Report - cutscroll.png

PE File OS Processor Check PE32
ScreenShot
Created 2021.04.30 09:48 Machine s1_win7_x6402
Filename cutscroll.png
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
12
Behavior Score
4.6
ZERO API file : clean
VT API (file)
md5 f5c29728fe1f4226a8dc603d788a0a6f
sha256 6c6cdded71d3398c3a29fbc8be8461a26d91057df1d9f8f47be49085b0a8695a
ssdeep 12288:ErMIH5gIEn3ByLEx8v+k1SRlMLeOAvRIwEP:0MU5G3BB0+RRKL/AvRI
imphash 9ef37d7737909563efaf7834f56f68c3
impfuzzy 192:N5wJ5hw1UKXDuwv6p9rsGMbvkMcncxcuvXP1QPLR:IJfwVqovXacf1QPLR
  Network IP location

Signature (12cnts)

Level Description
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Terminates another process
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info Queries for the computername

Rules (3cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://103.54.41.193/lib90/TEST22-PC_W617601.8F3740811540BBD5131268335F0573AB/5/kps/ BD Md. Manzurul Haque Khan T/A THE NET HEADS 103.54.41.193 clean
103.54.41.193 BD Md. Manzurul Haque Khan T/A THE NET HEADS 103.54.41.193 mailcious
178.134.47.166 GE JSC Silknet 178.134.47.166 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x433110 TerminateProcess
 0x433114 HeapSize
 0x433118 LCMapStringA
 0x43311c LCMapStringW
 0x433120 HeapDestroy
 0x433124 HeapCreate
 0x433128 VirtualFree
 0x43312c IsBadWritePtr
 0x433130 GetStdHandle
 0x433134 UnhandledExceptionFilter
 0x433138 FreeEnvironmentStringsA
 0x43313c GetEnvironmentStrings
 0x433140 FreeEnvironmentStringsW
 0x433144 GetEnvironmentStringsW
 0x433148 SetHandleCount
 0x43314c GetFileType
 0x433150 QueryPerformanceCounter
 0x433154 GetSystemTimeAsFileTime
 0x433158 SetUnhandledExceptionFilter
 0x43315c GetStringTypeA
 0x433160 GetStringTypeW
 0x433164 GetTimeZoneInformation
 0x433168 IsBadReadPtr
 0x43316c IsBadCodePtr
 0x433170 SetStdHandle
 0x433174 SetEnvironmentVariableA
 0x433178 HeapReAlloc
 0x43317c InterlockedExchange
 0x433180 GetCommandLineA
 0x433184 GetStartupInfoA
 0x433188 VirtualQuery
 0x43318c GetSystemInfo
 0x433190 VirtualAlloc
 0x433194 VirtualProtect
 0x433198 HeapFree
 0x43319c HeapAlloc
 0x4331a0 RtlUnwind
 0x4331a4 GetTickCount
 0x4331a8 GetFileTime
 0x4331ac GetFileAttributesA
 0x4331b0 FileTimeToLocalFileTime
 0x4331b4 SetErrorMode
 0x4331b8 CreateFileA
 0x4331bc GetFullPathNameA
 0x4331c0 GetVolumeInformationA
 0x4331c4 FindFirstFileA
 0x4331c8 FindClose
 0x4331cc GetCurrentProcess
 0x4331d0 DuplicateHandle
 0x4331d4 GetFileSize
 0x4331d8 SetEndOfFile
 0x4331dc UnlockFile
 0x4331e0 LockFile
 0x4331e4 FlushFileBuffers
 0x4331e8 SetFilePointer
 0x4331ec WriteFile
 0x4331f0 ReadFile
 0x4331f4 WritePrivateProfileStringA
 0x4331f8 FileTimeToSystemTime
