Automated Malware Analysis Report for Imageio-2.8.0
Total Page:16
File Type:pdf, Size:1020Kb
ID: 228893 Sample Name: imageio-2.8.0- py3-none-any.whl Cookbook: default.jbs Time: 04:10:40 Date: 11/05/2020 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report imageio-2.8.0-py3-none-any.whl 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification Spiderchart 5 Mitre Att&ck Matrix 5 Signature Overview 6 Software Vulnerabilities: 6 Networking: 6 System Summary: 6 Hooking and other Techniques for Hiding and Protection: 6 Malware Analysis System Evasion: 7 Anti Debugging: 7 HIPS / PFW / Operating System Protection Evasion: 7 Language, Device and Operating System Detection: 7 Malware Configuration 7 Behavior Graph 7 Simulations 8 Behavior and APIs 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 8 Domains 8 URLs 8 Yara Overview 8 Initial Sample 8 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Sigma Overview 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 9 Dropped Files 9 Screenshots 9 Thumbnails 9 Startup 10 Created / dropped Files 10 Domains and IPs 25 Contacted Domains 25 URLs from Memory and Binaries 25 Contacted IPs 26 Static File Info 26 General 26 File Icon 26 Network Behavior 27 Code Manipulations 27 Statistics 27 Behavior 27 System Behavior 27 Analysis Process: unarchiver.exe PID: 3980 Parent PID: 1260 27 Copyright Joe Security LLC 2020 Page 2 of 66 General 27 File Activities 27 File Created 28 File Written 28 File Read 29 Analysis Process: 7za.exe PID: 4740 Parent PID: 3980 29 General 29 File Activities 29 File Created 29 File Written 32 File Read 65 Analysis Process: conhost.exe PID: 2336 Parent PID: 4740 65 General 65 Disassembly 66 Code Analysis 66 Copyright Joe Security LLC 2020 Page 3 of 66 Analysis Report imageio-2.8.0-py3-none-any.whl Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 228893 Start date: 11.05.2020 Start time: 04:10:40 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 3m 32s Hypervisor based Inspection enabled: false Report type: light Sample file name: imageio-2.8.0-py3-none-any.whl (renamed file extension from whl to zip) Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 3 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis Mode: default Analysis stop reason: Timeout Detection: CLEAN Classification: clean2.winZIP@4/51@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated Warnings: Show All Execution Graph export aborted for target unarchiver.exe, PID 3980 because it is empty Detection Strategy Score Range Reporting Whitelisted Detection Threshold 2 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2020 Page 4 of 66 Strategy Score Range Further Analysis Required? Confidence Threshold 5 0 - 5 false Classification Spiderchart Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Mitre Att&ck Matrix Copyright Joe Security LLC 2020 Page 5 of 66 Initial Privilege Credential Lateral Command Network Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Effects Valid Windows Winlogon Process Disabling Security Credential Virtualization/Sandbox Application Data from Data Standard Eavesdrop on Accounts Remote Helper DLL Injection 1 1 Tools 1 Dumping Evasion 2 Deployment Local Encrypted 1 Cryptographic Insecure Management Software System Protocol 1 Network Communication Replication Service Port Accessibility Virtualization/Sandbox Network System Information Remote Data from Exfiltration Fallback Exploit SS7 to Through Execution Monitors Features Evasion 2 Sniffing Discovery 2 Services Removable Over Other Channels Redirect Phone Removable Media Network Calls/SMS Media Medium External Windows Accessibility Path Process Input Query Registry Windows Data from Automated Custom Exploit SS7 to Remote Management Features Interception Injection 1 1 Capture Remote Network Exfiltration Cryptographic Track Device Services Instrumentation Management Shared Protocol Location Drive Drive-by Scheduled System DLL Search Obfuscated Files or Credentials System Network Logon Input Data Multiband SIM Card Compromise Task Firmware Order Information 1 in Files Configuration