5d4e22be...6c81 | VMRay Analyzer Report
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Keylogger, Spyware, Trojan

nqmdwcixbxs.exe

Windows Exe (x86-32)

Created at 2019-07-21T23:34:00

...

Remarks (1/1)

(0x2000010): The operating system was rebooted during the analysis.

VMRay Threat Indicators (18 rules, 60 matches)

Severity Category Operation Count Classification
5/5
OS Obscures a file's origin 1 -
5/5
Local AV Malicious content was detected by heuristic scan 1 -
5/5
Reputation Known malicious file 1 Trojan
  • File "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nqmdwcixbxs.exe" is a known malicious file.
    ...
4/5
Information Stealing Exhibits Spyware behavior 1 Spyware
  • Tries to read sensitive data of: SeaMonkey, Google Chrome, Mozilla Firefox, Opera, Yandex Browser, Internet Explorer / Edge.
    ...
    • VTI Actions
4/5
Reputation Known malicious URL 1 -
  • Contacted URL "www.vacanzaimmobiliare.it/testla/WebPanel/post.php" is a known malicious URL.
    ...
3/5
Device Monitors keyboard input 1 Keylogger
  • Installs system wide "WH_KEYBOARD_LL" hook(s) to monitor keystrokes.
    ...
3/5
Network Reads network adapter information 1 -
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection 1 -
2/5
Information Stealing Reads sensitive browser data 9 -
  • Trying to read sensitive data of web browser "Google Chrome" by file.
    ...
  • Trying to read sensitive data of web browser "Mozilla Firefox" by file.
    ...
  • Trying to read sensitive data of web browser "Opera" by file.
    ...
  • Trying to read sensitive data of web browser "Yandex Browser" by file.
    ...
  • Trying to read sensitive data of web browser "Internet Explorer / Edge" by registry.
    ...
  • Trying to read sensitive data of web browser "Comodo Dragon" by file.
    ...
  • Trying to read sensitive data of web browser "Flock" by file.
    ...
  • Trying to read sensitive data of web browser "Maple Studio" by file.
    ...
  • Trying to read sensitive data of web browser "Chromium" by file.
    ...
2/5
Information Stealing Reads sensitive application data 6 -
  • Trying to read sensitive data of application "SeaMonkey" by file.
    ...
  • Trying to read sensitive data of application "WinSCP" by registry.
    ...
  • Trying to read sensitive data of application "DynDNS" by file.
    ...
  • Trying to read sensitive data of application "Pidgin" by file.
    ...
  • Trying to read sensitive data of application "Internet Download Manager" by registry.
    ...
  • Trying to read sensitive data of application "jDownloader" by file.
    ...
2/5
Information Stealing Reads sensitive mail data 5 -
  • Trying to read sensitive data of mail application "Microsoft Outlook" by registry.
    ...
  • Trying to read sensitive data of mail application "Mozilla Thunderbird" by file.
    ...
  • Trying to read sensitive data of mail application "Opera Mail" by file.
    ...
  • Trying to read sensitive data of mail application "Pocomail" by file.
    ...
  • Trying to read sensitive data of mail application "The Bat!" by file.
    ...
2/5
Information Stealing Reads sensitive ftp data 5 -
  • Trying to read sensitive data of ftp application "FileZilla" by file.
    ...
  • Trying to read sensitive data of ftp application "Ipswitch WS_FTP" by file.
    ...
  • Trying to read sensitive data of ftp application "CoreFTP" by file.
    ...
  • Trying to read sensitive data of ftp application "FlashFXP" by file.
    ...
  • Trying to read sensitive data of ftp application "Total Commander" by file.
    ...
1/5
Process Creates system object 1 -
  • Creates mutex with name "Global\.net clr networking".
    ...
1/5
Network Performs DNS request 1 -
  • Resolves host name "www.vacanzaimmobiliare.it".
    ...
1/5
Information Stealing Possibly does reconnaissance 21 -
  • Possibly trying to gather information about application "Mozilla Firefox" by file.
    ...
  • Possibly trying to gather information about application "Safari" by file.
    ...
  • Possibly trying to gather information about application "SeaMonkey" by file.
    ...
  • Possibly trying to gather information about application "Flock" by file.
    ...
  • Possibly trying to gather information about application "Mozilla Thunderbird" by file.
    ...
  • Possibly trying to gather information about application "Foxmail" by registry.
    ...
  • Possibly trying to gather information about application "Opera Mail" by file.
    ...
  • Possibly trying to gather information about application "Pocomail" by file.
    ...
  • Possibly trying to gather information about application "Qualcomm Eudora" by registry.
    ...
  • Possibly trying to gather information about application "The Bat!" by file.
    ...
  • Possibly trying to gather information about application "FileZilla" by file.
    ...
  • Possibly trying to gather information about application "WS_FTP" by file.
    ...
  • Possibly trying to gather information about application "WinSCP" by registry.
    ...
  • Possibly trying to gather information about application "CoreFTP" by file.
    ...
  • Possibly trying to gather information about application "DynDNS" by file.
    ...
  • Possibly trying to gather information about application "FlashFXP" by file.
    ...
  • Possibly trying to gather information about application "Paltalk" by registry.
    ...
  • Possibly trying to gather information about application "Pidgin" by file.
    ...
  • Possibly trying to gather information about application "SmartFTP" by file.
    ...
  • Possibly trying to gather information about application "No-IP DUC" by registry.
    ...
  • Possibly trying to gather information about application "jDownloader" by file.
    ...
1/5
Network Connects to remote host 2 -
  • Outgoing TCP connection to host "185.81.4.56:80".
    ...
  • Outgoing TCP connection to host "185.81.4.56:443".
    ...
1/5
Network Connects to HTTP server 1 -
  • URL "www.vacanzaimmobiliare.it/testla/WebPanel/post.php".
    ...
1/5
Static Unparsable sections in file 1 -
  • Static analyzer was unable to completely parse the analyzed file: C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\nqmdwcixbxs.exe.
    ...

Screenshots

Monitored Processes

Process Graph

Process Graph Legend

Sample Information

ID #117847
MD5 ef234f23724dc00e693bdb1b1218c1e8 Copy to Clipboard
SHA1 27f0ca2bf23aca5bf4c737480038f23c7eea5b96 Copy to Clipboard
SHA256 5d4e22be32dce5474b61e0df305861f2c07b10ddadbc2dc937481c7d2b736c81 Copy to Clipboard
SSDeep 6144:gzxCyj385/GUCdxzGrGHqveLAS1aP4vAvKhAp081nNVjqKoe:gw8RxSle7AP4oy6nnjqKoe Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
Filename nqmdwcixbxs.exe
File Size 440.00 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-07-22 01:34 (UTC+2)
Analysis Duration 00:02:29
Number of Monitored Processes 2
Execution Successful True
Reputation Enabled True
WHOIS Enabled False
Local AV Enabled True
YARA Enabled True
Number of AV Matches 1
Number of YARA Matches 0
Termination Reason Timeout
Tags
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image