Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4LISu7rYyc.exe

Overview

General Information

Sample name:4LISu7rYyc.exe
renamed because original name is a hash value
Original sample name:6a189645d4b931b1850eed40a68e80ad.exe
Analysis ID:1520609
MD5:6a189645d4b931b1850eed40a68e80ad
SHA1:6791a2f4d0a0f12a488e96cf67234fa0e52380bb
SHA256:e416178f2bcc62d37b8326d554bf82b18f87a3bd3dbfff2f957c77dbec04a329
Tags:exeuser-abuse_ch
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Machine Learning detection for sample
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found

Classification

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: 4LISu7rYyc.exeReversingLabs: Detection: 36%
Machine Learning detection for sample
Source: 4LISu7rYyc.exeJoe Sandbox ML: detected
Source: 4LISu7rYyc.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: 4LISu7rYyc.exeStatic PE information: Number of sections : 11 > 10
Source: 4LISu7rYyc.exeStatic PE information: No import functions for PE file found
Source: 4LISu7rYyc.exeStatic PE information: Data appended to the last section found
Source: classification engineClassification label: mal52.winEXE@0/0@0/0
Source: 4LISu7rYyc.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 4LISu7rYyc.exeReversingLabs: Detection: 36%
Source: 4LISu7rYyc.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 4LISu7rYyc.exeStatic file information: File size 5159875 > 1048576
Source: 4LISu7rYyc.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x54c600
Source: 4LISu7rYyc.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: 4LISu7rYyc.exeStatic PE information: real checksum: 0x570165 should be: 0x4f59a3
Source: 4LISu7rYyc.exeStatic PE information: section name: .xdata

Mitre Att&ck Matrix

⊘No Mitre Att&ck techniques found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
4LISu7rYyc.exe37%ReversingLabsWin64.Coinminer.XMRig
4LISu7rYyc.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1520609
Start date and time:2024-09-27 16:46:13 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 45s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:1
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:4LISu7rYyc.exe
renamed because original name is a hash value
Original Sample Name:6a189645d4b931b1850eed40a68e80ad.exe
Detection:MAL
Classification:mal52.winEXE@0/0@0/0
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Unable to launch sample, stop analysis

Errors

  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe
  • Excluded domains from analysis (whitelisted): time.windows.com
  • VT rate limit hit for: 4LISu7rYyc.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):7.7248324882618515
TrID:
  • Win64 Executable (generic) (12005/4) 74.95%
  • Generic Win/DOS Executable (2004/3) 12.51%
  • DOS Executable Generic (2002/1) 12.50%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:4LISu7rYyc.exe
File size:5'159'875 bytes
MD5:6a189645d4b931b1850eed40a68e80ad
SHA1:6791a2f4d0a0f12a488e96cf67234fa0e52380bb
SHA256:e416178f2bcc62d37b8326d554bf82b18f87a3bd3dbfff2f957c77dbec04a329
SHA512:ac751ab1586fef41f271c5506bc4d2f98d3c87cef74f6cc44bb50d3dbf5ffbf4066f37cd1eb3b44a91e7d9956bd8a62df21d598b6c52abcce24278e6ed18424e
SSDEEP:98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgIT6:vIlQIN33nVKboT7MAwtCYzQQjn46yQl2
TLSH:2B36F1B684F7112AF6AA4538597A0DF4167F69E717CC1D7A1A00992E027EA0C33EDDF0
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=d...............&......V................@.............................`W.....e.W...`... ............................

File Icon

Icon Hash:00928e8e8686b000

Static PE Info

General

Entrypoint:0x1400014b0
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x140000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:0x643DD19B [Mon Apr 17 23:09:15 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00569C25h]
mov dword ptr [eax], 00000001h
call 00007FA2C45F519Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00569C05h]
mov dword ptr [eax], 00000000h
call 00007FA2C45F517Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FA2C460BEE4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FA2C45F54B9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea eax, dword ptr [0056E749h]
dec eax
lea edx, dword ptr [eax+21h]
mov byte ptr [eax], 00000000h
dec eax
add eax, 01h
dec eax
cmp eax, edx
jne 00007FA2C45F54D6h
ret
dec eax
lea eax, dword ptr [0056E6F1h]
dec eax
lea edx, dword ptr [eax+18h]
mov word ptr [eax], 0000h
dec eax
add eax, 02h
dec eax
cmp eax, edx
jne 00007FA2C45F54D4h
ret
dec eax
lea eax, dword ptr [0056E6B7h]
dec eax
lea edx, dword ptr [eax+14h]
mov word ptr [eax], 0000h
dec eax
add eax, 02h
dec eax

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x5710000xa34.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x5740000x380.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x56c0000x114c.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x5750000x330.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x56a6e00x28.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x57128c0x250.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x190a00x192008296492ff92e6ea93d1a84b626424ebfFalse0.4730935167910448data6.168211123428597IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x1b0000x54c4a00x54c6005d22d119bd76805177c9becc5a5f62a5unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0x5680000x39500x3a00d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata0x56c0000x114c0x1200d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata0x56e0000xef00x1000d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss0x56f0000x1b800x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0x5710000xa340xc00d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT0x5720000x600x200d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls0x5730000x100x200d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc0x5740000x3800x400d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc0x5750000x3300x400d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Network Behavior

⊘No network behavior found

Statistics

⊘No statistics

System Behavior

⊘No system behavior

Disassembly

⊘No disassembly