Analysis MD5: 009b3e698de7eee86110877722c76369
Analysis of the file classifies it as a class F (Malicious). The file is malicious, do not use it. The trust index of this analysis is 100 % (certain).
Description
Filename: | 5f076e8fcf6ed495_Filesample.dll (Trojan:Win32/Wisdomeyes.FM) |
Threat analysis: | Malicious |
Analysis trust: | |
Recent activity: | |
First seen: | 06 Mar, 2018 |
Last seen: | 02 Apr, 2018 |
Last analysis: | 06 Nov, 2019 |
Possible infection: | Trojan:Win32/Wisdomeyes.FM |
5f076e8fcf6ed495_Filesample.dll Trojan:Win32/Wisdomeyes.FM
Application: | Trojan:Win32/Wisdomeyes.FM |
Developer: | Unknown |
Stability: | |
File version: | 0.0.0.0 |
File size: | 189340 bytes (185 KB.) |
Recent activity: | |
Historic activity: | |
CRC32 hash: | 3c59136c |
MD5 hash: | 009b3e698de7eee86110877722c76369 |
SHA1 hash: | ef569b68258923773724480101f991bb8fea8a2f |
SHA256 hash: | 5f076e8fcf6ed495931b8eb2ff92c9e7958eb10b7bc57b44b4d689514532786c |
File entropy
File entropy match: Encrypted
Parts of this file are encrypted. The reasons might be benign but it makes the analysis more difficult.
Plain Data Text Code Compressed Encrypted RandomFile signature
Dynamic Link Library
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.File header First 32 bytes of this file
4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
The determination of a file type is done with a signature or magic-numbers. Files are identified using by comparing the first set of bytes in the file header. Using this method type of files are recognised no matter the extension used. This information is useful to for example recognise executable files cloaked as images or movies.
Malicious code scan
No malicious code found
Agics makes een analysis of the source code of the file. We look for comparisons with known malicious source code. This is a good way to detect new malicious files which are in fact variations of existing, and known malicious files.
Scan results:
Fuzzy hash a.k.a. Context Triggered Piecewise Hashing
SSDEEP
Context Triggered Piecewise Hashing, also called Fuzzy Hashing, can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length. Comparing a fuzzyhash is a good way to detect morphing malware. Malware which include random code in every copy to change its properties. Agics uses ssdeep to make create a fuzzyhash.
SSDEEP: 3072:HxIBtQnE7OhssdWJ5jy392aCmCbBq/XIbeYql7ccXgqKVMuxCbE451y:Mqvhssdu5jyYaCmCQ/XI8ycXg3V5CIh
Match found
b6c800efae36575a01c6b5cb918b3c0f8659954e537c40ccecdab3b5498f5153
SSDEEP :
3072:HGIBtQnE7OhssdWJ5jy392aCmCbBqT/6BKHt/Sbrs4YXTbwYHGnJ/mZNtg9N8OV3:Hqvhssdu5jyYaCmCQT6Bgwr+DsYm4/yl
Online virus scanners
Detection ration:
VirusShare.com
Available on virusshare.com
VirusShare.com is a repository of malware samples to provide security researchers, incident responders, forensic analysts, and the morbidly curious access to samples of live malicious code. Presence of the sample on this site indicates that the file is (Once considered) being malicious.Website: virusshare.com
National Software Reference Library
Not on the nsrl list
The NSRL contains a collection of digital signatures of known, traceable software applications. There are application hash values in the hash set which may be considered malicious, i.e. steganography tools and hacking scripts.Website: www.nsrl.nist.gov
Behaviour
Sandbox behaviour analysis:
The file is executed in a safe environment to track its behaviour. The behaviour analysis can help with detecting new malware which is not recognized by virusscanners yet. However it has a high chance on a false-positive, especially with installers, uninstallers and virusscanners.
Detects Avast Antivirus through the presence of a library
Creates and runs a batch file to remove the original binary
The file dropped a dangerous file
Detects the presence of Wine emulator
Yara hit: Advapi_Hash_API - Looks for advapi API functions
Repeatedly searches for a not-found process.
Yara hit: CRC32_poly_Constant - Look for CRC32 [poly]
Checks for the presence of known windows from debuggers and forensic tools
Creates a suspicious process
One or more processes crashed
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Executed a process and injected code into it, probably while unpacking
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
Allocates read-write-execute memory (usually to unpack itself)
Performs some HTTP requests
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
Network activity
Connects to safe servers
Host not responding
Host | Port | ||
---|---|---|---|
51.143.22.239 | 80 | Dead |
TCP
Host | Port | |
---|---|---|
52.109.88.34 | 49176 | |
52.109.88.38 | 49174 |
DNS
Domain | Result | Record type | |
---|---|---|---|
watson.microsoft.com | 51.143.22.239 | A |
Dropped files
File name | md5 | |
---|---|---|
tmp_af9c2552.bat | 13470e003899338bb7d33e4e9b4f3586 | B |
taci.exe | a0a4c0e1ce38a1e2ffd73c549a8d828b | B |
Filesample.dll | 009b3e698de7eee86110877722c76369 | F |
Import hashing
Imphash 65e9607e6f28a7852bb41a6e2e439a92
Fingerprinting files can be done in various way. One way is to make a hash of the PE Imports. PE Imports are relative unique and this is a great way to find new variants of existing malware. The chance of false-positives is relative high. The resulting hash is often called an imphash.
Statistic analysis
Statistic analysis of the file
Similar to other files with the same name | |
File version is 0.0.0.0 | |
The certificate can not be determined | |
This is a very common file |
Neural network analysis
Analysis: Malicious
A neural network is a type of artificial intelligence. It recognized patterns nog clear for a human viewer. Our neural network is surprisingly accurate in recognizing dangerous files. The value below is the predicted chance the file is malicious.
User feedback
Read feedback on this file from other users. Help other users by providing feedback yourself.
You can earn reputation points !
You are currently not logged in. Login, or Create an account
Feedback users:
Login Create an account