Play interactive tour
Edit tourWindows Analysis Report Girls-Questionnaire-For-Autism-Spectrum-Disorders.exe
Overview
General Information
| Sample Name: | Girls-Questionnaire-For-Autism-Spectrum-Disorders.exe |
| Analysis ID: | 538201 |
| MD5: | ae5b37182059c7733466788212370e71 |
| SHA1: | e6b0ee285d7042834d23743ad8ca188082ac264f |
| SHA256: | 44af59a2d70ba23f2f80d80090d11184ef923a746c0c9ea3c81922bd8d899346 |
| Infos: | |
Most interesting Screenshot:  | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Powershell dedcode and execute
Multi AV Scanner detection for submitted file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Antivirus / Scanner detection for submitted sample
Sigma detected: Encoded FromBase64String
Sigma detected: Powershell Decrypt And Execute Base64 Data
Initial sample is a PE file and has a suspicious name
Sigma detected: FromBase64String Command Line
Suspicious powershell command line found
Sigma detected: Execution Of Other File Type Than .exe
Obfuscated command line found
Writes many files with high entropy
Powershell creates an autostart link
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Found evasive API chain checking for process token information
Contains functionality to launch a program with higher privileges
PE / OLE file has an invalid certificate
Creates a process in suspended mode (likely to inject code)
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Dropped Files |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| JoeSecurity_PowershellDedcodeAndExecute | Yara detected Powershell dedcode and execute | Joe Security | ||
| Click to see the 1 entries | ||||
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Encoded FromBase64String | Show sources | ||
| Source: | Author: Florian Roth: | ||