File name: | Netflix Checker v1 by Sh4lltear.exe |
Full analysis: | https://app.any.run/tasks/ff94e965-dabe-4b39-a713-e228adba1ac7 |
Verdict: | Malicious activity |
Threats: | Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. |
Analysis date: | July 13, 2020, 02:23:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 9DF9AE6FBE6AB5BF973808F564AA0D75 |
SHA1: | C2CFA1547FE16AC813E1061154413595F4D11F57 |
SHA256: | C79D324DAC4031A08F8BE97468230B729A8E3D546643E17E59F05176B9AE7325 |
SSDEEP: | 196608:NO+07jpU722lVLWjirYXA2DkYDdXLaylvbi3gmu:Nou72oVHYq+LHbWFu |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:04:27 22:03:27+02:00 |
PEType: | PE32 |
LinkerVersion: | 14 |
CodeSize: | 190976 |
InitializedDataSize: | 250880 |
UninitializedDataSize: | - |
EntryPoint: | 0x1d759 |
OSVersion: | 5.1 |
ImageVersion: | - |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 27-Apr-2019 20:03:27 |
Detected languages: |
|
Debug artifacts: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000110 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 27-Apr-2019 20:03:27 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0002E854 | 0x0002EA00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.69231 |
.rdata | 0x00030000 | 0x00009A9C | 0x00009C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.13286 |
.data | 0x0003A000 | 0x000213D0 | 0x00000C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.25381 |
.gfids | 0x0005C000 | 0x000000E8 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.11154 |
.rsrc | 0x0005D000 | 0x000308CC | 0x00030A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.72849 |
.reloc | 0x0008E000 | 0x00001FCC | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.64554 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.26192 | 1875 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 4.63597 | 67624 | Latin 1 / Western European | Process Default Language | RT_ICON |
3 | 4.98412 | 38056 | Latin 1 / Western European | Process Default Language | RT_ICON |
4 | 4.97447 | 21640 | Latin 1 / Western European | Process Default Language | RT_ICON |
5 | 4.912 | 16936 | Latin 1 / Western European | Process Default Language | RT_ICON |
6 | 5.21393 | 9640 | Latin 1 / Western European | Process Default Language | RT_ICON |
7 | 3.1586 | 482 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 3.11685 | 460 | Latin 1 / Western European | English - United States | RT_STRING |
9 | 3.15447 | 494 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 2.99727 | 326 | Latin 1 / Western European | English - United States | RT_STRING |
KERNEL32.dll |
USER32.dll (delay-loaded) |
gdiplus.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2584 | "C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe" | C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3868 | "C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe" | C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2944 | "C:\Users\admin\AppData\Local\Temp\nf2.exe" | C:\Users\admin\AppData\Local\Temp\nf2.exe | Netflix Checker v1 by Sh4lltear.exe | |
User: admin Company: Bloodfallen Integrity Level: HIGH Description: Netflix Checker v1 | Sh4lltear Exit code: 0 Version: 1.0.0.0 | ||||
3960 | "C:\Users\admin\AppData\Local\Temp\NC.exe" | C:\Users\admin\AppData\Local\Temp\NC.exe | — | Netflix Checker v1 by Sh4lltear.exe |
User: admin Company: Bloodfallen Integrity Level: HIGH Description: Netflix Checker v1 | Sh4lltear Version: 1.0.0.0 | ||||
1784 | "C:\Program Files\Microsoft\winlog.exe" | C:\Program Files\Microsoft\winlog.exe | nf2.exe | |
User: admin Company: Bloodfallen Integrity Level: HIGH Description: Netflix Checker v1 | Sh4lltear Version: 1.0.0.0 |
(PID) Process: | (3868) Netflix Checker v1 by Sh4lltear.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3868) Netflix Checker v1 by Sh4lltear.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2944) nf2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2944) nf2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (1784) winlog.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | WinLOGON |
Value: "C:\Program Files\Microsoft\winlog.exe" |
PID | Process | Filename | Type | |
---|---|---|---|---|
2944 | nf2.exe | C:\Program Files\Microsoft\winlog.exe | executable | |
MD5:DF7E5FFD3A0D99F86230B477473FEB97 | SHA256:BF1518F8D72919E209A45E465809653C5DAF9315531896F3CAD93C6D623F2410 | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\nf2.exe | executable | |
MD5:DF7E5FFD3A0D99F86230B477473FEB97 | SHA256:BF1518F8D72919E209A45E465809653C5DAF9315531896F3CAD93C6D623F2410 | |||
2944 | nf2.exe | C:\Program Files\Microsoft\winlog.exe.config | xml | |
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98 | SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839 | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\Leaf.xNet.dll | executable | |
MD5:AABE4F7E8F947171AB334B5CC0A76F7C | SHA256:70670C404F998B71FE5ABFB3AA58FCB5302D3940E805AC8927F79B625AFAB4A8 | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\xNet.dll | executable | |
MD5:AC1DCEDDBC66A1AB7915AC9931F0CFEC | SHA256:CC949931EF9533ADCED83F3D58862E9732E5DB7AD17B5FD4CB9D209A99EDB592 | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\NC.exe | executable | |
MD5:3C48B36295EB8EBB9E468BC273EBCE75 | SHA256:AD32D183B6173B7D11E87F80E41708299976C216F1312230A79903308EF58AB6 | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear32.dll | executable | |
MD5:7D723A8EB4D7E494EA488C13510B97B6 | SHA256:B695AC865A5DF23E45FF991BF26B71E4F879C89A1A6FDE0BA92F31904BEACA5C | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\Guna.UI.dll | executable | |
MD5:6D6A1F28978D42AD2F0A8F278EAAC966 | SHA256:FB23FA4FCA8F28BEBE7B7E39593A211CD3C3405DE5F948EC520E859B1BCAF91E | |||
3868 | Netflix Checker v1 by Sh4lltear.exe | C:\Users\admin\AppData\Local\Temp\Netflix Checker v1 by Sh4lltear64.dll | executable | |
MD5:08DFAD3A22E42E17A3BF8F4EE43A67F5 | SHA256:B3710DE17D2C2F84DEF83C8F3093DF0DBE1664F34AB4A3ADB72F1085E71C773C |