Windows Analysis Report
SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe

Overview

General Information

Sample name: SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe
Analysis ID: 1446233
MD5: c1367eaf2157e6a88432c899fc995104
SHA1: 7fac3e298b902d04213a5bf39a7db6848d34d099
SHA256: 50c87c9e9d89f20e6540b2f198244c1dc300026306c1b574d032c357f3f9e2af
Tags: exe

Detection

Score: 21
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Uses Windows timers to delay execution
PE file contains executable resources (Code or Archives)
Program does not show much activity (idle)
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
PE file contains executable resources (Code or Archives)
Source: SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Uses 32bit PE files
Source: SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: sus21.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Section loaded: perfos.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Window found: window name: TButton Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Uses Windows timers to delay execution
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe User Timer Set: Timeout: 100ms Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1446233 Sample: SecuriteInfo.com.BScope.Tro... Startdate: 23/05/2024 Architecture: WINDOWS Score: 21 4 SecuriteInfo.com.BScope.Trojan.Download.7332.18301.exe 2->4         started        signatures3 7 Uses Windows timers to delay execution 4->7
⊘No contacted IP infos