Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:780213
MD5:c7ec81f0acc9c8e034bc2d512942d044
SHA1:2cf635fcefa8db2f78e522634c5eb30bae2bd96e
SHA256:b4bbed50c840856520738aeb28649e34d9b017761d679530f7aaa3eb9340d0c1
Tags:exe
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: C000007B

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
PE file overlay found
Uses 32bit PE files
PE file contains an invalid checksum

Classification

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeReversingLabs: Detection: 21%
Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: C:\suvi-rak\juha\vinogugifi99-ficeviwojewel buwet lugemuvujaye.pdb source: file.exe
Source: file.exeStatic PE information: Data appended to the last section found
Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exeReversingLabs: Detection: 21%
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engineClassification label: mal48.winEXE@0/0@0/0
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\suvi-rak\juha\vinogugifi99-ficeviwojewel buwet lugemuvujaye.pdb source: file.exe
Source: file.exeStatic PE information: real checksum: 0x44899 should be: 0x24602

Mitre Att&ck Matrix

⊘No Mitre Att&ck techniques found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe22%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:780213
Start date and time:2023-01-08 16:10:43 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 2m 15s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:file.exe
Cookbook file name:default.jbs
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:0
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • HDC enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal48.winEXE@0/0@0/0
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Unable to launch sample, stop analysis

Errors

  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: C000007B

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):6.2746590081803
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:file.exe
File size:100253
MD5:c7ec81f0acc9c8e034bc2d512942d044
SHA1:2cf635fcefa8db2f78e522634c5eb30bae2bd96e
SHA256:b4bbed50c840856520738aeb28649e34d9b017761d679530f7aaa3eb9340d0c1
SHA512:f4192fbbc306bde89987c9ef52cc9fb24911d46a4aada8f942153ba3f6f04f85bde2b99a05c57ccc8ffef2228e3acf60fb108d9bf84b541248d97dddb087e0cc
SSDEEP:1536:RQukcgAkMjdEy2ZcfaNLn9HAn1niO6eTsBHfKPuACSg52IS5:RXhgA9iLnMfEHf8Lh5
TLSH:27A39D257982C073C59A50B06920DBE56FBE60321678DC877BA51B7E8F702D1A37B34B
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u......................................x`.........1...........................Rich....................PE..L....8.a...........

File Icon

Icon Hash:00828e8e8686b000

Static PE Info

General

Entrypoint:0x405fbf
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x61B838A2 [Tue Dec 14 06:24:34 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:5
OS Version Minor:0
File Version Major:5
File Version Minor:0
Subsystem Version Major:5
Subsystem Version Minor:0
Import Hash:b49d1773872141620d6e88f1989600b7

Entrypoint Preview

Instruction
call 00007F5F3CC7E0E8h
jmp 00007F5F3CC77E5Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
mov byte ptr [esi+0Ch], 00000000h
test eax, eax
jne 00007F5F3CC78045h
call 00007F5F3CC7DDC5h
mov dword ptr [esi+08h], eax
mov ecx, dword ptr [eax+6Ch]
mov dword ptr [esi], ecx
mov ecx, dword ptr [eax+68h]
mov dword ptr [esi+04h], ecx
mov ecx, dword ptr [esi]
cmp ecx, dword ptr [0042A268h]
je 00007F5F3CC77FF4h
mov ecx, dword ptr [0042A184h]
test dword ptr [eax+70h], ecx
jne 00007F5F3CC77FE9h
call 00007F5F3CC7EAFBh
mov dword ptr [esi], eax
mov eax, dword ptr [esi+04h]
cmp eax, dword ptr [0042A088h]
je 00007F5F3CC77FF8h
mov eax, dword ptr [esi+08h]
mov ecx, dword ptr [0042A184h]
test dword ptr [eax+70h], ecx
jne 00007F5F3CC77FEAh
call 00007F5F3CC7E36Fh
mov dword ptr [esi+04h], eax
mov eax, dword ptr [esi+08h]
test byte ptr [eax+70h], 00000002h
jne 00007F5F3CC77FF6h
or dword ptr [eax+70h], 02h
mov byte ptr [esi+0Ch], 00000001h
jmp 00007F5F3CC77FECh
mov ecx, dword ptr [eax]
mov dword ptr [esi], ecx
mov eax, dword ptr [eax+04h]
mov dword ptr [esi+04h], eax
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 10h
push esi
push dword ptr [ebp+0Ch]
lea ecx, dword ptr [ebp-10h]
call 00007F5F3CC77F4Ah
mov esi, dword ptr [ebp+08h]
movsx eax, byte ptr [esi]
push eax
call 00007F5F3CC7EDA3h
cmp eax, 65h
jmp 00007F5F3CC77FEEh
inc esi
movzx eax, byte ptr [esi]
push eax
call 00007F5F3CC7EB4Ch
test eax, eax
pop ecx
jne 00007F5F3CC77FD3h
movsx eax, byte ptr [esi]

Rich Headers

Programming Language:
  • [ASM] VS2008 build 21022
  • [ C ] VS2008 build 21022
  • [IMP] VS2005 build 50727
  • [C++] VS2008 build 21022
  • [RES] VS2008 build 21022
  • [LNK] VS2008 build 21022

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x17dec0x50.text
IMAGE_DIRECTORY_ENTRY_RESOURCE0x27910000x18460.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x12200x1c.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x43b80x40.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x10000x1d4.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x178660x17a00False0.5362723214285714OpenPGP Public Key6.401345372829029IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x190000x27777f40x11c00unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x27910000x184600x18600False0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLLImport
KERNEL32.dllGetModuleHandleA, CreateDirectoryExA, ReadConsoleInputA, GetTempPathW, GetCurrentDirectoryW, RemoveDirectoryW, OutputDebugStringA, GetProcAddress, LocalAlloc, GetBinaryTypeW, SearchPathA, VerifyVersionInfoA, GetProcessPriorityBoost, EndUpdateResourceW, FindNextFileW, FindFirstVolumeW, LocalFree, GlobalFlags, UpdateResourceW, CreateActCtxA, CopyFileW, InterlockedExchangeAdd, GetConsoleAliasW, VerSetConditionMask, CreateMutexA, DeactivateActCtx, GetDiskFreeSpaceA, MoveFileW, GetLogicalDriveStringsA, ResetEvent, MoveFileExW, CreateMailslotA, WriteConsoleInputA, QueryDosDeviceW, InterlockedDecrement, EnumTimeFormatsW, lstrcatW, FindFirstFileA, FreeEnvironmentStringsA, SetErrorMode, GetTickCount, SetLastError, AllocateUserPhysicalPages, GetPrivateProfileStructA, CopyFileExA, MoveFileWithProgressA, LoadLibraryA, GetLastError, DeleteFileA, GetStartupInfoW, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, HeapCreate, VirtualFree, HeapFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RaiseException, VirtualAlloc, HeapReAlloc, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, RtlUnwind, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, ReadFile, HeapSize, CloseHandle, CreateFileA
GDI32.dllGetTextFaceA
WINHTTP.dllWinHttpWriteData

Network Behavior

⊘No network behavior found

Statistics

⊘No statistics

System Behavior

⊘No system behavior

Disassembly

⊘No disassembly