Antivirus scan for e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca at 2016-05-30 21:01:47 UTC

ウイルス対策ソフト	結果	更新日
Ad-Aware	Trojan.Generic.9187771	20160530
AegisLab	Troj.Dropper.W32.Autoit.bjn!c	20160530
AhnLab-V3	Win-Trojan/Autoitdoor.699271	20160530
ALYac	Trojan.Generic.9187771	20160530
Arcabit	Trojan.Generic.D8C31BB	20160530
Avast	AutoIt:Agent-OJ [Trj]	20160530
AVG	Generic8_c.SRE	20160530
Avira (no cloud)	TR/Spy.Gen	20160530
AVware	Trojan.Win32.Generic!BT	20160530
Baidu	Win32.Worm.Autoit.z	20160530
Baidu-International	Trojan.Win32.Autoit.dhb	20160530
BitDefender	Trojan.Generic.9187771	20160530
Bkav	W32.DropperZbotS.Trojan	20160528
CAT-QuickHeal	Worm.Autoit.Jenxcus.A	20160530
CMC	Trojan.Win32.Generic!O	20160530
Comodo	UnclassifiedMalware	20160530
Cyren	W32/Trojan.PYRD-8357	20160530
DrWeb	Trojan.MulDrop4.46259	20160530
Emsisoft	Trojan.Generic.9187771 (B)	20160530
ESET-NOD32	Win32/Autoit.IV	20160530
F-Secure	Trojan.Generic.9187771	20160530
Fortinet	W32/Inject.EYEW!tr	20160530
GData	Trojan.Generic.9187771	20160530
Ikarus	Worm.Win32.AutoIt	20160530
Jiangmin	Trojan.MSIL.aeui	20160530
K7AntiVirus	Trojan ( 700000111 )	20160530
K7GW	Trojan ( 700000111 )	20160530
Kaspersky	Trojan.Win32.Autoit.dhb	20160530
McAfee	Artemis!61E6BE4E6DDE	20160530
McAfee-GW-Edition	BehavesLike.Win32.Worm.jh	20160530
Microsoft	Worm:Win32/Wervik.A	20160530
eScan	Trojan.Generic.9187771	20160530
NANO-Antivirus	Trojan.Script.Agent.debwym	20160530
nProtect	Trojan.Generic.9187771	20160530
Panda	Trj/CI.A	20160530
Qihoo-360	HEUR/QVM10.1.Malware.Gen	20160530
Rising	Trjoan.Generic-MozRuwERu0D (Cloud)	20160530
Sophos	W32/Wervik-A	20160530
Symantec	SAPE.Heur.328e	20160530
Tencent	Win32.Trojan.Autoit.Wpjq	20160530
TheHacker	Backdoor/Poison.evja	20160530
TrendMicro	TROJ_SPNR.06FD13	20160530
TrendMicro-HouseCall	TROJ_SPNR.06FD13	20160530
VBA32	Trojan.Autoit.Wirus	20160530
VIPRE	Trojan.Win32.Generic!BT	20160530
ViRobot	Trojan.Win32.S.Agent.698837[h]	20160530
Zillya	Dropper.Autoit.Win32.1879	20160528
Alibaba		20160530
Antiy-AVL		20160530
ClamAV		20160530
F-Prot		20160530
Kingsoft		20160530
Malwarebytes		20160530
SUPERAntiSpyware		20160530
TotalDefense		20160530
Yandex		20160530
Zoner		20160530

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

File version 3, 3, 8, 1

Packers identified

F-PROT AutoIt, UTF-8

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2012-01-29 21:32:28

Entry Point 0x000165C1

Number of sections 4

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 525852 526336 6.68 61ffce4768976fa0dd2a8f6a97b1417a

