popup

Report - smwd5306.exe

Gen2 NSIS UltraVNC Generic Malware UPX Malicious Library ASPack Anti_VM Malicious Packer Antivirus PE32 PE File PE64 DLL BMP Format .NET EXE OS Processor Check GIF Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.04.21 18:21 Machine s1_win7_x6401
Filename smwd5306.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
AI Score
4
 Behavior Score
11.0
ZERO API file : malware
VT API (file) 53 detected (NSIS, malicious, high confidence, Tedy, Goobzoltd, Goobzo, Sign, grayware, confidence, Attribute, HighConfidence, SBWatchman, score, Graftor, WatchMan, Shopper, dwtebt, ShopperPro, FalseSign, Twhl, PotentialRisk, SearchModule, Searcher, Crossrider, A@5t8nd1, BrowserModifier, Smudplu, Detected, X1378, Artemis, ai score=100, unsafe, Presenoker, QM5AQyszXAS, M5GL1lxOxM, Moat, ZemsilF, lm0@aSs0j9o)
md5 dc26d49b647e26665fe94dfe5a3b6cff
sha256 2ccb241464087a1296d795e47d12ee60295876126e2cbece750241ce0cf32a89
ssdeep 98304:+KKaz/ACVrPAcKHrV+LRzADH6G3ILhAUATHCxyRocMd4v6:J5nVrohHrOADaG3ILlDxyRqdE6
imphash 59a4a44a250c4cf4f2d9de2b3fe5d95f
impfuzzy 48:3qjH5zH0OIDrQlSv5L8r+tAlt8tz4eObGLl4x0Q7XEFpV74dT+5EQX/1Eowhy6Ub:3qj5r0tDrpJTc/6aj0
  Network IP location

Signature (28cnts)

Level Description
danger File has been identified by 53 AntiVirus engines on VirusTotal as malicious
watch Collects information about installed applications
watch Created a service where a service was also not started
watch Detects VMWare through the in instruction feature
watch Installs itself for autorun at Windows startup
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a shortcut to an executable file
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Expresses interest in specific running processes
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Searches running processes potentially to identify processes for sandbox evasion
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key

Rules (23cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning NSIS_Installer Null Soft Installer binaries (download)
warning NSIS_Installer Null Soft Installer binaries (upload)
warning UltraVNC_Zero UltraVNC binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch ASPack_Zero ASPack packed file binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
info bmp_file_format bmp file format binaries (download)
info Is_DotNET_EXE (no description) binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info Lnk_Format_Zero LNK Format binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info Win32_Trojan_Gen_2_0904B0_Zero Win32 Trojan Gen binaries (download)

Network (7cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=N4LjSLF&v=2.1.5.306&md5=271b06c792838b8d992c8cd45f4a3897&mid=AAA0A3AGAJA9A9A7A3AJieie777G3DiL7L77793D1JiAA1&uid=A14B9EAF-39FF-49F6-A848-E4C05A9C6A9C
whois
Unknown 54.230.169.96 clean
http://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=N4LjSLF&v=2.1.5.306&md5=3d0118e6f5b93e2a167614e8a0d320e7&mid=AAA0A3AGAJA9A9A7A3AJieie777G3DiL7L77793D1JiAA1&uid=A14B9EAF-39FF-49F6-A848-E4C05A9C6A9C
whois
Unknown 54.230.169.96 clean
http://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=N4LjSLF&v=2.1.5.306&md5=15adccbdf2e3e994baa9e12797b52a14&mid=AAA0A3AGAJA9A9A7A3AJieie777G3DiL7L77793D1JiAA1&uid=A14B9EAF-39FF-49F6-A848-E4C05A9C6A9C
whois
Unknown 54.230.169.87 clean
pwvz71qp-ur1xo6pn.netdna-ssl.com
whois
Unknown clean
d23ocewf5ttxmu.cloudfront.net
whois
Unknown 54.230.169.173 clean
18.67.47.49
whois
Unknown 18.67.47.49 clean
54.192.60.3
whois
Unknown 54.192.60.3 clean

