Edit tour
Windows
Analysis Report
Archive.zip
Overview
General Information
| Sample name: | Archive.zip |
| Analysis ID: | 1541176 |
| MD5: | c60cd0df4975d745722d1776d5be95b5 |
| SHA1: | f8e2eb05478108eae1f8fa28f70ebb64163d032d |
| SHA256: | f1ed181ee30a70c0f71aacf7c592be0e6589421bc479e379109c4c3f572bb663 |
| Infos: |  |
 | |
Detection
| Score: | 36 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 20% |
Signatures
Monitors registry run keys for changes
Binary contains a suspicious time stamp
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to modify clipboard data
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Classification
- System is w10x64_ra
rundll32.exe (PID: 6844 cmdline: C:\Windows \System32\ rundll32.e xe C:\Wind ows\System 32\shell32 .dll,SHCre ateLocalSe rverRunDll {9aa46009 -3ce0-458a -a354-7156 10a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
icepdfeditor.exe (PID: 7060 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_5947 d8bd2f31be dc98f32280 0cabd2fb85 e56117-2.z ip\icepdfe ditor.exe" MD5: 6700C9E3B5ADB8292F5FF09D1C38C920)
Patch.exe (PID: 3892 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F)
- Patch.exe (PID: 7148 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F)
- icepdfeditor.exe (PID: 6164 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_5947 d8bd2f31be dc98f32280 0cabd2fb85 e56117-2.z ip\icepdfe ditor.exe" MD5: 6700C9E3B5ADB8292F5FF09D1C38C920)
- pdf_editor_setup_Downloadly.ir.exe (PID: 2872 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_274f 715c8cf381 26dbbd4bca e3b6fed8ec edb649.zip \pdf_edito r_setup_Do wnloadly.i r.exe" MD5: 427D86902D064DCBDE0EB4F2D7FD601A) - pdf_editor_setup_Downloadly.ir.tmp (PID: 6340 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-SDS TO.tmp\pdf _editor_se tup_Downlo adly.ir.tm p" /SL5="$ 60464,2215 2334,23808 0,C:\Users \user\AppD ata\Local\ Temp\Temp1 _MDE_File_ Sample_274 f715c8cf38 126dbbd4bc ae3b6fed8e cedb649.zi p\pdf_edit or_setup_D ownloadly. ir.exe" MD5: 4BE9718959029220FC534542CB891006) - pdf_editor_setup_Downloadly.ir.exe (PID: 6512 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_274f 715c8cf381 26dbbd4bca e3b6fed8ec edb649.zip \pdf_edito r_setup_Do wnloadly.i r.exe" /SP AWNWND=$10 480 /NOTIF YWND=$6046 4 MD5: 427D86902D064DCBDE0EB4F2D7FD601A) - pdf_editor_setup_Downloadly.ir.tmp (PID: 6896 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-3U6 N3.tmp\pdf _editor_se tup_Downlo adly.ir.tm p" /SL5="$ 30476,2215 2334,23808 0,C:\Users \user\AppD ata\Local\ Temp\Temp1 _MDE_File_ Sample_274 f715c8cf38 126dbbd4bc ae3b6fed8e cedb649.zi p\pdf_edit or_setup_D ownloadly. ir.exe" /S PAWNWND=$1 0480 /NOTI FYWND=$604 64 MD5: 4BE9718959029220FC534542CB891006) 
chrome.exe (PID: 6116 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// icecreamap ps.com/PDF -Editor/th ankyou.htm l?v=3.27 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - chrome.exe (PID: 6232 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2120 --fi eld-trial- handle=190 4,i,138547 0179166100 7299,59415 8295395906 7631,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA) - icepdfeditor.exe (PID: 1388 cmdline:
"C:\Progra m Files (x 86)\Icecre am PDF Edi tor 3\icep dfeditor.e xe" -inst MD5: 4AF96C036230E02407C613237F8BC9D5)
Taskmgr.exe (PID: 4116 cmdline: "C:\Window s\system32 \taskmgr.e xe" /4 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)
- Taskmgr.exe (PID: 4352 cmdline:
"C:\Window s\system32 \taskmgr.e xe" /4 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | Binary or memory string: | memstr_83bb44db-3 | |
| Source: | Window detected: | ||