Edit tour
Windows
Analysis Report
3XRUFJRb3K.dll
Overview
General Information
Sample name: | 3XRUFJRb3K.dllrenamed because original name is a hash value |
Original sample name: | cea85af5f8bb6d3dc65f3b9ef2b581926e25d9c11f96dcd339f578014504baf1.dll |
Analysis ID: | 1511253 |
MD5: | 1040aaa72037f29d3cba032218f2f3c7 |
SHA1: | 1132b96c5072445f48c91b742fdce317353bd40c |
SHA256: | cea85af5f8bb6d3dc65f3b9ef2b581926e25d9c11f96dcd339f578014504baf1 |
Tags: | ad87h92j-comdll |
Infos: | |
Detection
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Drops password protected ZIP file
Machine Learning detection for sample
AV process strings found (often used to terminate AV products)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
- loaddll32.exe (PID: 4568 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\3XR UFJRb3K.dl l" MD5: 51E6071F9CBA48E79F10C84515AAE618) - conhost.exe (PID: 4536 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 2720 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\3XR UFJRb3K.dl l",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - rundll32.exe (PID: 3068 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",#1 MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2564 cmdline:
rundll32.e xe C:\User s\user\Des ktop\3XRUF JRb3K.dll, cef_clear_ cross_orig in_whiteli st MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4052 cmdline:
rundll32.e xe C:\User s\user\Des ktop\3XRUF JRb3K.dll, cef_clear_ scheme_han dler_facto ries MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5392 cmdline:
rundll32.e xe C:\User s\user\Des ktop\3XRUF JRb3K.dll, cef_comman d_line_cre ate MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4352 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_clea r_cross_or igin_white list MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4508 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_clea r_scheme_h andler_fac tories MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6512 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_comm and_line_c reate MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4448 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",you MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5712 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",create_c ontext_sha red MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5220 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_zip_ reader_cre ate MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6468 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_zip_ directory MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6260 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_writ e_json MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4280 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_wind ow_create_ top_level MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5492 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_visi t_web_plug in_info MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3608 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_valu e_create MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5216 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _undefined MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5856 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _uint MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5612 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _string MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5460 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _object MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5840 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _null MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5832 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _int MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7172 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _function MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7180 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _double MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7192 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _date MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7200 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _bool MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7212 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _array_buf fer MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7220 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8va lue_create _array MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7228 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8st ack_trace_ get_curren t MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7236 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8co ntext_in_c ontext MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7252 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8co ntext_get_ entered_co ntext MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7260 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_v8co ntext_get_ current_co ntext MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7272 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_urlr equest_cre ate MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7292 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_urie ncode MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7300 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_urid ecode MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7308 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_unre gister_int ernal_web_ plugin MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7416 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_time _to_timet MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7444 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_time _now MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7452 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\3XRU FJRb3K.dll ",cef_time _delta MD5: 889B99C52A60DD49227C5E485A016679)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |
---|
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | Avira: | ||
Source: | Avira: |
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Joe Sandbox ML: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: |
Networking |
---|
Source: | Network Connect: | Jump to behavior |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: |
Source: | UDP traffic detected without corresponding DNS query: |
Source: | HTTP traffic detected: |