Suricata ids

ET POLICY Unsupported/Fake Windows NT Version 5.0

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x407060 GetTickCount
 0x407064 GetFullPathNameA
 0x407068 MoveFileA
 0x40706c SetCurrentDirectoryA
 0x407070 GetFileAttributesA
 0x407074 GetLastError
 0x407078 CreateDirectoryA
 0x40707c SetFileAttributesA
 0x407080 SearchPathA
 0x407084 GetShortPathNameA
 0x407088 CreateFileA
 0x40708c GetFileSize
 0x407090 GetModuleFileNameA
 0x407094 ReadFile
 0x407098 GetCurrentProcess
 0x40709c CopyFileA
 0x4070a0 ExitProcess
 0x4070a4 SetEnvironmentVariableA
 0x4070a8 Sleep
 0x4070ac CloseHandle
 0x4070b0 GetCommandLineA
 0x4070b4 SetErrorMode
 0x4070b8 LoadLibraryA
 0x4070bc lstrlenA
 0x4070c0 lstrcpynA
 0x4070c4 GetDiskFreeSpaceA
 0x4070c8 GlobalUnlock
 0x4070cc GlobalLock
 0x4070d0 CreateThread
 0x4070d4 CreateProcessA
 0x4070d8 RemoveDirectoryA
 0x4070dc GetTempFileNameA
 0x4070e0 lstrcpyA
 0x4070e4 lstrcatA
 0x4070e8 GetSystemDirectoryA
 0x4070ec GetVersion
 0x4070f0 GetProcAddress
 0x4070f4 GlobalAlloc
 0x4070f8 CompareFileTime
 0x4070fc SetFileTime
 0x407100 ExpandEnvironmentStringsA
 0x407104 lstrcmpiA
 0x407108 lstrcmpA
 0x40710c WaitForSingleObject
 0x407110 GlobalFree
 0x407114 GetExitCodeProcess
 0x407118 GetModuleHandleA
 0x40711c GetTempPathA
 0x407120 GetWindowsDirectoryA
 0x407124 LoadLibraryExA
 0x407128 FindFirstFileA
 0x40712c FindNextFileA
 0x407130 DeleteFileA
 0x407134 SetFilePointer
 0x407138 WriteFile
 0x40713c FindClose
 0x407140 WritePrivateProfileStringA
 0x407144 MultiByteToWideChar
 0x407148 MulDiv
 0x40714c GetPrivateProfileStringA
 0x407150 FreeLibrary
USER32.dll
 0x407174 CreateWindowExA
 0x407178 EndDialog
 0x40717c ScreenToClient
 0x407180 GetWindowRect
 0x407184 EnableMenuItem
 0x407188 GetSystemMenu
 0x40718c SetClassLongA
 0x407190 IsWindowEnabled
 0x407194 SetWindowPos
 0x407198 GetSysColor
 0x40719c GetWindowLongA
 0x4071a0 SetCursor
 0x4071a4 LoadCursorA
 0x4071a8 CheckDlgButton
 0x4071ac GetMessagePos
 0x4071b0 LoadBitmapA
 0x4071b4 CallWindowProcA
 0x4071b8 IsWindowVisible
 0x4071bc CloseClipboard
 0x4071c0 GetDC
 0x4071c4 SystemParametersInfoA
 0x4071c8 RegisterClassA
 0x4071cc TrackPopupMenu
 0x4071d0 AppendMenuA
 0x4071d4 CreatePopupMenu
 0x4071d8 GetSystemMetrics
 0x4071dc SetDlgItemTextA
 0x4071e0 GetDlgItemTextA
 0x4071e4 MessageBoxIndirectA
 0x4071e8 CharPrevA
 0x4071ec DispatchMessageA
 0x4071f0 PeekMessageA
 0x4071f4 ReleaseDC
 0x4071f8 EnableWindow
 0x4071fc InvalidateRect
 0x407200 SendMessageA
 0x407204 DefWindowProcA
 0x407208 BeginPaint
 0x40720c GetClientRect
 0x407210 FillRect
 0x407214 DrawTextA
 0x407218 GetClassInfoA
 0x40721c DialogBoxParamA
 0x407220 CharNextA
 0x407224 ExitWindowsEx
 0x407228 DestroyWindow
 0x40722c CreateDialogParamA
 0x407230 SetTimer
 0x407234 GetDlgItem
 0x407238 wsprintfA
 0x40723c SetForegroundWindow
 0x407240 ShowWindow
 0x407244 IsWindow
 0x407248 LoadImageA
 0x40724c SetWindowLongA
 0x407250 SetClipboardData
 0x407254 EmptyClipboard
 0x407258 OpenClipboard
 0x40725c EndPaint
 0x407260 PostQuitMessage
 0x407264 FindWindowExA
 0x407268 SendMessageTimeoutA
 0x40726c SetWindowTextA
GDI32.dll
 0x40703c SelectObject
 0x407040 SetBkMode
 0x407044 CreateFontIndirectA
 0x407048 SetTextColor
 0x40704c DeleteObject
 0x407050 GetDeviceCaps
 0x407054 CreateBrushIndirect
 0x407058 SetBkColor
SHELL32.dll
 0x407158 SHGetSpecialFolderLocation
 0x40715c SHGetPathFromIDListA
 0x407160 SHBrowseForFolderA
 0x407164 SHGetFileInfoA
 0x407168 ShellExecuteA
 0x40716c SHFileOperationA
ADVAPI32.dll
 0x407000 RegCloseKey
 0x407004 RegOpenKeyExA
 0x407008 RegDeleteKeyA
 0x40700c RegDeleteValueA
 0x407010 RegEnumValueA
 0x407014 RegCreateKeyExA
 0x407018 RegSetValueExA
 0x40701c RegQueryValueExA
 0x407020 RegEnumKeyA
COMCTL32.dll
 0x407028 ImageList_Create
 0x40702c ImageList_AddMasked
 0x407030 ImageList_Destroy
 0x407034 None
ole32.dll
 0x407284 CoCreateInstance
 0x407288 CoTaskMemFree
 0x40728c OleInitialize
 0x407290 OleUninitialize
VERSION.dll
 0x407274 GetFileVersionInfoSizeA
 0x407278 GetFileVersionInfoA
 0x40727c VerQueryValueA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure