Edit tour
Windows
Analysis Report
Archive.zip
Overview
General Information
| Sample name: | Archive.zip |
| Analysis ID: | 1541179 |
| MD5: | c60cd0df4975d745722d1776d5be95b5 |
| SHA1: | f8e2eb05478108eae1f8fa28f70ebb64163d032d |
| SHA256: | f1ed181ee30a70c0f71aacf7c592be0e6589421bc479e379109c4c3f572bb663 |
| Infos: |  |
 | |
Detection
| Score: | 34 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 20% |
Signatures
Accesses ntoskrnl, likely to find offsets for exploits
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to modify clipboard data
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Classification
- System is w10x64_ra
rundll32.exe (PID: 7060 cmdline: C:\Windows \System32\ rundll32.e xe C:\Wind ows\System 32\shell32 .dll,SHCre ateLocalSe rverRunDll {9aa46009 -3ce0-458a -a354-7156 10a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
pdf_editor_setup_Downloadly.ir.exe (PID: 1316 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_274f 715c8cf381 26dbbd4bca e3b6fed8ec edb649.zip \pdf_edito r_setup_Do wnloadly.i r.exe" MD5: 427D86902D064DCBDE0EB4F2D7FD601A) - pdf_editor_setup_Downloadly.ir.tmp (PID: 2200 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-BA6 9I.tmp\pdf _editor_se tup_Downlo adly.ir.tm p" /SL5="$ 601F8,2215 2334,23808 0,C:\Users \user\AppD ata\Local\ Temp\Temp1 _MDE_File_ Sample_274 f715c8cf38 126dbbd4bc ae3b6fed8e cedb649.zi p\pdf_edit or_setup_D ownloadly. ir.exe" MD5: 4BE9718959029220FC534542CB891006) - pdf_editor_setup_Downloadly.ir.exe (PID: 2884 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_274f 715c8cf381 26dbbd4bca e3b6fed8ec edb649.zip \pdf_edito r_setup_Do wnloadly.i r.exe" /SP AWNWND=$60 2C2 /NOTIF YWND=$601F 8 MD5: 427D86902D064DCBDE0EB4F2D7FD601A) - pdf_editor_setup_Downloadly.ir.tmp (PID: 3024 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-7K9 QH.tmp\pdf _editor_se tup_Downlo adly.ir.tm p" /SL5="$ 70300,2215 2334,23808 0,C:\Users \user\AppD ata\Local\ Temp\Temp1 _MDE_File_ Sample_274 f715c8cf38 126dbbd4bc ae3b6fed8e cedb649.zi p\pdf_edit or_setup_D ownloadly. ir.exe" /S PAWNWND=$6 02C2 /NOTI FYWND=$601 F8 MD5: 4BE9718959029220FC534542CB891006) 
chrome.exe (PID: 6380 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// icecreamap ps.com/PDF -Editor/th ankyou.htm l?v=3.27 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6184 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2204 --fi eld-trial- handle=195 2,i,740568 1170674473 3,44012572 7402099787 1,262144 - -disable-f eatures=Op timization GuideModel Downloadin g,Optimiza tionHints, Optimizati onHintsFet ching,Opti mizationTa rgetPredic tion /pref etch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
Patch.exe (PID: 1904 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F)
- Patch.exe (PID: 2268 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F) - chrome.exe (PID: 3644 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// icecreamap ps.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 5144 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2204 --fi eld-trial- handle=195 6,i,719648 9178614102 710,145037 9114939376 5188,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- Patch.exe (PID: 6588 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F)
- Patch.exe (PID: 2452 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_d09a c12e80d793 e2bb60f6dc 17656721cb 8751bf-2.z ip\Patch.e xe" MD5: 8E8EB38C6438BAA41A5867B6F465926F)
- icepdfeditor.exe (PID: 7044 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Temp1_ MDE_File_S ample_5947 d8bd2f31be dc98f32280 0cabd2fb85 e56117-2.z ip\icepdfe ditor.exe" MD5: 6700C9E3B5ADB8292F5FF09D1C38C920)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | Binary or memory string: | memstr_833af754-6 | |
Exploits |   |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | Window detected: | ||