Report #7151

(1)

Binary

DLL False

Size 8.13MB

trid 66.9% Inno Setup installer

25.3% Win32 EXE PECompact compressed 2.7% Win32 Executable

1.2% Win16/32 Executable Delphi generic 1.2% OS/2 Executable

type PE

wordsize 32

Subsystem Windows GUI

Hashes

md5 0050cf38192915f0d6a8458cb9c9b805

sha1 808872806850f8dbb63b4ec2c3fb1fea7aa30524

crc32 0xdf5044e9

sha224 3ded75127a9722945314da5ca225e0ba52d510ff2741e263874bdeb3

sha256 55db0d8cd7c01ffde1f0e7935ef959519c6a4939f77d333a70d44f98a34850f d

sha384 0710c9dfeae51442732baf34ab90ee567d1b9445a38b1a2beef30f2ec7bface 6832b3adf0f865ffcd8adfa323a823ea6

sha512 389fb15fd02166e5c2aceb8c754e499f3be9222e5f1464665d2c32d07a57b1 89b4a54f2d3212ba4071b7b726807a360555ddc89f3347622d1a26b33da03 8cd30

ssdeep 196608:790eMDKBangOE+htJvgbjNERrYw8QQdQgTXevik4dnslV:5M8angZ+

hmNERkwTA7Jdnsr

Report #7151

Creation Date: Feb. 20, 2020, 4:43 p.m.

Last Update: Feb. 20, 2020, 7:39 p.m.

File:

Wmpdg.exe Results:

(2)

Community

Google False

HashLib False

YARA

Matches IP, Borland, Dropper_Strings, Borland_Delphi_30_, CRC32_poly_Constant, B ASE64_table, escalate_priv, borland_delphi, Delphi_FormShow, network_dns , BobSoftMiniDelphiBoBBobSoft, CRC32_table, Microsoft_Visual_Cpp_v50v60 _MFC, BobSoft_Mini_Delphi_BoB_BobSoft_additional, win_token, IsPE32, win _hook, contentis_base64, network_tcp_socket, screenshot, network_tcp_list en, Borland_Delphi_v40_v50, keylogger, win_files_operation, Borland_Delph i_40_additional, IsPacked, Borland_Delphi_40, Delphi_Random, IsWindowsG UI, network_udp_sock, anti_dbg, Borland_Delphi_Setup_Module, Borland_De lphi_DLL, url, win_registry, Delphi_CompareCall, Borland_Delphi_30_additio nal, Borland_Delphi_v30, System_Tools, Big_Numbers2, Big_Numbers1

Suspicious True

Strings

List

http://ns.adobe.com/xap/1.0/

(3)

IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch IEC http://www.iec.ch

<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><r df:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.

1/"/><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:xmp="http://ns.adobe.co m/xap/1.0/"><xmp:CreateDate>2017-02-07T02:34:39.444</xmp:CreateDate></rdf:Description><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:creat or><rdf:Seq xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li>Renata</rdf:li></rdf:Seq>

<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><r

(4)

df:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.

(5)

1/"/><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:xmp="http://ns.adobe.co m/xap/1.0/"><xmp:CreateDate>2017-01-30T00:39:23.463</xmp:CreateDate></rdf:Description><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:creat

(6)

or><rdf:Seq xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li>Renata</rdf:li></rdf:Seq>

Foremost

Matches 8113.jpg, 129 KB, 8374.jpg, 127 KB, 8630.jpg, 160 KB, 8962.jpg, 159 KB, 9 283.jpg, 215 KB, 9715.jpg, 249 KB, 10216.jpg, 264 KB, 10747.jpg, 260 KB, 11269.jpg, 196 KB, 11664.jpg, 196 KB, 12059.jpg, 170 KB, 12403.jpg, 180 KB, 12765.jpg, 225 KB, 13217.jpg, 221 KB, 13661.jpg, 206 KB, 14077.jpg, 1 73 KB, 14426.jpg, 216 KB, 14860.jpg, 180 KB, 15223.jpg, 159 KB, 15543.jp g, 166 KB, 15877.jpg, 61 KB, 16002.jpg, 64 KB, 16132.jpg, 69 KB, 16273.jp g, 58 KB, 16392.jpg, 60 KB, 16516.jpg, 60 KB

Suspicious True

Heuristics

IPs hasIPs: True

Allowed: 255.255.255.255, 1, record, 127.0.0.1, 1, localhost.

Suspicious

hasAllowed: True hasSuspicious: False

URLs Allowed: http://www.w3.org/1999/02/22-rdf-syntax-ns#

hasURLs: True

Suspicious: http://www.iec.ch, http://purl.org/dc/elements/1.1/, http://ns.a dobe.com/xap/1.0/

hasAllowed: True hasSuspicious: True

Files Allowed: user32.dll, owship6.dll, kernel32.dll, uxtheme.dll, winhttp.dll, win sta.dll, NTDLL.DLL, wtsapi32.dll, DWMAPI.dll, crypt32.dll, userenv.dll, Mouse A.dll, PSAPI.dll, comctl32.dll, aw_sas32.dll, wsock32.dll, ole32.dll, imm32.dll , wininet.dll, advapi32.dll, oleaut32.dll, olepro32.dll, ws2_32.dll, msvcrt.dll, msimg32.dll, gdi32.dll, umi.dll, windowscodecs.dll, version.dll, mpr.dll, shell 32.dll

hasFiles: True

Suspicious: *.log, System.Zip hasAllowed: True

hasSuspicious: True

Binary

Sizes RVA

RVA: 16

Suspicious: False

(7)

Code

Size: 5126144 Suspicious: False Image

Address: 4194304 Suspicious: False Stack

Stack: 16384 Suspicious: False Headers

Headers: 1024 Suspicious: False Suspicious: False

Symbols Number

Number: 0

Suspicious: True Pointer

Pointer: 0

Suspicious: True Directories Number: 16 Suspicious: False

Checksum Value: 0

Suspicous: True

Sections Allowed: .text, .itext, .data, .bss, .idata, .didata, .edata, .tls, .rdata, .reloc, .rsr c

Suspicious

hasAllowed: True hasSections: True hasSuspicious: False

Versions OS

Version: 5

Suspicious: False Image

Version: True Suspicious: 5 Linker

Version: 2.25 Suspicious: False Subsystem

Version: 5.0 Suspicious: False Suspicious: False

EntryPoint Address: 3399372

Suspicious: False

Anomalies Anomalies: The header checksum and the calculated checksum do not ma

(8)

tch.

hasAnomalies: True

Libraries Allowed: user32.dll, kernel32.dll, uxtheme.dll, winhttp.dll, winsta.dll, ntdll.

dll, wtsapi32.dll, dwmapi.dll, crypt32.dll, userenv.dll, psapi.dll, comctl32.dll, wsock32.dll, ole32.dll, imm32.dll, wininet.dll, advapi32.dll, oleaut32.dll, ole pro32.dll, ws2_32.dll, msvcrt.dll, msimg32.dll, gdi32.dll, windowscodecs.dll, version.dll, mpr.dll, shell32.dll

hasLibs: True

Suspicious: owship6.dll, mousea.dll, aw_sas32.dll, umi.dll hasAllowed: True

hasSuspicious: True

Timestamp Past: False

Valid: True

Value: 2017-02-08 14:43:37 Future: False

Compilation Packed: True

Missing: False

Packers: BobSoft Mini Delphi -> BoB / BobSoft Compiled: True

Compilers: Borland Delphi 3.0 (???), Borland Delphi 4.0, Borland Delphi v3.

0, Borland Delphi v6.0 - v7.0

MainPacker: BobSoft Mini Delphi -> BoB / BobSoft

Obfuscation XOR: False

Fuzzing: True

PEDetector

Matches None

Suspicious False

Disassembly

hasTricks True

Tricks

pushret .data: 16

.rsrc: 1778 .text: 97 .itext: 8

nopsequence .data: 1

.itext: 1

(9)

pushpopmath .data: 10 .rsrc: 777 .text: 68 .idata: 17 .reloc: 234

ss register .rsrc: 15

garbagebytes .data: 8

.rsrc: 1033 .text: 80 .itext: 8

hookdetection .data: 1

.rsrc: 63 .text: 2 .reloc: 20

software breakpoint .rsrc: 23 .text: 13 .reloc: 77

fakeconditionaljumps .rsrc: 119

programcontrolflowchange .data: 8 .rsrc: 916 .text: 80 .itext: 8

cpuinstructionsresultscomparison .data: 13 .rsrc: 17 .text: 43 .reloc: 1

AVclass

bestafera 1

VirusTotal

md5 0050cf38192915f0d6a8458cb9c9b805

sha1 808872806850f8dbb63b4ec2c3fb1fea7aa30524

(10)

SCANS (DETECTION RATE = 55.71%)

AVG result: Win32:Rootkit-gen [Rtk]

update: 20190601 version: 18.4.3895.0 detected: True

CMC update: 20190321

version: 1.1.0.977 detected: False

MAX result: malware (ai score=85)

APEX update: 20190530

version: 5.22 detected: False

Bkav update: 20190531

K7GW result: Spyware ( 00504efc1 )

update: 20190601 version: 11.47.31093 detected: True

ALYac result: Trojan.Generic.20466867

Avast result: Win32:Rootkit-gen [Rtk]

Avira result: HEUR/AGEN.1004378

Baidu update: 20190318

(11)

Cyren update: 20190601 version: 6.2.0.1 detected: False

DrWeb update: 20190601

GData result: Trojan.Generic.20466867

update: 20190601

version: A:25.22209B:25.15223 detected: True

Panda result: Trj/GdSda.A

VBA32 result: TrojanBanker.BestaFera

Zoner update: 20190531

ClamAV update: 20190601

Comodo update: 20190601

version: 30956 detected: False

F-Prot update: 20190601

Ikarus result: Trojan-Spy.Agent

(12)

McAfee result: Artemis!0050CF381929 update: 20190601

version: 6.0.6.653 detected: True

Rising result: Spyware.Banker!8.8D (CLOUD)

Sophos result: Mal/Generic-S

Yandex result: Trojan.PWS.BestaFera!

