Edit tour
Windows
Analysis Report
OBS-Studio-30.2.3-Windows-Installer.exe
Overview
General Information
| Sample name: | OBS-Studio-30.2.3-Windows-Installer.exe |
| Analysis ID: | 1555760 |
| MD5: | 287d64f35d7b81c26ca8cf2f2f6cf993 |
| SHA1: | 1f2a847fb81c3d4b488482bfade573ab4fc3c2c1 |
| SHA256: | b3c3cdd9e888ab607b9e146cf83cdca6b9810c2350c95ecea6b2990b9aba955a |
| Tags: | exeuser-SquiblydooBlog |
| Infos: |  |
 | |
Detection
| Score: | 52 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found pyInstaller with non standard icon
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Uses known network protocols on non-standard ports
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Recon Command Output Piped To Findstr.EXE
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
OBS-Studio-30.2.3-Windows-Installer.exe (PID: 4464 cmdline: "C:\Users\ user\Deskt op\OBS-Stu dio-30.2.3 -Windows-I nstaller.e xe" MD5: 287D64F35D7B81C26CA8CF2F2F6CF993) - OBS-Studio-30.2.3-Windows-Installer.exe (PID: 1496 cmdline:
"C:\Users\ user\Deskt op\OBS-Stu dio-30.2.3 -Windows-I nstaller.e xe" MD5: 287D64F35D7B81C26CA8CF2F2F6CF993) 
WMIC.exe (PID: 6612 cmdline: wmic bios get serial number MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
conhost.exe (PID: 3160 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5632 cmdline:
C:\Windows \system32\ cmd.exe /c "tasklist | findstr process_e xplorer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1100 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
tasklist.exe (PID: 1860 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA) - findstr.exe (PID: 1292 cmdline:
findstr pr ocess_expl orer MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 6444 cmdline:
C:\Windows \system32\ cmd.exe /c "tasklist | findstr wireshark " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3276 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - tasklist.exe (PID: 2796 cmdline:
tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA) - findstr.exe (PID: 348 cmdline:
findstr wi reshark MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 6612 cmdline:
C:\Windows \system32\ cmd.exe /c "tasklist | findstr ollydbg" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 984 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - tasklist.exe (PID: 6576 cmdline:
tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA) - findstr.exe (PID: 1784 cmdline:
findstr ol lydbg MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 7064 cmdline:
C:\Windows \system32\ cmd.exe /c "wmic csp roduct get UUID" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1628 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 5240 cmdline:
wmic cspro duct get U UID MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - WMIC.exe (PID: 6444 cmdline:
wmic /name space:\\ro ot\securit ycenter2 p ath antivi rus get di splayname MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - conhost.exe (PID: 3276 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Perez Diego (@darkquassar), oscd.community: | ||
| Source: | Author: Nasreddine Bencherchali (Nextron Systems), frack113: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||