch]
      xor edx, edx
      mov dl, ah
      mov dword ptr [011334ECh], edx
      mov ecx, eax
      and ecx, 000000FFh
      mov dword ptr [011334E8h], ecx
      shl ecx, 08h
      add ecx, edx
      mov dword ptr [011334E4h], ecx
      shr eax, 10h
      mov dword ptr [011334E0h], eax
      push 00000001h
      call 00007FBB9CA168EFh
      pop ecx
      test eax, eax
      jne 00007FBB9CA0FF8Ah
      push 0000001Ch
      call 00007FBB9CA10048h
      pop ecx
      call 00007FBB9CA165FAh
      test eax, eax
      jne 00007FBB9CA0FF8Ah
      push 00000010h
      call 00007FBB9CA10037h
      pop ecx
      xor esi, esi
      mov dword ptr [ebp-04h], esi
      call 00007FBB9CA16428h
      call dword ptr [006AF48Ch]
      mov dword ptr [01140EC4h], eax
      call 00007FBB9CA162E6h
      mov dword ptr [01133458h], eax
      call 00007FBB9CA1608Fh
      call 00007FBB9CA15FD1h
      call 00007FBB9CA14211h
      mov dword ptr [ebp-30h], esi
      lea eax, dword ptr [ebp-5Ch]
      push eax
      call dword ptr [006AF2D0h]
      call 00007FBB9CA15F62h
      mov dword ptr [ebp-64h], eax
      test byte ptr [ebp-30h], 00000001h
      je 00007FBB9CA0FF88h
      movzx eax, word ptr [ebp+00h]
      Programming Language:
      • [C++] VS98 (6.0) SP6 build 8804
      • [ C ] VS98 (6.0) SP6 build 8804
      • [C++] VS98 (6.0) build 8168
      • [ C ] VS98 (6.0) build 8168
      • [EXP] VC++ 6.0 SP5 build 8804
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xbd37c00x190.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0xd420000xc988.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x2af0000x940.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x2ad2e20x2ae000unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .rdata0x2af0000x9276e80x928000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0xbd70000x16a4220xd2000False0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .rsrc0xd420000xc9880xd000False0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      No network behavior found
      No statistics
      No system behavior
      No disassembly