analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MV_OCEAN1107_VSL070_pdf.exe

Full analysis: https://app.any.run/tasks/50cf0028-6e0e-46b8-a4c6-4c2261a22e43
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: November 08, 2018, 12:53:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F76925440A0EDA47692B8D07D45B74F5

SHA1:

9BD86C6FD86DF814706AA6B8F85F04140D38C8D7

SHA256:

B70DD03CF658BEFFD93DE21161CCDCE40EA8419366E1B8F3669024A1ADC6634B

SSDEEP:

24576:giRVIf7zB3ptHfD4rl9V0ZYDfEhdBiBOuJh2TskLK:5ZDV02kdBiDTn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LOKIBOT was detected

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
    • Detected artifacts of LokiBot

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
    • Connects to CnC server

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
    • Actions looks like stealing of personal data

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
  • SUSPICIOUS

    • Loads DLL from Mozilla Firefox

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
    • Application launched itself

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 920)
    • Creates files in the user directory

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
    • Executable content was dropped or overwritten

      • MV_OCEAN1107_VSL070_pdf.exe (PID: 2172)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

OriginalFileName: Harpless6.exe
InternalName: Harpless6
ProductVersion: 1.06.0001
FileVersion: 1.06.0001
ProductName: SELFVULCANIZING
FileDescription: Cubehead5
CompanyName: Dielike
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.6.0.1
FileVersionNumber: 1.6.0.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 1.6
OSVersion: 4
EntryPoint: 0x12d4
UninitializedDataSize: -
InitializedDataSize: 28672
CodeSize: 1269760
LinkerVersion: 6
PEType: PE32
TimeStamp: 2006:05:19 10:14:30+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-May-2006 08:14:30
Detected languages:
  • English - United States
CompanyName: Dielike
FileDescription: Cubehead5
ProductName: SELFVULCANIZING
FileVersion: 1.06.0001
ProductVersion: 1.06.0001
InternalName: Harpless6
OriginalFilename: Harpless6.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000B8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 19-May-2006 08:14:30
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001357CC
0x00136000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.93699
.data
0x00137000
0x00000A6C
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00138000
0x00005A4A
0x00006000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.21274

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.33205
620
Unicode (UTF 16LE)
English - United States
RT_VERSION
30001
5.63934
3640
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30002
6.00129
2216
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30003
6.05263
1736
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30004
4.49447
1384
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30005
5.37326
6848
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30006
5.17359
3240
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30007
4.95085
1864
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30008
4.69737
872
Unicode (UTF 16LE)
UNKNOWN
RT_ICON

Imports

MSVBVM60.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mv_ocean1107_vsl070_pdf.exe no specs #LOKIBOT mv_ocean1107_vsl070_pdf.exe explorer.exe no specs explorer.exe no specs Shell Security Editor no specs

Process information

PID
CMD
Path
Indicators
Parent process
920"C:\Users\admin\AppData\Local\Temp\MV_OCEAN1107_VSL070_pdf.exe" C:\Users\admin\AppData\Local\Temp\MV_OCEAN1107_VSL070_pdf.exeexplorer.exe
User:
admin
Company:
Dielike
Integrity Level:
MEDIUM
Description:
Cubehead5
Exit code:
0
Version:
1.06.0001
2172C:\Users\admin\AppData\Local\Temp\MV_OCEAN1107_VSL070_pdf.exe" C:\Users\admin\AppData\Local\Temp\MV_OCEAN1107_VSL070_pdf.exe
MV_OCEAN1107_VSL070_pdf.exe
User:
admin
Company:
Dielike
Integrity Level:
MEDIUM
Description:
Cubehead5
Version:
1.06.0001
3796"C:\Windows\explorer.exe" C:\Windows\explorer.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2484"C:\Windows\explorer.exe" C:\Windows\explorer.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4088C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}C:\Windows\system32\DllHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
84
Read events
83
Write events
1
Delete events
0

Modification events

(PID) Process:(2172) MV_OCEAN1107_VSL070_pdf.exeKey:HKEY_CURRENT_USER\������Ј��ы��җ�ќ��Н������Н�������Й��я��
Operation:writeName:F63AAA
Value:
%APPDATA%\F63AAA\A71D80.exe
Executable files
1
Suspicious files
1
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
2172MV_OCEAN1107_VSL070_pdf.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f
MD5:
SHA256:
2172MV_OCEAN1107_VSL070_pdf.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck
MD5:
SHA256:
2172MV_OCEAN1107_VSL070_pdf.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:F76925440A0EDA47692B8D07D45B74F5
SHA256:B70DD03CF658BEFFD93DE21161CCDCE40EA8419366E1B8F3669024A1ADC6634B
2172MV_OCEAN1107_VSL070_pdf.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdbtext
MD5:5302B1B5EC232D44E2D9507FB847FC49
SHA256:20B58A25872B1E3F7D47DAE0C090ACF229C49B6E33939934513499CC37BB2684
920MV_OCEAN1107_VSL070_pdf.exeC:\Users\admin\AppData\Local\Temp\~DFC174B76420B322DB.TMPbinary
MD5:E047E421FC6EAA6B5A89588B83019EC9
SHA256:2DC40F72B85235E1820A9FC06B7C8AE13570D0CFE6020CE51AA2F74CDACED6D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2172
MV_OCEAN1107_VSL070_pdf.exe
POST
188.225.25.117:80
http://www.tsq-hk.com/bassltd/bassloki/fre.php
RU
malicious
2172
MV_OCEAN1107_VSL070_pdf.exe
POST
404
188.225.25.117:80
http://www.tsq-hk.com/bassltd/bassloki/fre.php
RU
text
15 b
malicious
2172
MV_OCEAN1107_VSL070_pdf.exe
POST
404
188.225.25.117:80
http://www.tsq-hk.com/bassltd/bassloki/fre.php
RU
text
15 b
malicious
2172
MV_OCEAN1107_VSL070_pdf.exe
POST
404
188.225.25.117:80
http://www.tsq-hk.com/bassltd/bassloki/fre.php
RU
binary
23 b
malicious
2172
MV_OCEAN1107_VSL070_pdf.exe
POST
404
188.225.25.117:80
http://www.tsq-hk.com/bassltd/bassloki/fre.php
RU
binary
23 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2172
MV_OCEAN1107_VSL070_pdf.exe
188.225.25.117:80
www.tsq-hk.com
TimeWeb Ltd.
RU
malicious

DNS requests

Domain
IP
Reputation
www.tsq-hk.com
  • 188.225.25.117
malicious

Threats

PID
Process
Class
Message
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
2172
MV_OCEAN1107_VSL070_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
5 ETPRO signatures available at the full report
No debug info