Scripts Capture Encrypted Communication Swap Hijacking Discovery Signature Overview • Software Vulnerabilities • Networking • System Summary • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section Software Vulnerabilities: Found inlined nop instructions (likely shell or obfuscated code) Networking: Urls found in memory or binary data System Summary: Detected potential crypto function Classification label Creates mutexes Creates temporary files Parts of this applications are using the .NET runtime (Probably coded in C#) Reads software policies Spawns processes Submission file is bigger than most known malware samples Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Copyright Joe Security LLC 2020 Page 6 of 66 Malware Analysis System Evasion: Contains long sleeps (>= 3 min) May sleep (evasive loops) to hinder dynamic analysis Anti Debugging: Creates guard pages, often used to prevent reverse engineering and debugging HIPS / PFW / Operating System Protection Evasion: Creates a process in suspended mode (likely to inject code) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Malware Configuration No configs have been found Behavior Graph Hide Legend Legend: Process Signature Behavior Graph Created File ID: 228893 DNS/IP Info Sample: imageio-2.8.0-py3-none-any.whl Is Dropped Startdate: 11/05/2020 Architecture: WINDOWS Is Windows Process Score: 2 Number of created Registry Values started Number of created Files unarchiver.exe Visual Basic Delphi 5 Java .Net C# or VB.NET started C, C++ or other language 7za.exe Is malicious Internet 63 dropped dropped dropped dropped C:\Users\user\AppData\Local\...\testing.py, Python C:\Users\user\AppData\Local\...\tifffile.py, Python C:\Users\user\AppData\Local\Temp\...\swf.py, Python 33 other files (none is malicious) started conhost.exe Copyright Joe Security LLC 2020 Page 7 of 66 Simulations Behavior and APIs No simulations Antivirus, Machine Learning and Genetic Malware Detection Initial Sample Source Detection Scanner Label Link imageio-2.8.0-py3-none-any.zip 0% Virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches URLs Source Detection Scanner Label Link www.digitalpreservation.gov/formats/content/tiff_tags.shtml 0% Virustotal Browse www.digitalpreservation.gov/formats/content/tiff_tags.shtml 0% Avira URL Cloud safe bsdf.io 0% Virustotal Browse bsdf.io 0% Avira URL Cloud safe cellcognition.org/ 0% Virustotal Browse cellcognition.org/ 0% Avira URL Cloud safe www.cipa.jp/std/documents/e/DC-008-Translation-2016-E.pdf 0% Virustotal Browse www.cipa.jp/std/documents/e/DC-008-Translation-2016-E.pdf 0% Avira URL Cloud safe https://raw.githubusercontent.com/python-pillow/Pillow/master/docs/handbook/image-file- 0% Avira URL Cloud safe formats.rst www.micro-manager.org/wiki/Micro-Manager_File_Formats 0% Avira URL Cloud safe www.bioimagexd.net/ 0% Virustotal Browse www.bioimagexd.net/ 0% Avira URL Cloud safe www.awaresystems.be/imaging/tiff/faq.html 0% Virustotal Browse www.awaresystems.be/imaging/tiff/faq.html 0% Avira URL Cloud safe www.openmicroscopy.org/site/support/file-formats/ome-tiff 0% Avira URL Cloud safe www.dicomlibrary.com/dicom/transfer-syntax/ 0% Virustotal Browse www.dicomlibrary.com/dicom/transfer-syntax/ 0% Avira URL Cloud safe dgd.vision/Tools/LFToolbox/) 0% Avira URL Cloud safe imageio.github.io 0% Virustotal Browse imageio.github.io 0% Avira URL Cloud safe scanimage.vidriotechnologies.com/display/SI2016/ 0% Avira URL Cloud safe bsdf.io. 0% Virustotal Browse bsdf.io. 0% Avira URL Cloud safe www.ultralum.com/images%20ultralum/pdf/UQStart%20Up%20Guide.pdf 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches Copyright Joe Security LLC 2020 Page 8 of 66 PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Sigma Overview No Sigma rule has matched Joe Sandbox View / Context IPs No context Domains No context ASN No context JA3 Fingerprints No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2020 Page 9 of 66 Startup System is w10x64 unarchiver.exe (PID: 3980 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\Desktop\imageio-2.8.0-py3-none-any.zip'