Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Dark and Darker A5 Installer.exe

Overview

General Information

Sample Name:Dark and Darker A5 Installer.exe
Analysis ID:847130
MD5:8e8a3101ca60288fe7af6e6f23319539
SHA1:be03cf046ed5b995725667937b2cf42d69156b7f
SHA256:0cb1f4ac2c534771fbd27956791ef93604974dbb19658fdb176f9e037ee1ba60

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Uses 32bit PE files
Program does not show much activity (idle)

Classification

Process Tree

  • System is w10x64_ra
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Dark and Darker A5 Installer.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Dark and Darker A5 Installer.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Dark and Darker A5 Installer.exe, 00000001.00000002.1519601790.00000000006A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.ne
Source: Dark and Darker A5 Installer.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Dark and Darker A5 Installer.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeFile read: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeJump to behavior
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsb561B.tmpJump to behavior
Source: Dark and Darker A5 Installer.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: classification engineClassification label: clean1.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Dark and Darker A5 Installer.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\Dark and Darker A5 Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping1
File and Directory Discovery		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory2
System Information Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Dark and Darker A5 Installer.exe0%ReversingLabs
Dark and Darker A5 Installer.exe6%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://nsis.sf.ne0%Avira URL Cloudsafe
http://nsis.sf.ne0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://nsis.sf.net/NSIS_ErrorErrorDark and Darker A5 Installer.exefalse
    		high
    http://nsis.sf.neDark and Darker A5 Installer.exe, 00000001.00000002.1519601790.00000000006A8000.00000004.00000020.00020000.00000000.sdmpfalse
    • 0%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown

    World Map of Contacted IPs

    ⊘No contacted IP infos

    General Information

    Joe Sandbox Version:37.0.0 Beryl
    Analysis ID:847130
    Start date and time:2023-04-15 02:03:22 +02:00
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 3m 42s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Analysis system description:Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
    Number of analysed new started processes analysed:4
    Number of new started drivers analysed:0
    Number of existing processes analysed:1
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample file name:Dark and Darker A5 Installer.exe
    Detection:CLEAN
    Classification:clean1.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .exe

    Warnings

    • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded domains from analysis (whitelisted): client.wns.windows.com, login.live.com, slscr.update.microsoft.com

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    ⊘No context

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    ⊘No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
    Entropy (8bit):5.495222741466135
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.96%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:Dark and Darker A5 Installer.exe
    File size:297034
    MD5:8e8a3101ca60288fe7af6e6f23319539
    SHA1:be03cf046ed5b995725667937b2cf42d69156b7f
    SHA256:0cb1f4ac2c534771fbd27956791ef93604974dbb19658fdb176f9e037ee1ba60
    SHA512:6ac7464dab3975ecb16aa8f07be5201d99abd7f4b1f618122fd042c2f3c8b3e457298664bc69d2c08e14ae7436a2ab171c9df320c9485f419425fb52b6c73a3b
    SSDEEP:3072:wr4F3Ch40NiXmkuC0jg90mwV7WSyMAkPSlUFeQa86UlujlBm2unsZtAh:wrwf0mm490mwMdxlUwQa86UluZoVj
    TLSH:0854D21077FC9A0AF6F33F746EF462755ABABD91AD3CC21E2210265D1972A80DD20763
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........w...$...$...$..R$...$...$...$..B$...$..U$...$..P$...$Rich...$........................PE..L....h.a.................p.........

    File Icon

    Icon Hash:30d8bcbcbcbcf838

    Static PE Info

    General

    Entrypoint:0x403a0b
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
    Time Stamp:0x619B68F3 [Mon Nov 22 09:54:59 2021 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:5
    OS Version Minor:0
    File Version Major:5
    File Version Minor:0
    Subsystem Version Major:5
    Subsystem Version Minor:0
    Import Hash:d6b0dc1b7cdf65cf7e0ae1b8c64eba7d

