Exes_98d500945db83d542c3fdf09103a7f42_exe_2019-07-21_17_30.txt

* MalFamily: "TrojanDropper"

* MalScore: 10.0

* File Name: "Exes_98d500945db83d542c3fdf09103a7f42.exe"
* File Size: 53760
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "ddd22f55bb62a58d18c5c5797a078964df478597676089ad231d936044d7427f"
* MD5: "98d500945db83d542c3fdf09103a7f42"
* SHA1: "c498cfce18459c7e53f749a188d34b0d02edfd8a"
* SHA512: "b9cbc1aa738384d0e383676ebb34d6acc90205dadb33eb80fb5cb8460dcc73237d8e6356e7ec00c01b58ccbdc0814cac756f9067d56930a45b58b8aa54284ff4"
* CRC32: "8BE79A52"
* SSDEEP: "768:aHyEBK+o6yMPqgRDMa6RwuFQXQ/6p/4Jk8gqCfFC:aHL1Rt2/BFJkkUF"

* Process Execution:
    "Exes_98d500945db83d542c3fdf09103a7f42.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
        "Details":

                "IP": "67.229.196.122:10752"




        "Description": "A process attempted to delay the analysis task.",
        "Details":

                "Process": "Exes_98d500945db83d542c3fdf09103a7f42.exe tried to sleep 902 seconds, actually delayed analysis time by 0 seconds"




        "Description": "File has been identified by 63 Antiviruses on VirusTotal as malicious",
        "Details":

                "Bkav": "W32.Svchobst.Trojan"


                "MicroWorld-eScan": "Trojan.Dropper.YRX"


                "CAT-QuickHeal": "Trojan.Mauvaise.SL1"


                "McAfee": "DoS-FAR!98D500945DB8"


                "Cylance": "Unsafe"


                "Zillya": "Trojan.Agent.Win32.460378"


                "SUPERAntiSpyware": "Trojan.Agent/Gen-Morix"


                "K7AntiVirus": "Trojan ( 0049587e1 )"


                "Alibaba": "TrojanDropper:Win32/Dorifel.6da289bd"


                "K7GW": "Trojan ( 0049587e1 )"


                "Cybereason": "malicious.45db83"


                "TrendMicro": "TROJ_YODDOS.SMR"


                "Baidu": "Win32.Trojan.Agent.gr"


                "F-Prot": "W32/S-d71876f0!Eldorado"


                "Symantec": "ML.Attribute.HighConfidence"


                "TotalDefense": "Win32/Tnega.TIYXbaD"


                "APEX": "Malicious"


                "Avast": "Win32:Nitol-B Trj"


                "ClamAV": "Win.Malware.Yoddos-6992402-0"


                "Kaspersky": "Trojan-Dropper.Win32.Dorifel.axfp"


                "BitDefender": "Trojan.Dropper.YRX"


                "NANO-Antivirus": "Trojan.Win32.Click3.ctkwdy"


                "Paloalto": "generic.ml"


                "AegisLab": "Trojan.Win32.Patched.lNhi"


                "Tencent": "Win32.Trojan-dropper.Dorifel.Hwmn"


                "Endgame": "malicious (high confidence)"


                "Emsisoft": "Trojan.Dropper.YRX (B)"


                "Comodo": "TrojWare.Win32.Dynamer.JLS@5s363p"


                "F-Secure": "Trojan.TR/Graftor.ytsgd"


                "DrWeb": "Trojan.Click3.28277"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.qt"


                "FireEye": "Generic.mg.98d500945db83d54"


                "Sophos": "Mal/Generic-S"


                "SentinelOne": "DFI - Malicious PE"


                "Cyren": "W32/QQhelper.C.gen!Eldorado"


                "Jiangmin": "Trojan/Generic.baish"


                "Webroot": "W32.Malware.Gen"


                "Avira": "TR/Graftor.ytsgd"


                "Microsoft": "Trojan:Win32/Togapy.A!bit"


                "ViRobot": "Trojan.Win32.Ransom.53760.B"


                "ZoneAlarm": "Trojan-Dropper.Win32.Dorifel.axfp"


                "GData": "Trojan.Dropper.YRX"


                "TACHYON": "Trojan/W32.Agent.53760.AGX"


                "AhnLab-V3": "Trojan/Win32.Downloader.R97609"


                "Acronis": "suspicious"


                "VBA32": "BScope.Trojan.Bulta"


                "ALYac": "Trojan.Dropper.YRX"


                "MAX": "malware (ai score=100)"


                "Ad-Aware": "Trojan.Dropper.YRX"


                "Malwarebytes": "Trojan.Agent.QSS"


                "Zoner": "Trojan.Win32.29069"


                "ESET-NOD32": "a variant of Win32/Agent.VOM"


                "TrendMicro-HouseCall": "TROJ_YODDOS.SMR"


                "Rising": "Trojan.Farfli!1.65C0 (CLASSIC)"


                "Yandex": "Trojan.Graftor!Yk/ayiYcGzo"


                "Ikarus": "Trojan.Win32.Togapy"


                "eGambit": "Unsafe.AI_Score_91%"


                "Fortinet": "W32/Agent.VOM!tr"


                "AVG": "Win32:Nitol-B Trj"


                "Panda": "Trj/Genetic.gen"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "Qihoo-360": "Win32/Trojan.Dropper.eed"




        "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
        "Details":


        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Malware.Yoddos-6992402-0, sha256:ddd22f55bb62a58d18c5c5797a078964df478597676089ad231d936044d7427f, type:PE32 executable (GUI) Intel 80386, for MS Windows"




        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Actual checksum does not match that reported in PE header"





* Started Service:

* Mutexes:
    "pf1.f3322.net:10752",
    "DBWinMutex"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

        "type": "A",
        "request": "pf1.f3322.net",
        "answers":

                "data": "67.229.196.122",
                "type": "A"





* Domains:

        "ip": "67.229.196.122",
        "domain": "pf1.f3322.net"



* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: