anubis left
Anubis - Analysis Report
anubis right

Analysis Report for 58682074.exe

 Comment on this report

Table of Contents
expand all expand all   collapse all collapse all

1. General Information

  - Information about Anubis' invocation  
Time needed: 250 s 
Report created: 01/24/12, 02:42:14 UTC 
Termination reason: Timeout 
Program version: 1.75.3394 

2. 58682074.exe

  - General information about this executable  
Analysis Reason: Primary Analysis Subject 
Filename: 58682074.exe 
Command Line: "C:\58682074.exe" 
Process-status at analysis end: alive 
Exit Code: 0 

  - Load-time Dlls  
Module Name Base Address Size
C:\​WINDOWS\​system32\​ntdll.dll  0x7C900000  0x000AF000 
C:\​WINDOWS\​system32\​kernel32.dll  0x7C800000  0x000F6000 
C:\​WINDOWS\​system32\​MSVBVM60.DLL  0x73420000  0x00153000 
C:\​WINDOWS\​system32\​USER32.dll  0x7E410000  0x00091000 
C:\​WINDOWS\​system32\​GDI32.dll  0x77F10000  0x00049000 
C:\​WINDOWS\​system32\​ADVAPI32.dll  0x77DD0000  0x0009B000 
C:\​WINDOWS\​system32\​RPCRT4.dll  0x77E70000  0x00092000 
C:\​WINDOWS\​system32\​Secur32.dll  0x77FE0000  0x00011000 
C:\​WINDOWS\​system32\​ole32.dll  0x774E0000  0x0013D000 
C:\​WINDOWS\​system32\​msvcrt.dll  0x77C10000  0x00058000 
C:\​WINDOWS\​system32\​OLEAUT32.dll  0x77120000  0x0008B000 

  - Run-time Dlls  
Module Name Base Address Size
C:\​WINDOWS\​system32\​MSCTF.dll  0x74720000  0x0004C000 
C:\​WINDOWS\​system32\​SXS.DLL  0x7E720000  0x000B0000 

2.a) 58682074.exe - Registry Activities

  - Registry Values Read:  
Key Name Value Times
HKLM\​SOFTWARE\​Microsoft\​CTF\​SystemShared\​  CUAS  0  1 
HKLM\​SYSTEM\​CurrentControlSet\​Control\​Session Manager  CriticalSectionTimeout  2592000  1 
HKLM\​Software\​Microsoft\​Windows NT\​CurrentVersion\​Windows  AppInit_DLLs    1 
HKLM\​Software\​Policies\​Microsoft\​Windows\​Safer\​CodeIdentifiers  TransparentEnabled  1  1 
HKLM\​System\​CurrentControlSet\​Control\​Nls\​Codepage  932  c_932.nls  1 
HKLM\​System\​CurrentControlSet\​Control\​Nls\​Codepage  936  c_936.nls  1 
HKLM\​System\​CurrentControlSet\​Control\​Nls\​Codepage  949  c_949.nls  1 
HKLM\​System\​CurrentControlSet\​Control\​Nls\​Codepage  950  c_950.nls  1 
HKLM\​System\​CurrentControlSet\​Control\​Terminal Server  TSAppCompat  0  3 
HKLM\​System\​CurrentControlSet\​Control\​Terminal Server  TSUserEnabled  0  1 
HKU\​S-1-5-21-842925246-1425521274-308236825-500\​Keyboard Layout\​Toggle  Language Hotkey  1  2 
HKU\​S-1-5-21-842925246-1425521274-308236825-500\​Keyboard Layout\​Toggle  Layout Hotkey  2  2 

2.b) 58682074.exe - File Activities

  - File System Control Communication:  
File Control Code Times
C:\Program Files\Common Files\  0x00090028  1 

  - Device Control Communication:  
File Control Code Times
\Device\KsecDD  0x00390008  8 

  - Memory Mapped Files:  
File Name
C:\WINDOWS\system32\MSCTF.dll
C:\WINDOWS\system32\MSVBVM60.DLL
C:\WINDOWS\system32\SXS.DLL
C:\WINDOWS\system32\imm32.dll
C:\WINDOWS\system32\rpcss.dll

2.c) 58682074.exe - Other Activities

  - Mutexes Created:  
CTF.Asm.MutexDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500
CTF.Compart.MutexDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500
CTF.LBES.MutexDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500
CTF.Layouts.MutexDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500
CTF.TMD.MutexDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500
CTF.TimListCache.FMPDefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500MUTEX.DefaultS-​1-​5-​21-​842925246-​1425521274-​308236825-​500

  - Windows SEH exceptions:  
Description Times
Exception 0xc000008f (STATUS_FLOAT_INEXACT_RESULT) at 0x7c812aeb  15933 


International Secure Systems Lab
Vienna University of Technology, Eurecom France, UC Santa Barbara
Contact: anubis@iseclab.org