.rdata 532480 57280 57344 4.80 0354bc5f2376b5e9a4a3ba38b682dff1

.data 589824 108376 26624 2.15 8033f5a38941b4685bc2299e78f31221

.rsrc 700416 37672 37888 5.54 495451d7eb8326bd9fa2714869ea6de8

Overlays

MD5 167809e8fa73987bba5f9d30cd93d161

File type data

Offset 649216

Size 49621

Entropy 8.00

PE imports

GetStdHandle

GetDriveTypeW

FileTimeToSystemTime

WaitForSingleObject

GetPrivateProfileSectionNamesW

GetFileAttributesW

GetLocalTime

DeleteCriticalSection

GetCurrentProcess

GetConsoleMode

UnhandledExceptionFilter

SetErrorMode

FreeEnvironmentStringsW

SetStdHandle

WideCharToMultiByte

GetDiskFreeSpaceW

InterlockedExchange

WriteFile

GetSystemTimeAsFileTime

GlobalMemoryStatusEx

HeapReAlloc

GetStringTypeW

GetExitCodeProcess

FormatMessageW

ResumeThread

GetTimeZoneInformation

LoadResource

FindClose

InterlockedDecrement

MoveFileW

SetFileAttributesW

GetCurrentThread

GetEnvironmentVariableW

SetLastError

DeviceIoControl

TlsGetValue

CopyFileW

WriteProcessMemory

OutputDebugStringW

RemoveDirectoryW

Beep

IsDebuggerPresent

HeapAlloc

LoadLibraryA

RaiseException

WritePrivateProfileSectionW

GetVolumeInformationW

LoadLibraryExW

MultiByteToWideChar

SetFilePointerEx

GetPrivateProfileStringW

GetFullPathNameW

CreateThread

SetEnvironmentVariableW

GetSystemDirectoryW

CreatePipe

SetUnhandledExceptionFilter

MulDiv

IsProcessorFeaturePresent

ExitThread

SetEnvironmentVariableA

SetPriorityClass

TerminateProcess

SetCurrentDirectoryW

GlobalAlloc

LocalFileTimeToFileTime

GetDiskFreeSpaceExW

SetEndOfFile

GetCurrentThreadId

InterlockedIncrement

WriteConsoleW

CreateToolhelp32Snapshot

InitializeCriticalSectionAndSpinCount

HeapFree

EnterCriticalSection

SetHandleCount

TerminateThread

LoadLibraryW

GetVersionExW

SetEvent

QueryPerformanceCounter

GetTickCount

TlsAlloc

FlushFileBuffers

lstrcmpiW

RtlUnwind

FreeLibrary

GetProcessIoCounters

GetWindowsDirectoryW

GetFileSize

OpenProcess

GetDateFormatW

GetStartupInfoW

ReadProcessMemory

CreateDirectoryW

DeleteFileW

GlobalLock

GetProcessHeap

GetTempFileNameW

GetComputerNameW

EnumResourceNamesW

CompareStringW

lstrcpyW

GetModuleFileNameW

FindNextFileW

CreateHardLinkW

FindFirstFileW

DuplicateHandle

GetProcAddress

SetVolumeLabelW

GetPrivateProfileSectionW

CreateEventW

CreateFileW

GetFileType

TlsSetValue

ExitProcess

LeaveCriticalSection

GetLastError

SystemTimeToFileTime

LCMapStringW

GetShortPathNameW

VirtualAllocEx

GetSystemInfo

GlobalFree

GetConsoleCP

FindResourceW

GetTimeFormatW

GetEnvironmentStringsW

GlobalUnlock

lstrlenW

Process32NextW

CreateProcessW

FileTimeToLocalFileTime

SizeofResource

GetCurrentDirectoryW

VirtualFreeEx

GetCurrentProcessId

LockResource

SetFileTime

GetCommandLineW

GetCPInfo

HeapSize

SetSystemPowerState

Process32FirstW

WritePrivateProfileStringW

QueryPerformanceFrequency

TlsFree

SetFilePointer

ReadFile

CloseHandle

GetACP

GetModuleHandleW

IsValidCodePage

HeapCreate

GetTempPathW

VirtualFree

Sleep

VirtualAlloc

GetOEMCP

RedrawWindow

GetForegroundWindow

UnregisterHotKey

DrawTextW

SetUserObjectSecurity

DestroyMenu

PostQuitMessage

SetWindowPos

IsWindow

EndPaint

OpenWindowStationW

WindowFromPoint

CharUpperBuffW

VkKeyScanW

SetMenuItemInfoW

SetActiveWindow

GetDC

GetCursorPos

