Play interactive tour
Edit tourWindows Analysis Report Freddie-Mac-Warrantable-Condo-List.exe
Overview
General Information
| Sample Name: | Freddie-Mac-Warrantable-Condo-List.exe |
| Analysis ID: | 473045 |
| MD5: | ae5b37182059c7733466788212370e71 |
| SHA1: | e6b0ee285d7042834d23743ad8ca188082ac264f |
| SHA256: | 44af59a2d70ba23f2f80d80090d11184ef923a746c0c9ea3c81922bd8d899346 |
| Infos: | |
Most interesting Screenshot:  | |
Detection
| Score: | 92 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Powershell dedcode and execute
Multi AV Scanner detection for submitted file
Sigma detected: Encoded FromBase64String
Sigma detected: Powershell Decrypt And Execute Base64 Data
Sigma detected: FromBase64String Command Line
Bypasses PowerShell execution policy
Suspicious powershell command line found
Writes many files with high entropy
Powershell creates an autostart link
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
PE file contains executable resources (Code or Archives)
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
PE file contains strange resources
Drops PE files
Found evasive API chain checking for process token information
Contains functionality to launch a program with higher privileges
Creates a start menu entry (Start Menu\Programs\Startup)
PE / OLE file has an invalid certificate
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Dropped Files |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| Click to see the 1 entries | ||||
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Encoded FromBase64String | Show sources | ||
| Source: | Author: Florian Roth: | ||