ID: 128399 Sample Name: iconv.dll Cookbook: default.jbs Time: 01:10:55 Date: 03/05/2019 Version: 26.0.0 Aquamarine Table of Contents Table of Contents 2 Analysis Report iconv.dll 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 System Summary: 6 Malware Analysis System Evasion: 6 Anti Debugging: 6 HIPS / PFW / Operating System Protection Evasion: 6 Behavior Graph 6 Simulations 7 Behavior and APIs 7 Antivirus and Machine Learning Detection 7 Initial Sample 7 Dropped Files 7 Unpacked PE Files 7 Domains 7 URLs 8 Yara Overview 8 Initial Sample 8 PCAP (Network Traffic) 8 Dropped Files 8 Memory Dumps 8 Unpacked PEs 8 Joe Sandbox View / Context 8 IPs 8 Domains 8 ASN 8 JA3 Fingerprints 8 Dropped Files 8 Screenshots 8 Thumbnails 8 Startup 9 Created / dropped Files 9 Domains and IPs 9 Contacted Domains 9 Contacted IPs 10 Static File Info 10 General 10 File Icon 10 Static PE Info 10 General 10 Entrypoint Preview 10 Rich Headers 12 Data Directories 12 Sections 12 Resources 12 Imports 13 Exports 13 Version Infos 13 Possible Origin 13 Network Behavior 13 Copyright Joe Security LLC 2019 Page 2 of 17 Code Manipulations 13 Statistics 13 Behavior 13 System Behavior 14 Analysis Process: loaddll32.exe PID: 3512 Parent PID: 4104 14 General 14 File Activities 14 Analysis Process: rundll32.exe PID: 4076 Parent PID: 3512 14 General 14 Analysis Process: rundll32.exe PID: 4300 Parent PID: 3512 15 General 15 Analysis Process: rundll32.exe PID: 4292 Parent PID: 3512 15 General 15 Analysis Process: rundll32.exe PID: 4288 Parent PID: 3512 15 General 15 Analysis Process: rundll32.exe PID: 4540 Parent PID: 3512 15 General 15 Analysis Process: rundll32.exe PID: 4588 Parent PID: 3512 16 General 16 Analysis Process: rundll32.exe PID: 4596 Parent PID: 3512 16 General 16 Analysis Process: rundll32.exe PID: 4264 Parent PID: 3512 16 General 16 Disassembly 16 Code Analysis 17 Copyright Joe Security LLC 2019 Page 3 of 17 Analysis Report iconv.dll Create Interactive Tour Overview General Information Joe Sandbox Version: 26.0.0 Aquamarine Analysis ID: 128399 Start date: 03.05.2019 Start time: 01:10:55 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 2m 47s Hypervisor based Inspection enabled: false Report type: light Sample file name: iconv.dll Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 12 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies HCA enabled EGA enabled HDC enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean2.winDLL@17/0@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .dll Stop behavior analysis, all processes terminated Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe Detection Strategy Score Range Reporting Whitelisted Detection Threshold 2 0 - 100 true Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2019 Page 4 of 17 Strategy Score Range Further Analysis Required? Confidence Threshold 5 0 - 5 false Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Copyright Joe Security LLC 2019 Page 5 of 17 Mitre Att&ck Matrix Initial Privilege Defense Credential Command and Access Execution Persistence Escalation Evasion Access Discovery Lateral Movement Collection Exfiltration Control Valid Windows Remote Winlogon Process Process Input System Service Application Input Data Data Obfuscation Accounts Management Helper DLL Injection 1 Injection 1 Capture 1 Discovery Deployment Capture 1 Compressed Software Signature Overview • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Malware Analysis System Evasion • Anti Debugging • HIPS / PFW / Operating System Protection Evasion Click to jump to signature section Key, Mouse, Clipboard, Microphone and Screen Capturing: Creates a DirectInput object (often for capturing keystrokes) System Summary: Tries to load missing DLLs Classification label PE file has an executable .text section and no other executable section Reads software policies Runs a DLL by calling functions Spawns processes Malware Analysis System Evasion: Program does not show much activity (idle) Anti Debugging: Program does not show much activity (idle) HIPS / PFW / Operating System Protection Evasion: Creates a process in suspended mode (likely to inject code) Behavior Graph Copyright Joe Security LLC 2019 Page 6 of 17 Hide Legend Legend: Process Signature Created File Behavior Graph DNS/IP Info ID: 128399 Is Dropped Sample: iconv.dll Is Windows Process Startdate: 03/05/2019 Number of created Registry Values Architecture: WINDOWS Number of created Files Score: 2 Visual Basic Delphi started Java .Net C# or VB.NET loaddll32.exe C, C++ or other language Is malicious 1 Internet started started started rundll32.exe rundll32.exe rundll32.exe 5 other processes Simulations Behavior and APIs Time Type Description 01:11:55 API Interceptor 2x Sleep call for process: loaddll32.exe modified Antivirus and Machine Learning Detection Initial Sample Source Detection Scanner Label Link iconv.dll 2% virustotal Browse iconv.dll 0% metadefender Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2019 Page 7 of 17 URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context JA3 Fingerprints No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2019 Page 8 of 17 Startup System is w10x64 loaddll32.exe (PID: 3512 cmdline: loaddll32.exe 'C:\Users\user\Desktop\iconv.dll' MD5: 229B30A06FA656B0EF73C53B67977DCC) rundll32.exe (PID: 4076 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,_libiconv_version MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4300 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconv MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4292 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconv_close MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4288 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconv_open MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4540 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconv_set_relocation_prefix MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4588 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconvctl MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4596 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,libiconvlist MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) rundll32.exe (PID: 4264 cmdline: rundll32.exe C:\Users\user\Desktop\iconv.dll,locale_charset MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) cleanup Created / dropped Files No created / dropped files found Domains and IPs Contacted Domains Copyright Joe Security LLC 2019 Page 9 of 17 No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: PE32 executable (DLL) (GUI) Intel 80386, for MS Wi ndows Entropy (8bit): 7.316650828024265 TrID: Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: iconv.dll File size: 892928 MD5: d7cbbedfad7ad68e12bf6ffcc01c3080 SHA1: a21c860b81ed158e91b2b921b752f48fda6d6f1e SHA256: aa9ec502e20b927d236e19036b40a5da5ddd4ae030553a 6608f821becd646efb SHA512: 739a2913f882b712a4d20f831530a411081644704b9ae23 4f4623b4fb2400f6a36486454f6a25dc8676ef5c570d3e23 698b9a35bb3c2712ddb7e050661f36924 SSDEEP: 24576:hamf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY:hx+ s8KuqGaX0ToIBAUZLY File Content Preview: MZ......................@...............................................!..L.!Th is program cannot be run in DOS mode....$........Z...;...;.. .;...$...;..H'...;...$...;...$...;...;...;.......;...=...;..4....;..Rich.;...... ....PE..L......@...........!....... File Icon Icon Hash: 74f0e4ecccdce0e4 Static PE Info General Entrypoint: 0x1000d0b7 Entrypoint Section: .text Digitally signed: false Imagebase: 0x10000000 Subsystem: windows gui Image File Characteristics: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED DLL Characteristics: Time Stamp: 0x400493B0 [Wed Jan 14 00:56:16 2004 UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version