Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 6

• External Systems
  • Sample was identified as malicious by a large number of Antivirus engines

    details

    35/61 Antivirus vendors marked sample as malicious (57% detection rate)
    16/41 Antivirus vendors marked sample as malicious (39% detection rate)

    source

    External System

    relevance

    10/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    35/61 Antivirus vendors marked sample as malicious (57% detection rate)
    16/41 Antivirus vendors marked sample as malicious (39% detection rate)

    source

    External System

    relevance

    8/10

• General
  • The analysis spawned a process that was identified as malicious

    details

    41/85 Antivirus vendors marked spawned process "<Input Sample>" (PID: 2900) as malicious (classified as "Downloader.Exchanger" with 48% detection rate)

    source

    Monitored Target

    relevance

    10/10

• Pattern Matching
  • YARA signature match

    details

    YARA signature "UPX" classified file "KeyGen.exe.bin" as "upx" based on indicators: "UPX0,UPX1,UPX!" (Author: Kevin Breen <kevin@techanarchy.net>)

    source

    YARA Signature

    relevance

    10/10

• Unusual Characteristics
  • Entrypoint in PE header is within an uncommon section

    details

    "KeyGen.exe.bin" has an entrypoint in section "UPX1"

    source

    Static Parser

    relevance

    5/10

• Hiding 1 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 10

• Anti-Reverse Engineering
  • PE file has unusual entropy sections

    details

    UPX1 with unusual entropies 7.9567844273

    source

    Static Parser

    relevance

    10/10

  • PE file is packed with UPX

    details

    "KeyGen.exe.bin" has a section named "UPX0"
    "KeyGen.exe.bin" has a section named "UPX1"

    source

    Static Parser

    relevance

    10/10

• Environment Awareness
  • Reads the active computer name

    details

    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")

    source

    Registry Access

    relevance

    5/10

• General
  • Contains ability to find and load resources of a specific module

    details

    FindResourceA@KERNEL32.DLL from KeyGen.exe (PID: 2900) (Show Stream)

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Opened the service control manager

    details

    "<Input Sample>" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)

    source

    API Call

    relevance

    10/10

  • Requested access to a system service

    details

    "<Input Sample>" called "OpenService" to access the "AudioSrv" service
    "<Input Sample>" called "OpenService" to access the "ServicesActive" service requesting "SERVICE_QUERY_CONFIG" (0X1) access rights
    "<Input Sample>" called "OpenService" to access the "AudioSrv" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights

    source

    API Call

    relevance

    10/10

• Remote Access Related
  • Reads terminal service related keys (often RDP related)

    details

    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED")

    source

    Registry Access

    relevance

    10/10

• Unusual Characteristics
  • Imports suspicious APIs

    details

    VirtualProtect
    GetProcAddress
    VirtualAlloc
    LoadLibraryA

    source

    Static Parser

    relevance

    1/10

  • Reads information about supported languages

    details

    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

• Hiding 1 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 6

• Anti-Reverse Engineering
  • Contains ability to register a top-level exception handler (often used as anti-debugging trick)

    details

    SetUnhandledExceptionFilter@KERNEL32.DLL from KeyGen.exe (PID: 2900) (Show Stream)

    source

    Hybrid Analysis Technology

    relevance

    1/10

• General
  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Local\MidiMapper_modLongMessage_RefCnt"
    "Local\MidiMapper_modLongMessage_RefCnt"

    source

    Created Mutant

    relevance

    3/10

• Installation/Persistance
  • Connects to LPC ports

    details

    "<Input Sample>" connecting to "\ThemeApiPort"

    source

    API Call

    relevance

    1/10

  • Touches files in the Windows directory

    details

    "<Input Sample>" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls"
    "<Input Sample>" touched file "%WINDIR%\system32\wdmaud.drv"
    "<Input Sample>" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui"
    "<Input Sample>" touched file "%WINDIR%\system32\en-US\wdmaud.drv.mui"
    "<Input Sample>" touched file "%WINDIR%\system32\en-US\MMDevAPI.DLL.mui"
    "<Input Sample>" touched file "%WINDIR%\Fonts\staticcache.dat"
    "<Input Sample>" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui"

    source

    API Call

    relevance

    7/10

• System Security
  • Opens the Kernel Security Device Driver (KsecDD) of Windows

    details

    "<Input Sample>" opened "\Device\KsecDD"

    source

    API Call

    relevance

    10/10

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "KeyGen.exe.bin" was detected as "UPX v1.25 (Delphi) Stub"

    source

    Static Parser

    relevance

    10/10

File Sections

File Resources

File Imports

• GDI32.dll
• KERNEL32.DLL
• MSVCR80.dll
• USER32.dll
• WINMM.dll

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.