 0x4331fc GetOEMCP
 0x433200 GetCPInfo
 0x433204 InterlockedIncrement
 0x433208 GlobalFlags
 0x43320c TlsFree
 0x433210 LocalReAlloc
 0x433214 TlsSetValue
 0x433218 TlsAlloc
 0x43321c TlsGetValue
 0x433220 EnterCriticalSection
 0x433224 GlobalHandle
 0x433228 GlobalReAlloc
 0x43322c LeaveCriticalSection
 0x433230 LocalAlloc
 0x433234 GetCurrentThread
 0x433238 GetModuleFileNameA
 0x43323c ConvertDefaultLocale
 0x433240 EnumResourceLanguagesA
 0x433244 lstrcpyA
 0x433248 lstrcmpA
 0x43324c DeleteCriticalSection
 0x433250 InitializeCriticalSection
 0x433254 RaiseException
 0x433258 CloseHandle
 0x43325c InterlockedDecrement
 0x433260 GlobalFree
 0x433264 GlobalAlloc
 0x433268 FormatMessageA
 0x43326c LocalFree
 0x433270 GlobalLock
 0x433274 GlobalUnlock
 0x433278 MulDiv
 0x43327c SetLastError
 0x433280 FreeResource
 0x433284 GlobalGetAtomNameA
 0x433288 GlobalAddAtomA
 0x43328c GlobalFindAtomA
 0x433290 GlobalDeleteAtom
 0x433294 LoadLibraryA
 0x433298 FreeLibrary
 0x43329c lstrcatA
 0x4332a0 lstrcmpW
 0x4332a4 lstrcpynA
 0x4332a8 CompareStringW
 0x4332ac CompareStringA
 0x4332b0 lstrcmpiA
 0x4332b4 GetVersion
 0x4332b8 GetLastError
 0x4332bc ExitProcess
 0x4332c0 GetModuleHandleA
 0x4332c4 GetProcAddress
 0x4332c8 lstrlenA
 0x4332cc MultiByteToWideChar
 0x4332d0 GetCurrentThreadId
 0x4332d4 WideCharToMultiByte
 0x4332d8 FindResourceA
 0x4332dc LoadResource
 0x4332e0 LockResource
 0x4332e4 SizeofResource
 0x4332e8 GetVersionExA
 0x4332ec GetThreadLocale
 0x4332f0 GetLocaleInfoA
 0x4332f4 GetACP
 0x4332f8 GetCurrentProcessId
USER32.dll
 0x433354 LoadCursorA
 0x433358 CharNextA
 0x43335c CopyAcceleratorTableA
 0x433360 InvalidateRgn
 0x433364 GetNextDlgGroupItem
 0x433368 MessageBeep
 0x43336c RegisterClipboardFormatA
 0x433370 PostThreadMessageA
 0x433374 ReuseDDElParam
 0x433378 SetCursor
 0x43337c LoadAcceleratorsA
 0x433380 InsertMenuItemA
 0x433384 CreatePopupMenu
 0x433388 SetMenu
 0x43338c wsprintfA
 0x433390 RedrawWindow
 0x433394 TranslateAcceleratorA
 0x433398 TranslateMDISysAccel
 0x43339c BringWindowToTop
 0x4333a0 DrawMenuBar
 0x4333a4 DefMDIChildProcA
 0x4333a8 DefFrameProcA
 0x4333ac GetDesktopWindow
 0x4333b0 CreateDialogIndirectParamA
 0x4333b4 GetNextDlgTabItem
 0x4333b8 EndDialog
 0x4333bc DestroyMenu
 0x4333c0 TranslateMessage
 0x4333c4 GetActiveWindow
 0x4333c8 EndPaint
 0x4333cc BeginPaint
 0x4333d0 GetWindowDC
 0x4333d4 FillRect
 0x4333d8 SetMenuItemBitmaps
 0x4333dc ModifyMenuA
 0x4333e0 GetMenuState
 0x4333e4 EnableMenuItem
 0x4333e8 CheckMenuItem
 0x4333ec GetMenuCheckMarkDimensions
 0x4333f0 ShowWindow
 0x4333f4 MoveWindow
 0x4333f8 SetWindowTextA
 0x4333fc IsDialogMessageA
 0x433400 RegisterWindowMessageA
 0x433404 WinHelpA
