Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'UmCAService-1.8.1.msi'

not enough data to reliably determine

UmCAService-1.8.1.msi

This report is generated from a file or URL submitted to this webservice on June 6th 2018 16:05:22 (UTC)
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v8.10 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before Request Report Deletion

Incident Response

Risk Assessment

Remote Access: Contains a remote desktop related string
Network Behavior: Contacts 1 host. View all details

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 2
External Systems
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  1/60 Antivirus vendors marked sample as malicious (1% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
Network Related
- Malicious artifacts seen in the context of a contacted host
  
  details
  
  Found malicious artifacts related to "88.221.134.41": ...File SHA256: 5eb44cb7061e403f8995e70b43463ef3c3aa89a27102a131e1faea0cedea94e2 (AV positives: 23/68 scanned on 06/06/2018 15:06:46)
  File SHA256: 165e7c639bd94e0783a04e2d4f5370aca6c8f2b5fb95f95cbe54bf739b85ba7a (AV positives: 23/68 scanned on 06/06/2018 15:06:00)
  File SHA256: 5547da78877621f1a0aa99590f3ecd0404e2605e810567cd9e4b1117fda1db78 (AV positives: 60/68 scanned on 06/06/2018 15:02:20)
  File SHA256: 90341d30d73ecf276c768e632c4f136d1711775e06af8394f95a625939edb537 (AV positives: 58/67 scanned on 06/06/2018 14:59:20)
  File SHA256: f719b6b18293e91fa6a19d559c475955d0153f0687494a7016ca4b75af965370 (AV positives: 21/68 scanned on 06/06/2018 14:58:18)
  File SHA256: 2a1bb0a1a8d7646559e0db8e3f42d3a939dd1f7361ea18187746b9b739193924 (Date: 06/06/2018 10:58:24)
  File SHA256: 0f1c8f903bb5cdd5a49301bf233b17d3dcbd7a1493ce22d3bb3b73c13c16abce (Date: 06/06/2018 09:41:47)
  File SHA256: e42bc73af8ca04561c7f66b54256d3865ae22addfad57f546e8efb131218a0bc (Date: 06/06/2018 05:27:48)
  File SHA256: 42d570f13478f0556ed101fcc8b2cb27896e2de72a9e06108c38d6fc9e971ff0 (Date: 06/06/2018 05:20:40)
  File SHA256: a3405c8087b4dd0a5b2a95dca4d9d82dd3275da8e2dd44cc8c3c8426569993ee (Date: 06/05/2018 13:33:37)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10

Suspicious Indicators 5
Anti-Reverse Engineering
- Possibly checks for known debuggers/analysis tools
  
  details
  
  "B1D El_Salvador)C1D EnsenadarC1D FortalezaTI1D Fort_Wayne6J1D Glace_Bayi1D Godthab'c1D Goose_Bay1D Grand_Turkh1D Grenada1D Guadeloupe1D Guatemala1D Guayaquil1D Guyana*1D Halifax 1D HavanaS2D HermosilloT2D Indianapolis!g72D Knox}}X2D Marengos2D PetersburgP2D Tell_City2D VevayP2D Vincennes,2D Winamac.2D Indianapolis_12D Inuvik3D Iqaluit63D Jamaica:3D Jujuy_1 :3D Juneaut$[3D LouisvilleW 3D Monticellop3D Knox_IN73D Kralendijk3D La_Paz3D Lima$3D Los_AngelesE3D Louisville_1$3D Lower_Princes3D MaceioN3D Managuav3D Manaus3D MarigotJ3D Martinique~<3D Matamoros3D Mazatlan4D Mendoza_1k" (Indicator: "ntice")
  
  source
  
  File/Memory
  
  relevance
  
  2/10
Environment Awareness
- Possibly tries to implement anti-virtualization techniques
  
  details
  
  "EVjPVWjREHVjPEPMQSURWEP$_^[]UVu%?yH@+S3FW]uQDs3FQzED3FQOEDMUEMRUPQR9EMUPQSR'6PEWVSVPfMUQWREDVjPVjSM6PWVSVQ/MI03M~T@;E|El8MWURjEPQWE}:UERWPz}MAQEMUPjVQEERP=MUQMUPQREMUPjVSQREMAM@ERPQuUVjRVjSEMUPQROEEUPSR>ESjVPVSMUTQjVSVREMEMRPQERjPMQ4UVjRVjSSEPMQjWW0_[^]2^]UVu~}%?yH@umMUSQRVfu[2^]WVWSVfSIE]PSVPSWVMQWVW$_[^]2^]US]Vs3FWQ8MEWPQSD8uuEu" (Indicator: "qemu")
  "@$X<xB:H]:tr52fx`BRL0Ym UYCO%gVnx?{x}*&PZU|Pg)UKzb;-"Pg>O+\4gnd<`pPT\QEMU" (Indicator: "qemu")
  