Zillya result: Trojan.Banker.Win32.105706

Acronis update: 20190531

Alibaba update: 20190527

Arcabit result: Trojan.Generic.D1384CB3

Babable update: 20190424

version: 9107201 detected: False

Cylance result: Unsafe

(13)

Endgame result: malicious (high confidence) update: 20190522

version: 3.0.12 detected: True

FireEye result: Generic.mg.0050cf38192915f0

TACHYON update: 20190601

version: 2019-06-01.02 detected: False

Tencent result: Win32.Trojan-spy.Banker.Bxg update: 20190601

ViRobot update: 20190601

Webroot update: 20190601

Ad-Aware result: Trojan.Generic.20466867

AegisLab result: Trojan.Win32.BestaFera.7!c update: 20190601

version: 4.2 detected: True

Emsisoft result: Trojan.Generic.20466867 (B) update: 20190601

F-Secure result: Heuristic.HEUR/AGEN.1004378

(14)

Fortinet update: 20190601 version: 5.4.247.0 detected: False

Invincea update: 20190525

Jiangmin result: Trojan.Banker.BestaFera.dge update: 20190529

Kingsoft update: 20190601

Paloalto update: 20190601

Symantec result: ML.Attribute.HighConfidence update: 20190601

AhnLab-V3 result: Trojan/Win32.BestaFera.C1793766 update: 20190601

Antiy-AVL result: Trojan[Banker]/Win32.BestaFera update: 20190601

Kaspersky result: Trojan-Banker.Win32.BestaFera.yml update: 20190601

Microsoft result: TrojanSpy:Win32/Banker

Qihoo-360 result: Win32/Trojan.a8d

(15)

TheHacker update: 20190601

version: 6.8.0.5.4249 detected: False

Trustlook update: 20190601

ZoneAlarm result: Trojan-Banker.Win32.BestaFera.yml update: 20190601

Cybereason result: malicious.819291

ESET-NOD32 result: Win32/Spy.Banker.ADRJ update: 20190601

version: 19453 detected: True

TrendMicro update: 20190601

BitDefender result: Trojan.Generic.20466867 update: 20190601

CrowdStrike update: 20190212

K7AntiVirus result: Spyware ( 00504efc1 ) update: 20190529

SentinelOne result: DFI - Malicious PE update: 20190511

(16)

Avast-Mobile update: 20190531

version: 190531-00 detected: False

Malwarebytes update: 20190601

TotalDefense update: 20190601

CAT-QuickHeal update: 20190601

NANO-Antivirus update: 20190601

MicroWorld-eScan result: Trojan.Generic.20466867 update: 20190601

SUPERAntiSpyware update: 20190528

McAfee-GW-Edition result: BehavesLike.Win32.Generic.rc update: 20190601

version: v2017.3010 detected: True

TrendMicro-HouseCall update: 20190601 version: 10.0.0.1040 detected: False

total 70

sha256 55db0d8cd7c01ffde1f0e7935ef959519c6a4939f77d333a70d44f98a34850f d

(17)

scan_id 55db0d8cd7c01ffde1f0e7935ef959519c6a4939f77d333a70d44f98a34850f d-1559426199

resource 0050cf38192915f0d6a8458cb9c9b805

permalink https://www.virustotal.com/file/55db0d8cd7c01ffde1f0e7935ef959519c6a4 939f77d333a70d44f98a34850fd/analysis/1559426199/

positives 39

scan_date 2019-06-01 21:56:39

verbose_msg Scan finished, information embedded

response_code 1

Results

BINARY

KNN (K=3, NFS-BRMalware) confidence: 100.00%

suspicious: True

Decision Tree (NFS-BRMalware) confidence: 100.00%

SVC (Kernel=Linear, NFS-BRMalware) confidence: 40.19%

suspicious: False

MalConv (Ember: Raw Bytes, Threshold=0.5) confidence: 94.99%

Random Forest (100 estimators, NFS-BRMalware) confidence: 61.00%

Non-Negative MalConv (Ember: Raw Bytes, Threshold=0.35) confidence: 72.82%

LightGDM (Ember: File Characteristics, Threshold=0.8336) confidence: 84.54%

(18)