Automated Malware Analysis Report for Pdfcreator-1 7 3 Setup.Exe
Total Page：16
File Type：pdf, Size：1020Kb
ID: 185438 Sample Name: PDFCreator- 1_7_3_setup.exe Cookbook: default.jbs Time: 18:02:34 Date: 25/10/2019 Version: 28.0.0 Lapis Lazuli Table of Contents Table of Contents 2 Analysis Report PDFCreator-1_7_3_setup.exe 4 Overview 4 General Information 4 Detection 4 Confidence 5 Classification 5 Analysis Advice 6 Mitre Att&ck Matrix 6 Signature Overview 7 AV Detection: 7 Spreading: 7 Networking: 7 System Summary: 8 Data Obfuscation: 8 Persistence and Installation Behavior: 8 Hooking and other Techniques for Hiding and Protection: 8 Malware Analysis System Evasion: 9 Anti Debugging: 9 HIPS / PFW / Operating System Protection Evasion: 9 Language, Device and Operating System Detection: 9 Behavior Graph 9 Simulations 10 Behavior and APIs 10 Antivirus, Machine Learning and Genetic Malware Detection 10 Initial Sample 10 Dropped Files 10 Unpacked PE Files 11 Domains 11 URLs 11 Yara Overview 11 Initial Sample 12 PCAP (Network Traffic) 12 Dropped Files 12 Memory Dumps 12 Unpacked PEs 12 Sigma Overview 12 Joe Sandbox View / Context 12 IPs 12 Domains 12 ASN 12 JA3 Fingerprints 13 Dropped Files 14 Screenshots 15 Thumbnails 15 Startup 15 Created / dropped Files 16 Domains and IPs 19 Contacted Domains 19 Contacted URLs 19 URLs from Memory and Binaries 19 Contacted IPs 23 Public 23 Static File Info 23 General 23 File Icon 24 Static PE Info 24 General 24 Copyright Joe Security LLC 2019 Page 2 of 40 Authenticode Signature 24 Entrypoint Preview 24 Data Directories 25 Sections 25 Resources 26 Imports 26 Version Infos 26 Possible Origin 27 Network Behavior 27 Network Port Distribution 27 TCP Packets 27 UDP Packets 28 DNS Queries 28 DNS Answers 28 HTTP Request Dependency Graph 28 HTTP Packets 28 HTTPS Packets 29 Code Manipulations 29 Statistics 29 Behavior 29 System Behavior 30 Analysis Process: PDFCreator-1_7_3_setup.exe PID: 3816 Parent PID: 2804 30 General 30 File Activities 30 File Created 30 File Deleted 30 File Written 30 File Read 31 Analysis Process: PDFCreator-1_7_3_setup.tmp PID: 1616 Parent PID: 3816 31 General 31 File Activities 31 File Created 31 File Deleted 32 File Written 32 File Read 35 Analysis Process: DownloadUpdateInfo.exe PID: 4528 Parent PID: 1616 35 General 35 File Activities 35 File Created 36 File Deleted 36 File Written 36 File Read 36 Analysis Process: DownloadUpdateInfo.tmp PID: 4152 Parent PID: 4528 36 General 36 File Activities 37 File Created 37 File Deleted 37 File Written 37 File Read 39 Registry Activities 40 Disassembly 40 Code Analysis 40 Copyright Joe Security LLC 2019 Page 3 of 40 Analysis Report PDFCreator-1_7_3_setup.exe Overview General Information Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 185438 Start date: 25.10.2019 Start time: 18:02:34 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 8m 41s Hypervisor based Inspection enabled: false Report type: light Sample file name: PDFCreator-1_7_3_setup.exe Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 7 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: SUS Classification: sus28.winEXE@8/10@1/1 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 27.4% (good quality ratio 27%) Quality average: 84.9% Quality standard deviation: 21.3% HCA Information: Successful, ratio: 53% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe Excluded IPs from analysis (whitelisted): 8.248.131.254, 8.253.204.121, 8.241.126.249, 8.253.207.121, 67.27.157.254, 67.26.75.254, 8.253.95.120, 8.252.5.126, 8.253.95.249 Excluded domains from analysis (whitelisted): audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, auto.au.download.windowsupdate.com.c.footprint.n et Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Whitelisted Detection Copyright Joe Security LLC 2019 Page 4 of 40 Strategy Score Range Reporting Whitelisted Detection Threshold 28 0 - 100 false Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 1 0 - 5 true Classification Copyright Joe Security LLC 2019 Page 5 of 40 Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Mitre Att&ck Matrix Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Valid Accounts Command-Line Winlogon Exploitation for Software Packing 1 Credential System Time Remote File Data from Data Standard Interface 1 Helper DLL Privilege Dumping Discovery 1 Copy 1 Local System Encrypted 1 1 Cryptographic Escalation 1 Protocol 1 2 Copyright Joe Security LLC 2019 Page 6 of 40 Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Replication Execution Port Monitors Access Token Access Token Network Peripheral Remote Data from Exfiltration Over Remote File Through through API 1 Manipulation 1 Manipulation 1 Sniffing Device Services Removable Other Network Copy 1 Removable Discovery 1 Media Medium Media Drive-by Windows Accessibility Path Deobfuscate/Decode Input Capture Application Windows Data from Automated Standard Compromise Management Features Interception Files or Window Remote Network Exfiltration Non- Instrumentation Information 1 Discovery 1 Management Shared Drive Application Layer Protocol 3 Exploit Public- Scheduled Task System DLL Search Obfuscated Files or Credentials in Account Logon Scripts Input Capture Data Encrypted Standard Facing Firmware Order Hijacking Information 2 Files Discovery 1 Application Application Layer Protocol 3 Spearphishing Command-Line Shortcut File System DLL Side- Account System Shared Data Staged Scheduled Standard Link Interface Modification Permissions Loading 1 Manipulation Owner/User Webroot Transfer Cryptographic Weakness Discovery 3 Protocol Spearphishing Graphical User Modify Existing New Service DLL Search Order Brute Force Security Third-party Screen Data Transfer Commonly Attachment Interface Service Hijacking Software Software Capture Size Limits Used Port Discovery 1 1 Spearphishing Scripting Path Scheduled Task Software Packing Two-Factor Remote System Pass the Hash Email Exfiltration Over Uncommonly via Service Interception Authentication Discovery 1 Collection Command and Used Port Interception Control Channel Supply Chain Third-party Logon Scripts Process Indicator Blocking Bash History File and Remote Clipboard Data Exfiltration Over Standard Compromise Software Injection Directory Desktop Alternative Application Discovery 2 Protocol Protocol Layer Protocol Trusted Rundll32 DLL Search Service Process Injection Input Prompt System Windows Automated Exfiltration Over Multilayer Relationship Order Hijacking Registry Information Admin Shares Collection Physical Encryption Permissions Discovery 1 4 Medium Weakness Signature Overview • AV Detection • Spreading • Networking • System Summary • Data Obfuscation • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion • Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for URL or domain Multi AV Scanner detection for submitted file Antivirus or Machine Learning detection for unpacked file Spreading: Contains functionality to get notified if a device is plugged in / out Contains functionality to enumerate / list files inside a directory Networking: JA3 SSL client fingerprint seen in connection with other malware Downloads files from webservers via HTTP Copyright Joe Security LLC 2019 Page 7 of 40 Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Contains functionality to call native functions Contains functionality to communicate with device drivers Contains functionality to shutdown / reboot the system Detected potential crypto