  source
  
  File/Memory
  
  relevance
  
  4/10
General
- Found a potential E-Mail address in binary/memory
  
  details
  
  Pattern match: "yh@eeppwwhxuu.jp"
  Pattern match: "rj@eph.mh0mh8mfpr"
  Pattern match: "meuj@mqhw.uuq"
  Pattern match: "p.m@p.mum"
  Pattern match: "at@tepq.e38ee"
  Pattern match: "0@pyp1.2.804.2.1.1.1.1.3.51.2.804.2.1.1.1.1.3.40"
  Pattern match: "support@author.kiev.ua10u"
  Pattern match: "g5@p.v8"
  Pattern match: "cf@d.l2em"
  Pattern match: "mc@83wdw.v0"
  Pattern match: "qmv@ze0.od_ytva1hvu2"
  Pattern match: "ir@h.ti"
  Pattern match: "piwaov@3_s.cv"
  Pattern match: "_@czrj8.y"
  Pattern match: "yvcabq@nt.39k"
  Pattern match: "v@qoyk.fn"
  Pattern match: "u@z.p"
  Pattern match: "h@q.s"
  Pattern match: "aeys6vf@davb4.lerc"
  Pattern match: "zf@2c.q"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
Network Related
- Found potential IP address in binary/memory
  
  details
  
  Heuristic match: "SsG=QSoe0siqiQSoe0siqISoe0siQSoe0sISoe0SiSiiISoe0SiSiISoe0SiSISoe0SiISoe0SISSdSxz`pp ``z 6`p,{P`ppx{u{0@pyP1.2.804.2.1.1.1.1.3.51.2.804.2.1.1.1.1.3.40*$+VE<p{#^X7)8k%Nr"
  Heuristic match: ":(_d8d,>mySSoe0siqiQSSoe0siqISSoe0siQSSoe0sISSoe0SiSiiISSoe0SiSiISSoe0SiSISSoe0SiISSoe0SI|`P@ 6000@60 pP60SxQSisQSiSdx1.2.804.2.1.1.1.1.1.1.5SD/BD7q[V9Y?^[1$}Ut]rtiG$o,-tJ\vRQ>m1'YGQcg))"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
Remote Access Related
- Contains a remote desktop related string
  
  details
  
  "bJwvnc!#HPmoh2mwURt" (Indicator for product: Generic VNC)
  
  source
  
  File/Memory
  
  relevance
  
  10/10

Informative 3
General
- Contacts server
  
  details
  
  "88.221.134.41:80"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contains PDB pathways
  
  details
  
  "!"#$%&'()*+
  -./0123456789:;<=>?@aicustact.dllAI_AuthorSinglePackageAI_ResolveKnownFoldersAI_SearchOfficeAddinsAddCaspolSecurityPolicyBrowseForFileCheckFreeTCPPortCheckIfUserExistsChooseTextStylesCloseApplicationCollectFeaturesWithoutCabComputeReplaceProductsListConfigureServFailActionsCreateExeProcessDeleteEmptyDirectoryDeleteFromComboBoxDeleteFromListBoxDeleteShortcutsDetectModernWindowsDetectProcessDetectServiceDisableFeaturesDoEventsDpiContentScaleEnumStartedServicesExtractComboBoxDataExtractListBoxDataGetArpIconPathGetFreeTCPPortGetLocalizedCredentialsGetPathFreeSpaceInstanceMajorUpgradeJoinFilesLaunchAppLaunchLogFileLoadShortcutDirsLogOnAsAServiceMixedAllUsersInstallLocationMsgBoxMsmTrialMessagePlayAudioFilePopulateComboBoxPopulateListBoxPrepareUpgradePreserveInstallTypePreventInstancesUpgradePrintRTFProcessFailActionsRemoveCaspolSecurityPolicyResolveKnownFolderResolveServicePropertiesRestoreLocationRunAllExitActionsRunAsAdminRunFinishActionsSetLatestVersionPathStopProcessStopWinServiceTrialMessageUninstallPreviousVersionsUpdateFeatureStatesUpdateInstallModeUpdateMsiEditControlsValidateInstallFolderViewReadMeWarningMessageBoxRSDS[`gvF9*C:\Branch\win\Release\custact\x86\AICustAct.pdb=GCTL.text$mn.idata$5R.rdata$P.edata
  X.rdata$zzzdbgx-.idata$2T..idata$3h..idata$4 1.idata$6@$.data(@0.bssP.rsrc$01P.rsrc$020 1/1\01/82l0X2/|506.", "6IwJ<7@]#
  >k&uMw1$S>nwSU5(/xbo"n9jL*M1CDScLFHQ4v\6$}7F%TBY.PDb {Ou64Hu3"-ns%oA =X\
  ]sBX(0Q#Q6%\O"
  
