File name: | wls.exe |
Full analysis: | https://app.any.run/tasks/a51c4e13-3e02-49f0-9639-c296e2bdb8b7 |
Verdict: | Malicious activity |
Analysis date: | April 23, 2019, 13:35:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
MD5: | A2FB452398CE83F5BD87F8579A7B6639 |
SHA1: | 8D9997B914ABE10458F7AFCB3A6CC6F72A0D4322 |
SHA256: | 10A978826AABDCD53DFAEFA2A4EFA1E84C91259B92581334F5D29C00228F2E27 |
SSDEEP: | 24576:f2O/GlM/kG4wTzkJbsB6cFbSKy87XB9rz/cK9qqGE+lwKhKbHofiglxughA0c:hV4aFOKy8TB9ncK9qDDlwKUTrgl+0c |
.exe | | | Win32 Executable MS Visual C++ (generic) (35.8) |
---|---|---|
.exe | | | Win64 Executable (generic) (31.7) |
.scr | | | Windows screen saver (15) |
.dll | | | Win32 Dynamic Link Library (generic) (7.5) |
.exe | | | Win32 Executable (generic) (5.1) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0xac87 |
UninitializedDataSize: | - |
InitializedDataSize: | 58880 |
CodeSize: | 74752 |
LinkerVersion: | 9 |
PEType: | PE32 |
TimeStamp: | 2012:06:09 15:19:49+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Jun-2012 13:19:49 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000F0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 09-Jun-2012 13:19:49 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001231E | 0x00012400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.55555 |
.rdata | 0x00014000 | 0x00001D15 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.99401 |
.data | 0x00016000 | 0x00017724 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.54914 |
.CRT | 0x0002E000 | 0x00000020 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.394141 |
.rsrc | 0x0002F000 | 0x0000C2C0 | 0x0000C400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.19694 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.20816 | 1464 | Latin 1 / Western European | English - United States | RT_MANIFEST |
7 | 3.24143 | 556 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.26996 | 974 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.04375 | 530 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.16254 | 776 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.06352 | 380 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 2.33959 | 102 | Latin 1 / Western European | English - United States | RT_STRING |
100 | 1.91924 | 20 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
101 | 4.19099 | 2998 | Latin 1 / Western European | English - United States | RT_BITMAP |
ASKNEXTVOL | 3.42597 | 646 | Latin 1 / Western European | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3084 | "C:\Users\admin\AppData\Local\Temp\wls.exe" | C:\Users\admin\AppData\Local\Temp\wls.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3120 | "C:\Users\admin\AppData\Local\Temp\53486815\wls.exe" svp=xqo | C:\Users\admin\AppData\Local\Temp\53486815\wls.exe | — | wls.exe |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
2436 | C:\Users\admin\AppData\Local\Temp\53486815\wls.exe C:\Users\admin\AppData\Local\Temp\53486815\MJNTD | C:\Users\admin\AppData\Local\Temp\53486815\wls.exe | wls.exe | |
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script Exit code: 0 Version: 3, 3, 14, 5 | ||||
3596 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | wls.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.6.1055.0 built by: NETFXREL2 |
(PID) Process: | (3084) wls.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3084) wls.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2436) wls.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | WindowsUpdate |
Value: C:\Users\admin\AppData\Local\Temp\53486815\wls.exe C:\Users\admin\AppData\Local\Temp\53486815\SVP_XQ~1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\bjo.txt | text | |
MD5:24937F19D85F36F69CF28260D7815030 | SHA256:BB5FC3C1C25E2FE515DFACB785028824D9C6625F5B1CB523170E7DB9477125F0 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\FileConstants.docx | text | |
MD5:EF7BEF0D858A72B7BBA32D7EA3CAC231 | SHA256:AA9A029698543CDC30F32015978DF6FF3DB15363A3E5AF422B8799ED46DB92B4 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\ngv.docx | text | |
MD5:3FDDE5221DFC687F0679E94A4584B5A0 | SHA256:44D874EEB13D7136C20091E4E028C367C5C98CC0A5C73D27F7486AB11D4D59EA | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\aqj.xl | text | |
MD5:F7B68C29A10EBC64F290D44A12CF707B | SHA256:2F908C3F0292421C8E3E57885CE60C7ECB20BE9BE52D96F698F312A2D26F2D26 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\ojk.xl | image | |
MD5:2090E69E299E6562D3C315D664466017 | SHA256:A8471A830ED28A5D737C9C67B95726BCB235988760F4A43945EB376CAAAEF4A5 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\wmq.bmp | text | |
MD5:54C9E5F79FF726F3F4DB04577D310EA5 | SHA256:5CAEADAF4EE0C331A38C49C31146150CBAEC43935BBD893178CFE4A47D8CC263 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\obf.mp3 | text | |
MD5:19BDC51EC32B900A5F7FFE5B8465031E | SHA256:9C3150A43FC920FF777C5AD2C8222EE2B9761D8CB5514785C43E8224CE5D6A54 | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\lmt.icm | text | |
MD5:0800C89EBDA10671E6B2345958DFE81E | SHA256:98DDB36E0300C04FD397B73E52F6CCE61BE3B587BAB7FC1C87359610C210FFAA | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\ToolTipConstants.bmp | text | |
MD5:6B559A45F95A02FCA4A82E06F27FBE62 | SHA256:E4170F0E3B9BA582FD960754ECBF0DD0CAA20274E2AF07314C1F82315A6AFF0F | |||
3084 | wls.exe | C:\Users\admin\AppData\Local\Temp\53486815\jef.icm | text | |
MD5:148BEC91F69185232D93563A7BCC2D9F | SHA256:CE0EF783532CE52F25605AF7DAC249F7B601A8BA57C5530117F1558C8EE847E9 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3596 | RegSvcs.exe | 79.134.225.23:5592 | mstanley.ufcfan.org | Andreas Fink trading as Fink Telecom Services | CH | malicious |
Domain | IP | Reputation |
---|---|---|
mstanley.ufcfan.org |
| unknown |