Zips_6764d481442d801167012f7681fb113b_2_2019-06-27_17_30.json

[*] MalFamily: "Ursu"

[*] MalScore: 10.0

[*] File Name: "Zips_6764d481442d801167012f7681fb113b.2"
[*] File Size: 11960748
[*] File Type: "Zip archive data, at least v2.0 to extract"
[*] SHA256: "742ecf7b71060e0b422632225712e394950a36d296e67f910bf9c4673aa66801"
[*] MD5: "6764d481442d801167012f7681fb113b"
[*] SHA1: "9c47bbdf1e9209b2a3a8383d8e8a74ac672cccc3"
[*] SHA512: "edf89dfe238bfc7798c17e21b0484fe99364d81d9576071b48baa7e1f0c8f933644e7224556585b9f269c1474ac0da86c9151e5cf88944a0d3d9bfc2539ccfe0"
[*] CRC32: "9BF4EF5B"
[*] SSDEEP: "196608:y5qo5E8q7bQTKlBDSBUN/nigJEi0iyE3JoNeSzIRsVrssgIDq:eNqMuH2CN/igJvH3JoISLVXgh"

[*] Process Execution: [
    "exe.png"
]

[*] Signatures Detected: [
    {
        "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "Bkav": "HW32.Packed."
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Kaspersky": "not-a-virus:HEUR:RiskTool.Win32.Generic"
            },
            {
                "BitDefender": "Gen:Variant.Ursu.311378"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Emsisoft": "Gen:Variant.Ursu.311378 (B)"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "FireEye": "Gen:Variant.Ursu.311378"
            },
            {
                "Jiangmin": "Trojan.Miner.ffr"
            },
            {
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            },
            {
                "Arcabit": "Trojan.Ursu.D4C052"
            },
            {
                "ZoneAlarm": "not-a-virus:HEUR:RiskTool.Win32.Generic"
            },
            {
                "GData": "Gen:Variant.Ursu.311378"
            },
            {
                "AhnLab-V3": "Malware/Win32.Generic.C3273244"
            },
            {
                "ALYac": "Gen:Variant.Ursu.311378"
            },
            {
                "MAX": "malware (ai score=84)"
            },
            {
                "ESET-NOD32": "a variant of Win32/Packed.VMProtect.CW"
            },
            {
                "Rising": "Malware.Heuristic.MLite(86%) (AI-LITE:rDPSA9qfwnN7/Y4L2wToag)"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: [
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "DefaultTabtip-MainUI",
    "Local\\Shell.CMruPidlList"
]