 0x433408 CreateWindowExA
 0x43340c GetClassLongA
 0x433410 GetClassInfoExA
 0x433414 SendDlgItemMessageA
 0x433418 IsWindow
 0x43341c SetFocus
 0x433420 IsChild
 0x433424 GetWindowTextLengthA
 0x433428 GetWindowTextA
 0x43342c GetLastActivePopup
 0x433430 SetActiveWindow
 0x433434 GetSysColorBrush
 0x433438 EndDeferWindowPos
 0x43343c GetDlgItem
 0x433440 GetTopWindow
 0x433444 DestroyWindow
 0x433448 GetMessageTime
 0x43344c GetMessagePos
 0x433450 PeekMessageA
 0x433454 MapWindowPoints
 0x433458 MessageBoxA
 0x43345c TrackPopupMenu
 0x433460 SetForegroundWindow
 0x433464 GetMenuItemID
 0x433468 AdjustWindowRectEx
 0x43346c DeferWindowPos
 0x433470 GetClassInfoA
 0x433474 RegisterClassA
 0x433478 UnregisterClassA
 0x43347c DefWindowProcA
 0x433480 GetWindowPlacement
 0x433484 CharUpperA
 0x433488 LoadIconA
 0x43348c IsIconic
 0x433490 GetSubMenu
 0x433494 AppendMenuA
 0x433498 DrawIcon
 0x43349c CopyRect
 0x4334a0 IsWindowEnabled
 0x4334a4 InflateRect
 0x4334a8 DrawFocusRect
 0x4334ac EnableWindow
 0x4334b0 SendMessageA
 0x4334b4 GetParent
 0x4334b8 GetSysColor
 0x4334bc InvalidateRect
 0x4334c0 ValidateRect
 0x4334c4 GetClientRect
 0x4334c8 GetWindowRect
 0x4334cc GetWindow
 0x4334d0 GetSystemMetrics
 0x4334d4 SetWindowPos
 0x4334d8 TrackMouseEvent
 0x4334dc UpdateWindow
 0x4334e0 IntersectRect
 0x4334e4 IsMenu
 0x4334e8 SetMenuItemInfoA
 0x4334ec SetWindowsHookExA
 0x4334f0 GetMenuItemCount
 0x4334f4 GetMenuItemRect
 0x4334f8 SystemParametersInfoA
 0x4334fc DestroyIcon
 0x433500 LoadBitmapA
 0x433504 GetClassNameA
 0x433508 GetWindowLongA
 0x43350c SetWindowContextHelpId
 0x433510 MapDialogRect
 0x433514 ShowOwnedPopups
 0x433518 CallNextHookEx
 0x43351c CallWindowProcA
 0x433520 UnhookWindowsHookEx
 0x433524 SetWindowLongA
 0x433528 IsWindowVisible
 0x43352c GetPropA
 0x433530 SetPropA
 0x433534 RemovePropA
 0x433538 GetForegroundWindow
 0x43353c GetSystemMenu
 0x433540 GetMenu
 0x433544 EqualRect
 0x433548 OffsetRect
 0x43354c PostQuitMessage
 0x433550 SetRect
 0x433554 LoadMenuA
 0x433558 BeginDeferWindowPos
 0x43355c UnpackDDElParam
 0x433560 GetKeyState
 0x433564 GetFocus
 0x433568 ReleaseDC
 0x43356c GetDC
 0x433570 GetDlgCtrlID
 0x433574 IsRectEmpty
 0x433578 PtInRect
 0x43357c DrawFrameControl
 0x433580 ClientToScreen
 0x433584 GetCapture
 0x433588 SetCapture
 0x43358c TabbedTextOutA
 0x433590 DrawTextA
 0x433594 DrawTextExA
 0x433598 GrayStringA
 0x43359c ReleaseCapture
 0x4335a0 DispatchMessageA
 0x4335a4 GetMessageA
 0x4335a8 PostMessageA
 0x4335ac ScreenToClient
 0x4335b0 GetCursorPos
 0x4335b4 DrawStateA
 0x4335b8 GetMenuItemInfoA
 0x4335bc SetRectEmpty
GDI32.dll
 0x433044 CreatePatternBrush
 0x433048 GetDeviceCaps