    Entrypoint Preview

    Instruction
    push ebp
    lea ebp, dword ptr [esp-78h]
    sub esp, 000003F0h
    push ebx
    push esi
    push edi
    push 00000020h
    pop edi
    xor ebx, ebx
    push 00008001h
    mov dword ptr [ebp+68h], ebx
    mov dword ptr [ebp+70h], 004085C8h
    mov dword ptr [ebp+74h], ebx
    call dword ptr [004080A4h]
    mov esi, dword ptr [004080C4h]
    lea eax, dword ptr [ebp-000000C4h]
    push eax
    mov dword ptr [ebp-000000B0h], ebx
    mov dword ptr [ebp+50h], ebx
    mov dword ptr [ebp+54h], ebx
    mov dword ptr [ebp-000000C4h], 0000011Ch
    call esi
    test eax, eax
    jne 00007FE3B89C0A56h
    lea eax, dword ptr [ebp-000000C4h]
    push eax
    mov dword ptr [ebp-000000C4h], 00000114h
    call esi
    mov ecx, dword ptr [ebp-00000096h]
    xor eax, eax
    add ecx, FFFFFFD0h
    cmp word ptr [ebp-000000B0h], 0053h
    mov byte ptr [ebp+56h], 00000004h
    setne al
    dec eax
    and eax, ecx
    mov word ptr [ebp+50h], ax
    cmp dword ptr [ebp-000000C0h], 0Ah
    jnc 00007FE3B89C0A2Ch
    and dword ptr [ebp-000000B8h], 0000FFFFh
    mov eax, dword ptr [ebp-000000B8h]
    movzx ecx, byte ptr [ebp-000000BCh]
    mov dword ptr [00434AF8h], eax
    movzx ax, byte ptr [ebp-000000C0h]
    shl ax, 0008h
    movzx eax, ax
    or eax, ecx
    movzx cx, byte ptr [ebp+50h]
    shl cx, 0008h

    Rich Headers

    Programming Language:
    • [IMP] VS2008 SP1 build 30729
    • [ C ] VS2008 SP1 build 30729
    • [LNK] VS2008 SP1 build 30729

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x8b080xa0.rdata
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x5c0000x28aa0.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x6e020x7000False0.6587960379464286data6.453673821244673IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    .rdata0x80000x199e0x1a00False0.45447716346153844data5.0151502329730455IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
    .data0xa0000x2ab040x200False0.306640625data2.0657421577707753IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .ndata0x350000x270000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
    .rsrc0x5c0000x28aa00x28c00False0.5860693059815951data5.945917751312337IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    RT_ICON0x5c3280x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States
    RT_ICON0x6cb500xf446PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States
    RT_ICON0x7bf980x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States
    RT_ICON0x801c00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States
    RT_ICON0x827680x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States
    RT_ICON0x838100x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States
    RT_DIALOG0x83c780xb4dataEnglishUnited States
    RT_DIALOG0x83d300x120dataEnglishUnited States
    RT_DIALOG0x83e500x202dataEnglishUnited States
    RT_DIALOG0x840580xf8dataEnglishUnited States
    RT_DIALOG0x841500xeedataEnglishUnited States
    RT_GROUP_ICON0x842400x5adataEnglishUnited States
    RT_VERSION0x842a00x3c0dataEnglishUnited States
    RT_MANIFEST0x846600x439XML 1.0 document, ASCII text, with very long lines (1081), with no line terminatorsEnglishUnited States

    Imports

    DLLImport
    ADVAPI32.dllRegDeleteKeyW, RegCloseKey, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegSetValueExW, RegDeleteValueW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegCreateKeyExW
    SHELL32.dllShellExecuteExW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, SHFileOperationW, SHGetSpecialFolderLocation
    ole32.dllCoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
    COMCTL32.dllImageList_Destroy, ImageList_AddMasked, ImageList_Create
    USER32.dllGetDlgItemTextW, SetDlgItemTextW, RegisterClassW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, SetWindowPos, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, EndDialog, GetSystemMetrics, CreatePopupMenu, AppendMenuW, GetWindowRect, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, ScreenToClient, CheckDlgButton, LoadCursorW, SetCursor, MessageBoxIndirectW, GetSysColor, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, CharPrevW, DispatchMessageW, wsprintfA, GetWindowLongW, PeekMessageW, SystemParametersInfoW
    GDI32.dllGetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
    KERNEL32.dlllstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, CreateProcessW, CreateDirectoryW, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, lstrcatW, GetCurrentProcess, GetVersionExW, GetModuleFileNameW, GetFileSize, GetLastError, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, RemoveDirectoryW, lstrcpyA, MoveFileExW, ExitProcess

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States

    Network Behavior

    ⊘No network behavior found

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Target ID:1
    Start time:02:03:57
    Start date:15/04/2023
    Path:C:\Users\user\Desktop\Dark and Darker A5 Installer.exe
    Wow64 process (32bit):true
    Commandline:C:\Users\user\Desktop\Dark and Darker A5 Installer.exe
    Imagebase:0x400000
    File size:297034 bytes
    MD5 hash:8E8A3101CA60288FE7AF6E6F23319539
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:low

    Disassembly

    ⊘No disassembly