  source
  
  File/Memory
  
  relevance
  
  1/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Pattern match: "l.vx/k"
  Heuristic match: ")-IyY\]#5sjI#whAAAAAC.]< A++.SY"
  Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0U%0"
  Pattern match: "http://t1.symcb.com/ThawtePCA.crl0U%0++0U0"
  Pattern match: "http://tl.symcb.com/tl.crl0U0U%0"
  Pattern match: "https://www.thawte.com/cps0/+0#!https://www.thawte.com/repository0U000"
  Pattern match: "tl.symcb.com/tl.crt0`HB0"
  Pattern match: "http://www.advancedinstaller.com0"
  Heuristic match: "/o:fG 9MWQ^-ZI}/l^%Vc*?{SkD^^Y[w'#JT[2h^ET9'[UU]m7> *KqdTO&Ts_f_z?7zNyIplN.NF"
  Pattern match: "a-kkqDw-u.fmN/HD#9k:0"
  Pattern match: "hr.msg/l+D"
  Heuristic match: "Yct.Xrol(`n.c6mKzOXvx_lT}dUj;2$9KHmWKC6g-#QA-8Y-WNrU/80u/?pf\L-p5@<f<{`>N:=pR,[3*\'@ 8{9Xi%85~).pR"
  Pattern match: "sAy.OmP/y~h"
  Heuristic match: "U$b^mQk5+VGnc:uRo.<0M>d{MxT7frb@7LN56h~;}/l5l2JaNQLMw/L-<=w?9;^\J'PiwAOv@3_S.cV"
  Heuristic match: "o:]PWzIh3^w.Cm"
  Heuristic match: "k\@*0(HS4$*)E&!~~w{G}b:.]^bla';]Qr#*2jz kw0^Z.AQ"
  Pattern match: "fr4HJcXN.5.sy/;CTXSHyy\\8V[x*"
  Heuristic match: "AH$Z j2BQOO;4tXm? {a' U>}Y<MH`+8l}mM~$'-mbgI>.Cy"
  Pattern match: "W.Dk/bv^EJm"
  Pattern match: "TVRgvUcW.GG/-ld6"
  Heuristic match: "~B;xT-nC/n60Imml6.nO"
  Heuristic match: "z{N*AD3Lx0b_H6NyJ<xOefu^?K<^'UO9'y<,9_''o}|<,hqI+MR-[:bgH`gJ)LIfM73.no"
  Heuristic match: "J(zG?Y?MXb {V+oJ-hJmAFz>g|.Tn"
  Pattern match: "R.TB/:&m*cNNu]c\L{4i'nOOcUMDNpzkLC&"
  Pattern match: "Vyw.Yfw/8C=}`*6[&mf%Kg18?|pDN,Kgq?t9Wc\zKVQPwJ;.P"
  Heuristic match: "\8w<QrM9(c%j'K1;223>Mbqi2'44c6A Ss!DT?MRT_{9.QCF^$>G'LV*epx)jE8ap.Ai"
  Pattern match: "N.voBK/+8?$'omsP=V6ogZEoQ\O.r"
  Heuristic match: "^f/CMyAi(:{w_,&/Ncu,dnSKaK.NI2<w`Q2~cSWh-ZiL,Sl-8)e.se"
  Pattern match: "bPMJ.IEz/9-t'f,_"
  Heuristic match: "mZ//zsJ5E'ihC.,{X.gr"
  Pattern match: "a4AV.uZL/}v"
  Heuristic match: "0-o^.{s!e(kS{ q*p:l92Ub!RO[_s+&4/6Elxq@iUD]*{}% PKa8c<GHPD='@Yh&&+7:l[CPqEbK6$2;HZ_?SO6A;S}ahk-w&JODg*GnQe7qF?-U9#vUi{V3g?Ul*=~5_fUfKX.US"
  Heuristic match: "v19%>q?#[eFf.Tl"
  Pattern match: "Yiw.Ki/+i+:q8d&UlO"
  Pattern match: "7t.wMEO/[X.whr/ee/CT|"
  Pattern match: "u.bx/7#m0#w\]C@7@.*%n8$}{9#~"
  Heuristic match: "p6{,gCt&g6adLX7lB[8bQw5\<[O-O_tXs%0!21}22*o^&foY&&_d#_xDy'byzAn3-L8c$)_*0}3wEt1IW1B{oF6IF'~dOs.pY"
  Pattern match: "Sy.yB/A5cwM,1Ri/B|N"
  Heuristic match: "sJAAVgLNy:U0Njy^.VI"
  Pattern match: "sA.OS/=$"
  Pattern match: "y.EF/hb{OF3P/M\I"
  Pattern match: "t.lq/R^tI%4}%}#Fp+W~@^"
  Heuristic match: "^]u}z%<}NzjXp&S<PU!G;s_S;s\y`{_W<R\nW(x<u^=ln#k.R>O#977s Gh.uz"
  Pattern match: "Y.6.hu/+x_${yd%BF\/8"
  Pattern match: "y.Opqz/NJy5%yl"
  Pattern match: "6.ir/4j\{`-xuvX/jI{`dapm1GfTb@"
  Pattern match: "o.dNNP/XI08"
  Pattern match: "SrAw.at/9vh"
  Pattern match: "18.UKW/x1LW3h24@_D+P/r"
  Heuristic match: "'LW&YAVFE$BPgm36!~|ENfZDd7PS.7yo% =$: S<(79Z8/jukJAct$NZqtow~uU E}><;_PO8fYY|s,2Y]sbSyuT)likE[|XMYgW;n-@!.ar"
  Heuristic match: "vkX3q/9-<o7PBsL=RhybWlyTxuXups~:ii%M\j/OFu(T)}M_;3Gf5MhJS%J%[i!L.CH"
  Pattern match: "F1.jDQ/5T!UOH!CL^6L-\FW,nbur%"
  Pattern match: "w8zHvvr.KilG/Gq8Zehx+"
  Heuristic match: "9p<ks'9MGNdXxeLnOq0nA&L]gs]3qEgmNm|j,p7;{y5ac'V[Dq;G1)uO&^:r~?i0:_u@]M3f.ru"
  Heuristic match: "=%BBx-+z5%2,@YjutA9~yLenw.DJ"
  Pattern match: "e8bMU.mxi/YzW:ZM"
  Pattern match: "DRPrVT.pUW/qyVd-D4arPo@tVX.9RrWJ~G\SR'*\tj7ln/t"
  Heuristic match: "C^6).RK@ah0b|){.$Zh:{@b7{nJCV,T)8Aa T_]t~s0PGOybPXQebAIp'x$`Wu6ne.fi"
  Heuristic match: "/uv 7|=JoXwKKVFU_e.tl"
  Pattern match: "r5GYB.zrg/WbDHAvQ2w+Y"
  Pattern match: "l.pv/L3kM&?8%}G3qng&?s=$uI"
  Pattern match: "S.ksSW/;y3/Z0'6Kpq=67j59&N"
  Heuristic match: "3I.Mg"
  Pattern match: "tc.TISo/[SWNkG"
  Pattern match: "Q.dNF/Tyu_t;.xLcDt|0#QduHR0zY[lFCydSg"
  Pattern match: "3eNE.MFo/oLiKy#227&0/KVh+%md_t8%s^84"
  Pattern match: "kfO.rw/UF"
  Pattern match: "v12IQxCAq.wI/&e6&#:9Yr5e\5&00QW"
  Heuristic match: "{;d`eU^tJ@h2R2.HN"
  Pattern match: "D.MdRn/{IP6f"
  Pattern match: "zsC.ico/&FcVq7I"
  Pattern match: "q.xH/@'o!pX?[8YyVi3qu?}Z9J"
  Heuristic match: "=rtrd>B:[0f=^vv%jn<8Z+G2eoBy|g~9}AQpNuN342rO&K&_>DbKOqnM-9doT7mk.SI"
  Heuristic match: "^7sH^3ih>w/s$7@9X0Z_khtT*8Mo.ye"
  Pattern match: "5.puq/l%1sQ\j-/f?qEMrFW|t#T8{=S"
  Pattern match: "g.DW//g,T8]LQ4"
  Pattern match: "QS.Zmd/ovCzO@"
  Pattern match: "xfO.tIm/_C=F2Tu%AfA}+"
  Pattern match: "0s.TkRU/_*Mu-nvu:cz?1S^ZG]?Ck_l8RZ%*?&l"
  Pattern match: "H.wq/G5"
  Pattern match: "U5g0.jW/8,O%+/2MyX=x+s[I4]K"
  Pattern match: "dK-.hUa/s}x9U"
  Heuristic match: "X6Mf`lv;]n`Cap8N'Sip8.Ke"
  Heuristic match: "J^xi4M.fK"
  Pattern match: "X7.kLh/kd7"
  Heuristic match: "X!Mk(pZ,/2$k>8]E~[oI{00H'3oo#g:a)tD~LK/EH.nc"
  Pattern match: "q5.IN/`]S0eG"
  Pattern match: "9B.STN/;|ic_~QvM`P,[cY-3yUPuu"
  Pattern match: "dt.WirA/{82="
  Heuristic match: "N<cT%/bV*I'Q?2<MrR&u6bw#)~xE8e;7|J[28FCg0qw.ml"
  Heuristic match: "x@5}O?4dFHkd4b3gAVBDx>+ohuAWw_B3Ehk:Ad0HP<.Je"
  Pattern match: "XBcdt.EZ/:/V{'vncx8_itIF=Nh"
  Pattern match: "lra.vGkn/sg;W.o$,~*c]@te&45"
  Heuristic match: "PAfr~fN1GOVj;x7rz(B!x5}J*u#ro+>jx?,405<. x?i*?Z&[lPBQdn{rC`!8kJ^}]/,~.TN"
  Pattern match: "amY.OfeS/n-0X}v/lv,F*^;,P41Y;qsRO&gYZW$"
  Heuristic match: "ZX-9EO'AzLmA(Z%L7aJ%>SpK^.NC"
  Pattern match: "nP.Tf/w3Phr=H`7ifJ5-pQkGV0X"
  Heuristic match: "qfit.Tz"
  Pattern match: "kdn.Bo/+CKUS0J;OmmmmmorrC;5Fj||lWaeC~8c"
  Pattern match: "n.hj/]'mGO_3nDg|4c+TPuQx=fhGg^%f3f"
  Heuristic match: "ld$4`E.V~XV O0GjW25Ui| [2/kW!IOxMS|rz{VeE-9=~PJKTk~znz;mWZ,w[FK-J8=8&-7*g6tK*a)nHr{d'3\Jb/*z@f&x2s(q&;rN;![{ejZthXw#DYT~VZHDWyDcO{kC #ol>e=vj}.an"
  Pattern match: "..pn/F/HoPw3KZ@32m"
  Pattern match: "3s.Lw/LOz:S^pN-?PSopL}?ituwEtH{4r%5bX\;b/82R1#=,qZnQh8Hc"
  Heuristic match: "zAX)/:So.Mp"
  Heuristic match: "(@o1\X/XH,qy<#-1%g!h:..]fD]mBIuuU$$OKp5REbRB?.eT"
  Pattern match: "kc6.zbuy/^=F"
  Pattern match: "EMEunc.RRJV/J_Lse"
  Heuristic match: "IAE$n)?NXPlv]s{V.kh"
  Heuristic match: "9\n6g1p<S}4sL{d!)Vv-zo}fow.UY"
  Pattern match: "6.Xg/P]IX"
  Pattern match: "a9.Vwl/\G]gB9*G+gPXggjcmqFWOfGdpp"
  Heuristic match: "^5Z$Q}n2)b`ryk-pE*}_Jd]sN.tW"
  Pattern match: "aCeoH.vtz/ngnRY]BY"
  Pattern match: "C.NX/bpo^=h6"
  Pattern match: "f1.fm/tQ"
  Pattern match: "2f.jt//IbwV5Wn-_5![\KDti;|o|pHB%Osb%1"
  Pattern match: "III.Vb/XKc@}J='z:%5"
  Heuristic match: "vXhW#v<Es.aN"
  Pattern match: "m.owGh/r+ntR7H78wfj'5be/"
  Pattern match: "l150.cW/f-~%D355_$FuX6=?X}&mxxn&(`NWwIO0-O#)zqWnsy|U;1c#F*tCL"
  Heuristic match: "Q`(um}mA04Xq}/IOS63VBg'8&X.}3s),gjx{oB[km7<($or-U[20AD7ofNo],6rz=svu`[/XO2#r<y1*9@^K~LK>D^NKC#Or.pf"
  Pattern match: "gP.Be/`6%Hcd@"
  Heuristic match: "'#KC8.Sa"
  Pattern match: "V1T.hTV/PM]D@qW=8b"
  Pattern match: "Q.DP/d5rG"
  Heuristic match: "ah.vm-NQK:j[N>^D/o}Pp<<nF[+m{m7h-dty`hdS_DkM~f7><)hWG.;%^2uc6o.kE!NjTHS]uA|.@E{S-sl5,:ysgK3%I;3nKv.Fi"