ReleaseDC

GetMenuStringW

GetMenu

IsWindowEnabled

GetClientRect

CreateAcceleratorTableW

SetMenuDefaultItem

IsClipboardFormatAvailable

LoadImageW

CountClipboardFormats

BlockInput

GetActiveWindow

RegisterHotKey

OpenClipboard

GetWindowTextW

LockWindowUpdate

GetWindowTextLengthW

CopyImage

PtInRect

GetParent

GetCursorInfo

AttachThreadInput

EnumWindows

GetMessageW

ShowWindow

GetCaretPos

DrawFrameControl

GetDesktopWindow

IsCharAlphaW

PeekMessageW

InsertMenuItemW

TranslateMessage

BeginPaint

SetClipboardData

DestroyWindow

OpenDesktopW

IsZoomed

LoadStringW

DrawMenuBar

IsCharLowerW

IsIconic

TrackPopupMenuEx

DrawFocusRect

CreateMenu

IsDialogMessageW

FlashWindow

EnumThreadWindows

MonitorFromPoint

CopyRect

GetSysColorBrush

CreateWindowExW

GetWindowLongW

CharNextW

SetFocus

RegisterWindowMessageW

GetMonitorInfoW

EmptyClipboard

IsCharAlphaNumericW

DefWindowProcW

GetKeyboardLayoutNameW

KillTimer

MapVirtualKeyW

CheckMenuRadioItem

GetClipboardData

GetSystemMetrics

SetWindowLongW

GetWindowRect

InflateRect

SetCapture

ReleaseCapture

EnumChildWindows

SetProcessWindowStation

SendDlgItemMessageW

SetKeyboardState

MonitorFromRect

CreatePopupMenu

GetSubMenu

GetClassLongW

SetWindowTextW

SetTimer

GetDlgItem

SendInput

ClientToScreen

PostMessageW

CloseWindowStation

GetKeyboardState

GetMenuItemCount

IsDlgButtonChecked

DestroyAcceleratorTable

CreateIconFromResourceEx

LoadCursorW

LoadIconW

FindWindowExW

GetMenuItemID

FillRect

SetForegroundWindow

GetProcessWindowStation

ExitWindowsEx

GetMenuItemInfoW

GetAsyncKeyState

EnableWindow

CharLowerBuffW

SetLayeredWindowAttributes

EndDialog

FindWindowW

GetDlgCtrlID

ScreenToClient

MessageBeep

GetWindowThreadProcessId

MessageBoxW

SendMessageW

RegisterClassExW

SetMenu

MoveWindow

DialogBoxParamW

MessageBoxA

IsCharUpperW

GetWindowDC

AdjustWindowRectEx

mouse_event

SendMessageTimeoutW

GetSysColor

keybd_event

GetKeyState

DestroyIcon

IsWindowVisible

SystemParametersInfoW

DispatchMessageW

FrameRect

SetRect

DeleteMenu

InvalidateRect

GetUserObjectSecurity

GetClassNameW

CloseDesktop

IsMenu

GetFocus

wsprintfW

CloseClipboard

TranslateAcceleratorW

DefDlgProcW

SetCursor

Number of PE resources by type

RT_ICON 12

RT_STRING 7

RT_GROUP_ICON 4

RT_DIALOG 1

RT_MANIFEST 1

RT_MENU 1

RT_VERSION 1

Number of PE resources by language

ENGLISH UK 25

ENGLISH US 2

PE resources

08bcba5aa989c988ea18f8101c84daaee58d4f0b584535a85186c8b98b66147e data

10d8d1d5d34a6d375fe241ef289d303f40e59680b8c33b0307325f03a3f2185e data

245fc49e4e955e1db3975b826dcf27ad2eb32a6831caa4cb6b501a3914bcfaa9 data

3beadf2cf64cbd321f31a554775f7839eebc911a695a7815731f9933cd873a71 data

3f37dba0277dc704f072aaf3e740c2bee9ac04f79982fd41662dfc94e7bfda2e ASCII text

4854e5abce2237256df24b69c9759fc1e8caa423a54bfe661ba7031afd8375eb ASCII text

4c78e116fb08293b0883a8d1fa1a8b58c1c08fbd1c2aa89d1a41951632d18c0e data

54f5e2ecbfc4f87380ca7466337676b99d0c4a21f806cf83f69fd48934c857ab data

5d62d392a0f454a05c957c41003db41c4faabf09156725ca8ce9d6622b22ca71 data

62ba0b2575098d4428c9a99bd060ef7572071698bf9d03b4bd430f5f691378e5 data

ExifTool file metadata

UninitializedDataSize

LinkerVersion

10.0

ImageVersion

0.0

FileVersionNumber

3.3.8.1

LanguageCode

English (British)