 0x43304c CreateRectRgnIndirect
 0x433050 ExtSelectClipRgn
 0x433054 GetMapMode
 0x433058 GetBkColor
 0x43305c GetRgnBox
 0x433060 ScaleWindowExtEx
 0x433064 SetWindowExtEx
 0x433068 ScaleViewportExtEx
 0x43306c SetViewportExtEx
 0x433070 OffsetViewportOrgEx
 0x433074 SetViewportOrgEx
 0x433078 GetWindowExtEx
 0x43307c GetViewportExtEx
 0x433080 Rectangle
 0x433084 LineTo
 0x433088 ExcludeClipRect
 0x43308c SetMapMode
 0x433090 SetBkMode
 0x433094 RestoreDC
 0x433098 SaveDC
 0x43309c CreateBitmap
 0x4330a0 SetBkColor
 0x4330a4 GetTextExtentPoint32A
 0x4330a8 GetTextMetricsA
 0x4330ac Ellipse
 0x4330b0 Escape
 0x4330b4 ExtTextOutA
 0x4330b8 TextOutA
 0x4330bc RectVisible
 0x4330c0 PtVisible
 0x4330c4 GetClipBox
 0x4330c8 SetPixel
 0x4330cc GetPixel
 0x4330d0 CreateSolidBrush
 0x4330d4 CreatePen
 0x4330d8 GetTextColor
 0x4330dc GetCurrentObject
 0x4330e0 GetObjectA
 0x4330e4 CreateFontIndirectA
 0x4330e8 DeleteObject
 0x4330ec SetTextColor
 0x4330f0 CreateCompatibleDC
 0x4330f4 CreateCompatibleBitmap
 0x4330f8 BitBlt
 0x4330fc DeleteDC
 0x433100 GetStockObject
 0x433104 SelectObject
 0x433108 MoveToEx
comdlg32.dll
 0x4335d4 GetFileTitleA
WINSPOOL.DRV
 0x4335c4 OpenPrinterA
 0x4335c8 DocumentPropertiesA
 0x4335cc ClosePrinter
ADVAPI32.dll
 0x433000 RegOpenKeyA
 0x433004 RegQueryValueExA
 0x433008 RegOpenKeyExA
 0x43300c RegDeleteKeyA
 0x433010 RegEnumKeyA
 0x433014 RegQueryValueA
 0x433018 RegCreateKeyExA
 0x43301c RegSetValueExA
 0x433020 RegCloseKey
SHELL32.dll
 0x433334 DragQueryFileA
 0x433338 DragFinish
COMCTL32.dll
 0x433028 ImageList_Draw
 0x43302c ImageList_GetIcon
 0x433030 None
 0x433034 ImageList_GetImageInfo
 0x433038 ImageList_Destroy
 0x43303c ImageList_LoadImageA
SHLWAPI.dll
 0x433340 PathFindFileNameA
 0x433344 PathStripToRootA
 0x433348 PathFindExtensionA
 0x43334c PathIsUNCA
oledlg.dll
 0x43361c None
ole32.dll
 0x4335dc StgOpenStorageOnILockBytes
 0x4335e0 CoGetClassObject
 0x4335e4 CLSIDFromString
 0x4335e8 CLSIDFromProgID
 0x4335ec StgCreateDocfileOnILockBytes
 0x4335f0 CoTaskMemFree
 0x4335f4 CreateILockBytesOnHGlobal
 0x4335f8 OleUninitialize
 0x4335fc CoFreeUnusedLibraries
 0x433600 CoRegisterMessageFilter
 0x433604 OleFlushClipboard
 0x433608 OleIsCurrentClipboard
 0x43360c CoRevokeClassObject
 0x433610 CoTaskMemAlloc
 0x433614 OleInitialize
OLEAUT32.dll
 0x433300 SysAllocStringLen
 0x433304 VariantClear
 0x433308 VariantChangeType
 0x43330c VariantInit
 0x433310 SysFreeString
 0x433314 SysStringLen
 0x433318 SysAllocStringByteLen
 0x43331c VariantCopy
 0x433320 SafeArrayDestroy
 0x433324 SystemTimeToVariantTime
 0x433328 SysAllocString
 0x43332c OleCreateFontIndirect

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure