A process attempted to delay the analysis task.
- Description:
- 289477f12b10e6b770b40d4c0fb028b1af46b295a91030793c7188abe9774d0b.exe tried to sleep 413 seconds, actually delayed analysis time by 413 seconds
Checks adapter addresses which can be used to detect virtual network interfaces
| PID |
API |
Arguments |
| 816 |
GetAdaptersAddresses |
- flags:
- 0
- family:
- 0
|
| 816 |
GetAdaptersAddresses |
- flags:
- 0
- family:
- 0
|
This sample is detected by clamav as: Win.Worm.Socks-9
- Description:
- Win.Worm.Socks-9
One or more AV tool detects this sample as malicious: Worm:Win32/Autorun.gen!BS
- Description:
- Worm:Win32/Autorun.gen!BS
Strings possibly contain hardcoded IP Addresses.
- Ip Address:
- 124.217.253.6
Creates executable files on the filesystem
- File:
- C:\Users\Virtual\Local Settings\Application Data\cftmon.exe
- File:
- C:\Windows\System32\drivers\spools.exe
Automatic Sequence Detection maliciousness score: 76%
Performs some HTTP requests
- Request:
- GET http://124.217.253.6/~statis00/load/?&v=up
- Request:
- GET http://hq-pharma.org/manda.php?id=-930381926&v=up
HTTP traffic contains suspicious features which may be indicative of malware related traffic
- Ip Hostname:
- HTTP connection was made to an IP address rather than domain name
- Suspicious Request:
- http://124.217.253.6/~statis00/load/?&v=up
- Suspicious Request:
- http://hq-pharma.org/manda.php?id=-930381926&v=up
Performs some DNS requests
- Dns :
- Request: hq-pharma.org IP: 18.215.128.143
The executable has PE anomalies (could be a false positive)
The binary likely contains encrypted or compressed data.
- Section:
- hbgmgi, at virtual address 0x00010000
- Entropy:
- 7.98289318573
- Description:
- A section with a high entropy has been found
- Entropy:
- 0.967509025271
- Description:
- Overall entropy of this PE file is high
Creates an Alternate Data Stream (ADS)
- File:
- \??\L:
- File:
- \??\N:
- File:
- \??\U:
- File:
- \??\H:
- File:
- \??\W:
- File:
- \??\J:
- File:
- \??\Q:
- File:
- \??\D:
- File:
- \??\S:
- File:
- \??\F:
- File:
- \??\M:
- File:
- \??\X:
- File:
- \??\O:
- File:
- \??\I:
- File:
- \??\T:
- File:
- \??\V:
- File:
- \??\K:
- File:
- \??\E:
- File:
- \??\P:
- File:
- \??\R:
- File:
- \??\G:
Installs itself for autorun at Windows startup
- Registry:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\autoload
- Registry:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ntuser
This sample contains high entropy sections
- Section:
- hbgmgi, at virtual address 0x00010000
- Entropy:
- 7.98289318573
Anomalous binary characteristics
- Anomaly:
- Actual checksum does not match that reported in PE header
Contains sections of zero entropy
- Section:
- .bss, at virtual address 0x00001000
Presents an Authenticode digital signature