FileFlagsMask

0x0017

CharacterSet

Unicode

InitializedDataSize

121856

EntryPoint

0x165c1

MIMEType

application/octet-stream

FileVersion

3, 3, 8, 1

TimeStamp

2012:01:29 22:32:28+01:00

FileType

Win32 EXE

PEType

PE32

SubsystemVersion

5.0

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

CompiledScript

AutoIt v3 Script: 3, 3, 8, 1

MachineType

Intel 386 or later, and compatibles

CodeSize

526336

FileSubtype

ProductVersionNumber

3.3.8.1

FileTypeExtension

exe

ObjectFileType

Unknown

File identification

MD5 61e6be4e6dde05cce9383a2da2431ceb

SHA1 2fe5dce8fd6403bea5fec2e9ec646929e05a3b60

SHA256 e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca

ssdeep

12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCSRfxoH:uRmJkcoQricOIQxiZY1iaC0xoH

authentihash a8fd45b6287df7d19ecc31b9b11a17988ab6eb1eb6ed7e5c7782801e0e0ced56

imphash d3bf8a7746a8d1ee8f6e5960c3f69378

File size 682.5 KB ( 698837 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win32 Executable MS Visual C++ (generic) (67.4%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%)

VirusTotal metadata

First submission 2013-05-20 14:26:48 UTC (3 年, 10 ヶ月前)

Last submission 2013-05-30 14:17:04 UTC (3 年, 10 ヶ月前)

ファイル名

java.exe
61e6be4e6dde05cce9383a2da2431ceb

Advanced heuristic and reputation engines

Symantec reputation Suspicious.Insight

サインインしていません。登録ユーザーのみがコメントを投稿できます。サインインして意見をお聞かせください。

サインインコミュニティに参加

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca (successful)

\\.\PIPE\lsarpc (successful)

\\.\MountPointManager (successful)

\\.\PIPE\wkssvc (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\java.exe (successful)

C:\WINDOWS\system32\netsh.exe (successful)

C:\WINDOWS\system32\xpob2res.dll (successful)

C:\WINDOWS\system32\xpsp2res.dll (successful)

Read files

C:\e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca (successful)

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\java.exe (successful)

C:\WINDOWS\system32\netsh.exe (successful)

Copied files

SRC: C:\e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe
DST: C:\Documents and Settings\<USER>\Start Menu\Programs\Startup\java.exe (successful)

Set keys

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a20cd692-8e41-11e1-9999-806d6172696f}\\BaseClass
TYPE: REG_SZ
VALUE: Drive (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
TYPE: REG_SZ
VALUE: C:\Documents and Settings\<USER>\My Documents (successful)

KEY: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
TYPE: REG_SZ
VALUE: C:\Documents and Settings\All Users\Documents (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
TYPE: REG_SZ
VALUE: C:\Documents and Settings\<USER>\Desktop (successful)

KEY: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
TYPE: REG_SZ
VALUE: C:\Documents and Settings\All Users\Desktop (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProxyBypass
TYPE: REG_DWORD
VALUE: 1 (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\IntranetName
TYPE: REG_DWORD
VALUE: 1 (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\UNCAsIntranet
TYPE: REG_DWORD
VALUE: 1 (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\(null)\C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe
TYPE: REG_SZ
VALUE: java (successful)

KEY: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\(null)\C:\WINDOWS\system32\netsh.exe
TYPE: REG_SZ
VALUE: Network Command Shell (successful)

Created processes

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe" "del" C:\e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca" (successful)

C:\WINDOWS\system32\netsh.exe C:\WINDOWS\system32\netsh.exe" firewall add allowedprogram "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe" "java.exe" ENABLE" (successful)

Shell commands

() C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exedel" C:\e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca" [(null)] (successful)

() netshfirewall add allowedprogram C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\java.exe" "java.exe" ENABLE" [] (successful)

Created mutexes

tempjava.exe (successful)

Opened mutexes

ShimCacheMutex (successful)

Opened service managers

MACHINE: localhost
DATABASE: ServicesActive (successful)

Opened services

NapAgent (successful)

Runtime DLLs

kernel32.dll (successful)

uxtheme.dll (successful)

ole32.dll (successful)

setupapi.dll (successful)

rpcrt4.dll (successful)

shell32.dll (successful)

comctl32.dll (successful)

netapi32 (successful)

clbcatq.dll (successful)

secur32.dll (successful)

Additional details

The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.

The file sends control codes directly to certain device drivers making use of the DeviceIoControl Windows API function.

DNS requests

winserver.zapto.org (105.136.131.149)

TCP connections

105.136.131.149:1888

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	e1ee5facc6cf8a3c2df22c6b649cb56946180c7fcf90d4266b7ce622bd8403ca
ファイル名:	java.exe
検出率:	47 / 57
分析日時:	2016-05-30 21:01:47 UTC (10 ヶ月前)

Ciphered bundle