ID: Sample Name: pafish.exe Cookbook: default.jbs Time: 15:08:33 Date: 25/02/2018 Version:

Transcription

1 ID: Sample Name: pafish.exe Cookbook: default.jbs Time: :0:33 Date: 25/02/201 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Spreading: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Possible Origin Network Behavior Table of Contents Copyright Joe Security LLC 201 Page 2 of

3 Code Manipulations Statistics System Behavior Analysis Process: pafish.exe PID: 3316 Parent PID: 304 General File Activities File Created Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 16

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: :0:33 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 3m 33s false light pafish.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal76.evad.winexe@1/1@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 0% HDC Information: Successful, ratio: 0% (good quality ratio 41%) Quality average: 32.3% Quality standard deviation: 42.3% Cookbook Comments: Adjust boot time Adjusted system time to: 2//2016 Found application associated with file extension:.exe Warnings: Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, conhost.exe, dllhost.exe Report size getting too big, too many NtOpenKeyEx calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 16

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Signature Overview Copyright Joe Security LLC 201 Page 5 of 16

6 Signature Overview AV Detection Spreading System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Language, Device and Operating System Detection Click to jump to signature section AV Detection: Multi AV Scanner detection for submitted file Spreading: Contains functionality to query local drives System Summary: Classification label Contains functionality to check free disk space Contains functionality to enum processes or threads Contains functionality to instantiate COM classes Creates files inside the user directory PE file has an executable.text section and no other executable section Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Uses an in-process (OLE) Automation server Contains functionality to communicate with device drivers Detected potential crypto function Sample file is different than original file name gathered from version info HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Contains functionality to register its own exception handler Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Contains functionality for execution timing, often used to detect debuggers Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to check if a debugger is running (OutputDebugString,GetLastError) Found API chain indicative of debugger detection Malware Analysis System Evasion: Contains functionality to query local drives Copyright Joe Security LLC 201 Page 6 of 16

7 Contains functionality to query system information May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Queries a list of all running processes Contains capabilities to detect virtual machines Contains functionality for execution timing, often used to detect debuggers Queries disk information (often used to detect virtual machines) Contains functionality to detect hardware virtualization (CPUID execution measurement) Contains functionality to detect sandboxes (mouse cursor move detection) Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) Tries to detect sandboxes / dynamic malware analysis system (registry check) Tries to detect sandboxes and other dynamic analysis tools (process name) Language, Device and Operating System Detection: Contains functionality to query local / system time Contains functionality to query the account / user name Contains functionality to query windows version Queries the cryptographic machine GUID Contains functionality to query CPU information (cpuid) Behavior Graph Hide Legend Behavior Graph ID: Sample: pafish.exe Startdate: 25/02/201 Architecture: WINDOWS Score: 76 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java Multi AV Scanner detection for submitted file Tries to detect sandboxes and other dynamic analysis tools (process name) started.net C# or VB.NET C, C++ or other language Is malicious pafish.exe 1 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) Contains functionality to detect hardware virtualization (CPUID execution measurement) 3 other signatures Copyright Joe Security LLC 201 Page 7 of 16

8 Simulations Behavior and APIs Time Type Description :09:01 API Interceptor 1x Sleep call for process: pafish.exe modified from: 30000ms to: 0ms :09:01 API Interceptor 3x Sleep call for process: pafish.exe modified from: 60000ms to: 0ms Antivirus Detection Initial Sample Source Detection Scanner Label Link pafish.exe 17% virustotal Browse pafish.exe 14% metadefender Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context Copyright Joe Security LLC 201 Page of 16

9 IPs No context Domains No context ASN No context Dropped Files No context Screenshot Startup System is w7 pafish.exe (PID: 3316 cmdline: 'C:\Users\user\Desktop\pafish.exe' MD5: 99EDB64C4A21DD0BF2DB23F3) cleanup Copyright Joe Security LLC 201 Page 9 of 16

10 Created / dropped Files C:\Users\user\Desktop\pafish.log File Type: Size (bytes): 14 ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false EC95DD43C0426E49EC14BF5B3E5522 A99C90646FA33F0A7C2022B73AFCCE219C A D1D3B471D354D9439CDFF7191B1FACE4FC077ACD1CA0317E5 BEE20E2EC2F3D442DDC0137E229C2D79A44A12A94196FC376EA175E5D321EEB6B2CF1944A14B56C9 6A9574B A2FEA6792A9740E393520F26 false low Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (bit): PE32 executable (console) Intel 036 (stripped to external PDB), for MS Windows TrID: Win32 Executable (generic) a (002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: 7600 MD5: SHA1: SHA256: SHA512: File Content Preview: pafish.exe 99edb64c4a21dd0bf2db23f3 124f4622d1e220dae5e9a24d6e713039a64f9 2f4a13add5e346ecf699476a9d2f5eac3fcb695db d24cd6d5 4b6d56b1dd3cd42bb53fcd6b5cef0d6c5ebcc503cd 042ae5c19e965e6477f259a02bafb9c5c66956ae23fc 30e3be5bbcd526eacc40f93d74c1ab7c MZ...@...!..L.!Th is program cannot be run in DOS mode...$...pe..l...i{.w...p...(...`...@ File Icon Static PE Info General Entrypoint: 0x4014e0 Copyright Joe Security LLC 201 Page of 16

11 General Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash:.text false 0x windows cui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, RELOCS_STRIPPED 0x57C17B69 [Sat Aug 27 11:37: UTC] 0x404e90, 0x404e40 5fd4caa76ea3c961f2d f64d Entrypoint Preview Instruction sub esp, 0Ch mov dword ptr [0040B39h], h call 00007FB07C6D1F3h add esp, 0Ch jmp 00007FB07C6965Bh push ebp mov ebp, esp sub esp, 1h mov eax, dword ptr [ Ch] test eax, eax je 00007FB07C69A1Eh mov dword ptr [esp], h call dword ptr [0040C30Ch] sub esp, 04h test eax, eax mov edx, h je 00007FB07C699Fh mov dword ptr [esp+04h], Eh mov dword ptr [esp], eax call dword ptr [0040C3h] sub esp, 0h mov edx, eax test edx, edx je 00007FB07C699EBh mov dword ptr [esp], Ch call edx mov dword ptr [esp], h call 00007FB07C6D0AEh leave ret lea esi, dword ptr [esi h] push ebp mov ebp, esp pop ebp ret Copyright Joe Security LLC 201 Page 11 of 16

12 Instruction push ebp mov ebp, esp push ebx sub esp, 24h lea eax, dword ptr [ebp+14h] mov dword ptr [ebp-0ch], eax mov eax, dword ptr [ebp-0ch] mov dword ptr [esp+0ch], eax mov eax, dword ptr [ebp+h] mov dword ptr [esp+0h], eax mov eax, dword ptr [ebp+0ch] mov dword ptr [esp+04h], eax mov eax, dword ptr [ebp+0h] mov dword ptr [esp], eax call 00007FB07C6E1Bh mov ebx, eax Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0xc000 0xd24.idata IMAGE_DIRECTORY_ENTRY_RESOURCE 0xf000 0xef0.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0xe004 0x1.tls IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0xc2a 0x1cc.idata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x00 0x4f04 0x5000 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_204BYTES, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_BYTES, IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 12 of 16

13 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.data 0x6000 0x30 0x200 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ.rdata 0x7000 0x32b 0x3400 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ.bss 0xb000 0x400 0x0 False 0 empty 0.0 IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_204BYTES, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_CNT_UNINITIALIZED _DATA, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ.idata 0xc000 0xd24 0xe00 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ.CRT 0xd000 0x34 0x200 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 13 of 16

14 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.tls 0xe000 0x20 0x200 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ.rsrc 0xf000 0xef0 0x9000 False data IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_ALIGN_24BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_192BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0xf1e0 0x5a6c PNG image data, 256 x 256, -bit/color RGBA, noninterlaced RT_ICON 0x14c50 0x1e12 PNG image data, 12 x 12, -bit/color RGBA, noninterlaced RT_ICON 0x16a6 0x79e PNG image data, 4 x 4, -bit/color RGBA, noninterlaced RT_ICON 0x1720 0x4ac PNG image data, 32 x 32, -bit/color RGBA, noninterlaced RT_ICON 0x176b 0x354 PNG image data, 24 x 24, -bit/color RGBA, noninterlaced RT_ICON 0x17a 0x1f1 PNG image data, 16 x 16, -bit/color RGBA, noninterlaced English English English English English English United States United States United States United States United States United States RT_GROUP_ICON 0x17c0 0x5a MS Windows icon resource - 6 icons, 16-colors English United States RT_VERSION 0x17c6 0x2 data English United States Imports DLL ADVAPI32.dll IPHLPAPI.DLL KERNEL32.dll MPR.DLL msvcrt.dll ole32.dll OLEAUT32.dll SHELL32.dll USER32.dll WS2_32.dll Import GetUserNameA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA GetAdaptersAddresses CloseHandle, CreateFileA, CreateProcessA, CreateToolhelp32Snapshot, DeleteCriticalSection, DeleteFileW, DeviceIoControl, EnterCriticalSection, GetConsoleScreenBufferInfo, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDiskFreeSpaceExA, GetDriveTypeA, GetFileAttributesA, GetLastError, GetLogicalDriveStringsA, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetStdHandle, GetSystemInfo, GetSystemTimeAsFileTime, GetTickCount, GetVersionExA, GlobalMemoryStatusEx, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, LocalAlloc, LocalFree, OutputDebugStringA, Process32First, Process32Next, QueryPerformanceCounter, SetConsoleTextAttribute, SetLastError, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, lstrcmpia WNetGetProviderNameA dllonexit, getmainargs, initenv, lconv_init, set_app_type, setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _iob, _lock, _onexit, calloc, exit, fclose, fopen, fprintf, fputs, free, fwrite, getchar, malloc, mbstowcs, memcmp, memcpy, printf, puts, signal, sprintf, strlen, strncat, strncmp, strncpy, strstr, _unlock, abort, toupper, vfprintf, wcsstr, _vsnprintf CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoUninitialize SysAllocString, SysFreeString ShellExecuteExW FindWindowA, GetCursorPos freeaddrinfo, getaddrinfo Version Infos Copyright Joe Security LLC 201 Page 14 of 16

15 Description LegalCopyright InternalName FileVersion CompanyName LegalTrademarks ProductName ProductVersion FileDescription OriginalFilename Translation Data Paranoid Fish Paranoid Fish is paranoid 0x0409 0x04e4 Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: pafish.exe PID: 3316 Parent PID: 304 General Start time: :0:4 Start date: 2/0/2016 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\pafish.exe false 'C:\Users\user\Desktop\pafish.exe' 0x bytes 99EDB64C4A21DD0BF2DB23F3 true C, C++ or other language low File Activities File Created Copyright Joe Security LLC 201 Page of 16

16 File Path Access Attributes Options Completion Count C:\Users\user\Desktop\pafish.log read attributes normal and synchronize and generic write synchronous io non alert and n on directory file Source Address Symbol success or wait BF fopen File Path Offset Length Value Ascii Completion Count Source Address Symbol Disassembly Code Analysis Copyright Joe Security LLC 201 Page 16 of 16