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}

[*] Resolved APIs: [
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsFree",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "kernel32.dll.GetNativeSystemInfo",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.OleInitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "comctl32.dll.#320",
    "comctl32.dll.RegisterClassNameW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "uxtheme.dll.EnableThemeDialogTexture",
    "uxtheme.dll.OpenThemeData",
    "comctl32.dll.HIMAGELIST_QueryInterface",
    "comctl32.dll.DrawShadowText",
    "comctl32.dll.DrawSizeBox",
    "comctl32.dll.DrawScrollBar",
    "comctl32.dll.SizeBoxHwnd",
    "comctl32.dll.ScrollBar_MouseMove",
    "comctl32.dll.ScrollBar_Menu",
    "comctl32.dll.HandleScrollCmd",
    "comctl32.dll.DetachScrollBars",
    "comctl32.dll.AttachScrollBars",
    "comctl32.dll.CCSetScrollInfo",
    "comctl32.dll.CCGetScrollInfo",
    "comctl32.dll.CCEnableScrollBar",
    "comctl32.dll.QuerySystemGestureStatus",
    "uxtheme.dll.#49",
    "uxtheme.dll.CloseThemeData",
    "uxtheme.dll.IsThemePartDefined",
    "uxtheme.dll.GetThemeFont",
    "uxtheme.dll.GetThemeColor",
    "uxtheme.dll.GetThemeBool",
    "imm32.dll.ImmIsIME",
    "uxtheme.dll.GetThemeMargins",
    "uxtheme.dll.GetThemeInt",
    "uxtheme.dll.SetWindowTheme",
    "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
    "ole32.dll.CoGetMalloc",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "gdi32.dll.GetTextFaceAliasW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegEnumKeyExW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoRevokeInitializeSpy",
    "imm32.dll.ImmGetContext",
    "imm32.dll.ImmLockIMC",
    "imm32.dll.ImmUnlockIMC",
    "imm32.dll.ImmReleaseContext",
    "imm32.dll.ImmSetCompositionFontW",
    "uxtheme.dll.DrawThemeBackground",
    "imm32.dll.ImmGetCompositionWindow",
    "imm32.dll.ImmSetCompositionWindow",
    "comctl32.dll.#411",
    "comctl32.dll.#410",
    "ole32.dll.CLSIDFromString",
    "uxtheme.dll.GetThemePartSize",
    "uxtheme.dll.GetThemeTextExtent",
    "comctl32.dll.#413",
    "comctl32.dll.#328",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "comctl32.dll.#334",
    "comctl32.dll.InitCommonControlsEx",
    "kernel32.dll.QueryActCtxW",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.DeactivateActCtx",
    "comctl32.dll.LoadIconWithScaleDown",
    "ntdll.dll.RtlRunEncodeUnicodeString",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlRunDecodeUnicodeString",
    "duser.dll.InitGadgets",
    "user32.dll.RegisterMessagePumpHook",
    "uxtheme.dll.GetThemeTextMetrics",
    "uxtheme.dll.IsCompositionActive",
    "uxtheme.dll.GetThemeBackgroundExtent",
    "comctl32.dll.ImageList_LoadImageW",
    "comctl32.dll.ImageList_CoCreateInstance",
    "windowscodecs.dll.WICCreateImagingFactory_Proxy",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryValueW",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "apphelp.dll.ApphelpCheckShellObject",
    "shlwapi.dll.PathRemoveFileSpecW",
    "comctl32.dll.#321",
    "comctl32.dll.#325",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "duser.dll.CreateGadget",
    "duser.dll.SetGadgetMessageFilter",
    "duser.dll.SetGadgetStyle",
    "duser.dll.SetGadgetRootInfo",
    "uxtheme.dll.GetCurrentThemeName",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.GetThemeAppProperties",
    "ole32.dll.CreateStreamOnHGlobal",
    "xmllite.dll.CreateXmlReader",
    "xmllite.dll.CreateXmlReaderInputWithEncodingName",
    "oleaut32.dll.#6",
    "duser.dll.InvalidateGadget",
    "duser.dll.GetGadgetTicket",
    "duser.dll.SetGadgetParent",
    "msftedit.dll.CreateTextServices",
    "ole32.dll.OleUninitialize",
    "msls31.dll.#71",
    "msls31.dll.#1",
    "msls31.dll.#52",
    "msls31.dll.#48",
    "msls31.dll.#3",
    "msls31.dll.#44",
    "duser.dll.SetGadgetRect",
    "uxtheme.dll.BufferedPaintInit",
    "ole32.dll.StringFromGUID2",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoGetApartmentType",
    "comctl32.dll.#236",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "oleaut32.dll.#2",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "comctl32.dll.#332",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#338",
    "comctl32.dll.#386",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "comctl32.dll.#388",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "propsys.dll.PropVariantToStringAlloc",
    "ole32.dll.PropVariantClear",
    "propsys.dll.PSGetPropertyDescription",
    "ole32.dll.PropVariantCopy",
    "comctl32.dll.#330",
    "ntdll.dll.RtlDllShutdownInProgress",
    "comctl32.dll.#329",
    "linkinfo.dll.IsValidLinkInfo",
    "propsys.dll.#407",
    "sechost.dll.ConvertSidToStringSidW",
    "propsys.dll.#417",
    "propsys.dll.PSGetNameFromPropertyKey",
    "propsys.dll.PSStringFromPropertyKey",
    "propsys.dll.InitVariantFromBuffer",
    "oleaut32.dll.#9",
    "propsys.dll.PropVariantToGUID",
    "ole32.dll.CoMarshalInterThreadInterfaceInStream",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "ole32.dll.CoGetInterfaceAndReleaseStream",
    "oleaut32.dll.#500",
    "propsys.dll.PropVariantToUInt32",
    "propsys.dll.PSPropertyBag_ReadStr",
    "oleaut32.dll.#8",
    "oleaut32.dll.#150",
    "propsys.dll.PSPropertyBag_ReadDWORD",
    "propsys.dll.PSPropertyBag_ReadStrAlloc",
    "propsys.dll.PSPropertyBag_ReadGUID",
    "propsys.dll.PSPropertyBag_ReadBOOL",
    "propsys.dll.PSGetPropertyKeyFromName",
    "oleaut32.dll.#12",
    "propsys.dll.PropVariantToBooleanWithDefault",
    "propsys.dll.PSGetPropertyDescriptionListFromString",
    "shell32.dll.SHCreateItemFromIDList",
    "shell32.dll.#18",
    "shell32.dll.#155"
]

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}