  Heuristic match: ":E$>9R]V$N3>Vr~V5]E#@?F_TY{9]=.MV"
  Pattern match: "0.nR/qdWN`0'vAmh4%&G|="
  Heuristic match: "TMp3m)rb.bj"
  Pattern match: "z.Nw/Yw89GQG+!k+{o;pV9=SWrEo,`R$|dS@c6IT\{`p^7^R~jM#8XKvQML]tX[;!6[Q:[!v{VW"
  Pattern match: "PrF0YP.Um//;9"
  Heuristic match: "[]h8YX$a`y#MffVu.Tn"
  Pattern match: "l.kOQ/sOysi]9'#p`ktds*FI-BIPyi"
  Heuristic match: "OC^D6||'%uE[547~a6p\W:aONY*U{u2G'>+dq7}5G;V6uEb+8%4^8HtRZ~{Iw\.tT"
  Pattern match: "g.Am/JvT&J'c_yGS`Kdfhk*@"
  Pattern match: "0SQ2s3.WiV/^sct,e\_},d-"
  Heuristic match: "C_Jc2/7_MN4vsu.Be"
  Pattern match: "j1.HQhj/bH2=R"
  Heuristic match: "3[6{c\z7'7begTlfG+^Li*V%8)_/IcJbGUWln>-,}P/lf*$?hFo5Y:fV'W'[@5Wfdu}Hf^gQ_L.sE"
  Heuristic match: "\WYViq'$/nyEU]U&.`fzbz|pD;6X4P78fE<C_GtKXB,&C^[11&6Gn2wvsx!DmPMQJ:$`Xc@htas&')AjTe )Bjc/+/A!MtEFmq$qHb]`,hXcenmpwR4ecm'=.YE"
  Heuristic match: "|q?).va"
  Heuristic match: "JUp9J)UyJXX=\QZz*Ae=dE.UK"
  Heuristic match: "E}9J<^~Bu\#:bcMMYf4CMwS3T!v\n5&~UdB`i}c%v w!:QD91blFpc&BBG5EB7_tx/%|PFY}V8-/6H{FLgmvl#tbD1f -fbQ2DF;KXL{8}*D@O0Gw~^#qv#~UV/0 3j@)Ks(:brCD2\:x]zx.kY"
  Heuristic match: "M5Z2}/==tg`M/LVPzkZgo^ 2{I.8e3aq-5-UV<$<PX~#?9#|@R7th(05sNG^3W=z,5;m;t%0@FfYybL~ZR.mH"
  Pattern match: "g.kXcH/k(Uj/[UKR0cRKRg+JF{aAL^D3@}\zOz63INR#|fv-`so0S})b]s$h7Vug0/v{-x=BLeUOB~MqWyhQOW\DNN_^"
  Pattern match: "k-V.WX/Z4F2+^Xdp_c6+diV+H}_z~lBJ&O}xE?7}?k%!%mX'v6"
  Heuristic match: "W >Q=YcityXz&{7{xo%xf)i6>n!CKxid0Kuqt-}*/^%SQ%hmILcWa+=c{P%J86xI\wn.VM*P\p}kXX):{(@%D^nAzo\_n:'67|\>dV06[|dytnA#_3T29x>GixN@nPMrAtYR9MZ?8.TM"
  Heuristic match: "*~z|\=.hT"
  Heuristic match: "-kXDon=,j['%k[B+kCYBiERI.UY"
  Pattern match: "rc7.Apqk/zy/o#ZDx"
  Heuristic match: "Pl;r$D}Ni= %>JOI/Aj#,jF.I@F+{t(CfjDu<[;TB@Q2GJPa~0xn!0;oWV3[^ya*/E3cW8#5HT!4K~5D/n&C.pR"
  Pattern match: "E.RY/.Pu8BO'O;\.?y"
  Heuristic match: "z.YO[I(2>^0Vc3VfA!${*8V]kjKHf4a4 q(V_tI U0.BT"
  Pattern match: "WfHpLPF.lW/R^e?[^0@5c"
  Pattern match: "l.lSq/ug^"
  Heuristic match: "<0@RDbv|.uS"
  Pattern match: "WH.pqL/m!v"
  Pattern match: "tx0Y.Bl/`7]%t0$lVpe}bGu;hP{gzWKGjMJgmp|N11WBdW3qZd{BZi$:gJEDL'8i\OYjzcl"
  Heuristic match: "pA=__2wcMaYZJi8h'P1).!18(unhoIRU/i_h)w~.0%aI%68dpcqB.ZM"
  Pattern match: "I.Beh/.Lu{w"
  Pattern match: "N.ni/k938[*/I"
  Heuristic match: "rP- QEC;p|`(IHAp|`(IHAp|`(IHAtK<pC|Wx|' {60x|,XB6a+v`G_pG]|x&.CD"
  Pattern match: "9.sx/LxXq"
  Pattern match: "Y.YY/a]E]rdDBmCYNKlXWUN"
  Heuristic match: "12Sq82'Ug=].CU"
  Pattern match: "n.Oj/suZ@N~BE[n:A0I%i/U1]g'f"
  Pattern match: "m.zt/wAA@/:zmmA3t*Z%"
  Heuristic match: "2k$:HgH!5j.!h%=}OR)-{Q_m),&\o?nE5<WFI:Rgxf!\VTLESgDR-g`U1OeuQ:r51K';;APD~6_5Nj#. }Z([(Zc,GQ|5;2T|O.gd"
  Heuristic match: "}v>i[Cvs.rw"
  Pattern match: "47.XUUE/kfS"
  Pattern match: "84.zo/sy9ce?\XJtMI"
  Pattern match: "Je.ZIR/x0y$K"
  Pattern match: "YN.oF/N}3kgdln"
  Pattern match: "IKt.sL/N8\Ri?BG~vCeG^LUTW()m!-islHJSj\pz]CxkGSDK#[JvvAJz`#z"
  Pattern match: ".J.Kn/+D-OvHnH-{@="
  Pattern match: "U-U.AcS/ICc=;jIiD"
  Pattern match: "c.WSz/'N\RK8"
  Pattern match: "yc.DHE/^MW:z5Bp"
  Pattern match: "H.HI/os_"
  Pattern match: "bIP.LLjz/U*bOjB10,45f"
  Heuristic match: "7y3X.HTe^')GbCBbzAv={y&C0&lVoVD+_Bq[b2p1n7/$@$ZG;{li4de+v`Rr4Yw$Zs'J*SDeor'>0E>iamT6Q++l$xASa|=U=T.Bd"
  Pattern match: "yalo.Jq/1^a1]f]&N+DZ'1z^r-XSL"
  Heuristic match: "8v[{d,i%H|xGPg%R>QNhL-y_!Nk#.lT"
  Heuristic match: "wwW_CN DI(W(E9Ag$Lx0Dp1a->7]RG{.pR"
  Heuristic match: "S(t]c>6_{gj ]uwYZ9H$C^oT*U\x-e4AI= PW#Z3:H=_&3d~%CwU0P6ea{R+PehNXv?$4]V^=.:qu^/o!tA @ A].Ax"
  Heuristic match: "SE!dCT?Jij!]T[QuT-]64.Bb"
  Heuristic match: "<f!.su"
  Pattern match: "ZDz.da/Ebv2I.BYB\3Q[d:dtrM2"
  Pattern match: "Ws.HEWL/@-TGR8z\VD!~REu`Xb]IgTc^yx"
  Heuristic match: "}z$cqlnC;8c`O`$5X\E=-|5hmuvB@+9!lho.avx@yB91sA]Uko@m+F]blMvHbl-\jo-iGko@]$cWAmoavBjVi,N0Z;a!mk[cm,06rc]cU0Z;STc[cxj%c7`kuZ_.cc"
  Pattern match: "wC.tL//fYm"
  Heuristic match: "$QpUuBNR#JYBYNg#%`IVbDq65WQ(G=HxqB~mij8y}|xX.Lt"
  Heuristic match: "0yT}9L<1A&VTmT,[|J$IB,MX 2})(b!8]b3lF/Bm@A fc*vQ,;b&M._$IQ=.kw"
  Heuristic match: "?/C% .+Wf.0sYkhb5Ve69~OcO#;aeO6K.K$A[M +,DBl0Jh<2<ezoEJ.DJ"
  Heuristic match: "TnP+uUORZS'dE0rTs<rXb.Cy"
  Pattern match: "rJ.Wf/gHe;w"
  Pattern match: "oWdS.tl/d&eFKFKSW|&,L!vgh^"
  Heuristic match: "jDs}`|bI1 O%3:U@.eT"
  Pattern match: "Yt.HbC/A*yU^_:]f]IpUyXsH=e/ohJ$6XImm@tC:=vox6Dg-A1{`QU_4$"
  Heuristic match: "ZA58s.XXb`-:V0j%{.bg"
  Pattern match: "Uf.QY/KdOr"
  Pattern match: "v-rn.cs/iZKbmb0sr[*MVXR{Cy_:Gm&QCG/J^a2*mJGWzBVh3drvWw$k"
  
  source
  
  File/Memory
  
  relevance
  
  10/10

File Details

All Details:

UmCAService-1.8.1.msi

Filename: UmCAService-1.8.1.msi
Size: 11MiB (11281920 bytes)
Type: doc office
Description: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1251, Revision Number: {37C37E67-9C85-4D47-B0AD-E6D12B42C2C2}, Number of Words: 2, Subject: UmCAService, Author: Avtor, Name of Creating Application: Advanced Installer 12.6.
Architecture
: WINDOWS
SHA256
: f29296838130e134c7aa784eace21a2ed70b56a32e89b7feb8c838cd15049fbc
MD5
: 431dea6dea2e0607cc8a3d7e3a46ad6a
SHA1
: 19e14dc8d684fa1a1651ae4fdf34939398f37c04

Resources

Icon

Visualization

Input File (PortEx)

Classification (TrID)

89.3% (.MSI) Microsoft Windows Installer
9.4% (.MST) Windows SDK Setup Transform Script
1.2% (.) Generic OLE2 / Multistream Compound File

Screenshots

Loading content, please wait...

Hybrid Analysis

No runtime process information available.

Network Analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

IP Address

Port/Protocol

Associated Process

Details

88.221.134.41

Associated Artifacts for 88.221.134.41

Details	Associated SHA256	Threat Level	Positives	Scan Date	Reference
Associated SHA256 5eb44cb7061e403f8995e70b43463ef3c3aa89a27102a131e1faea0cedea94e2 Threat Level malicious Positives 23/68 Scan Date 06/06/2018 15:06:46 Reference VirusTotal	5eb44cb7061e403f8995e70b43463ef3c3aa89a27102a131e1faea0cedea94e2	malicious	23/68	06/06/2018 15:06:46	VirusTotal
Associated SHA256 165e7c639bd94e0783a04e2d4f5370aca6c8f2b5fb95f95cbe54bf739b85ba7a Threat Level malicious Positives 23/68 Scan Date 06/06/2018 15:06:00 Reference VirusTotal	165e7c639bd94e0783a04e2d4f5370aca6c8f2b5fb95f95cbe54bf739b85ba7a	malicious	23/68	06/06/2018 15:06:00	VirusTotal
Associated SHA256 5547da78877621f1a0aa99590f3ecd0404e2605e810567cd9e4b1117fda1db78 Threat Level malicious Positives 60/68 Scan Date 06/06/2018 15:02:20 Reference VirusTotal	5547da78877621f1a0aa99590f3ecd0404e2605e810567cd9e4b1117fda1db78	malicious	60/68	06/06/2018 15:02:20	VirusTotal
Associated SHA256 90341d30d73ecf276c768e632c4f136d1711775e06af8394f95a625939edb537 Threat Level malicious Positives 58/67 Scan Date 06/06/2018 14:59:20 Reference VirusTotal	90341d30d73ecf276c768e632c4f136d1711775e06af8394f95a625939edb537	malicious	58/67	06/06/2018 14:59:20	VirusTotal
Associated SHA256 f719b6b18293e91fa6a19d559c475955d0153f0687494a7016ca4b75af965370 Threat Level malicious Positives 21/68 Scan Date 06/06/2018 14:58:18 Reference VirusTotal	f719b6b18293e91fa6a19d559c475955d0153f0687494a7016ca4b75af965370	malicious	21/68	06/06/2018 14:58:18	VirusTotal
Associated SHA256 2a1bb0a1a8d7646559e0db8e3f42d3a939dd1f7361ea18187746b9b739193924 Threat Level no verdict Positives - Scan Date 06/06/2018 10:58:24 Reference AlienVault	2a1bb0a1a8d7646559e0db8e3f42d3a939dd1f7361ea18187746b9b739193924	no verdict	-	06/06/2018 10:58:24	AlienVault
Associated SHA256 0f1c8f903bb5cdd5a49301bf233b17d3dcbd7a1493ce22d3bb3b73c13c16abce Threat Level no verdict Positives - Scan Date 06/06/2018 09:41:47 Reference AlienVault	0f1c8f903bb5cdd5a49301bf233b17d3dcbd7a1493ce22d3bb3b73c13c16abce	no verdict	-	06/06/2018 09:41:47	AlienVault
Associated SHA256 e42bc73af8ca04561c7f66b54256d3865ae22addfad57f546e8efb131218a0bc Threat Level no verdict Positives - Scan Date 06/06/2018 05:27:48 Reference AlienVault	e42bc73af8ca04561c7f66b54256d3865ae22addfad57f546e8efb131218a0bc	no verdict	-	06/06/2018 05:27:48	AlienVault
Associated SHA256 42d570f13478f0556ed101fcc8b2cb27896e2de72a9e06108c38d6fc9e971ff0 Threat Level no verdict Positives - Scan Date 06/06/2018 05:20:40 Reference AlienVault	42d570f13478f0556ed101fcc8b2cb27896e2de72a9e06108c38d6fc9e971ff0	no verdict	-	06/06/2018 05:20:40	AlienVault
Associated SHA256 a3405c8087b4dd0a5b2a95dca4d9d82dd3275da8e2dd44cc8c3c8426569993ee Threat Level no verdict Positives - Scan Date 06/05/2018 13:33:37 Reference AlienVault	a3405c8087b4dd0a5b2a95dca4d9d82dd3275da8e2dd44cc8c3c8426569993ee	no verdict	-	06/05/2018 13:33:37	AlienVault

Details	Domain	Threat Level	Positives	Last Resolved	Reference
Domain www.download.windowsupdate.com Threat Level - Positives - Last Resolved 06/06/2018 15:06:46 VirusTotal Report	www.download.windowsupdate.com	-	-	06/06/2018 15:06:46	Report
Domain strongsignal-a.akamaihd.net Threat Level - Positives - Last Resolved 06/05/2018 13:19:34 VirusTotal Report	strongsignal-a.akamaihd.net	-	-	06/05/2018 13:19:34	Report
Domain dist.blizzard.com.edgesuite.net Threat Level - Positives - Last Resolved 05/18/2018 00:00:00 VirusTotal Report	dist.blizzard.com.edgesuite.net	-	-	05/18/2018 00:00:00	Report
Domain blzddist1-a.akamaihd.net Threat Level - Positives - Last Resolved 05/17/2018 00:00:00 VirusTotal Report	blzddist1-a.akamaihd.net	-	-	05/17/2018 00:00:00	Report
Domain a1219.w10.akamai.net Threat Level - Positives - Last Resolved 04/29/2018 10:47:03 VirusTotal Report	a1219.w10.akamai.net	-	-	04/29/2018 10:47:03	Report

TCP

European Union

Contacted Countries

HTTP Traffic

No relevant HTTP requests were made.