popup

Report - redbutton.png

OS Processor Check PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.05.04 18:29 Machine s1_win7_x6401
Filename redbutton.png
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
10
 Behavior Score
4.8
ZERO API file : clean
VT API (file)
md5 13643c7875dd8e1a32b657651029e321
sha256 d957186904058d788122fcd7d061e99a541823364dd5bc389e303faf7dfd14b4
ssdeep 12288:WODzE+jyMiCwdorN0PWpgl0Bhlr4CiZlC7xOhAUNQJ:yUiDdy0OFuAuy
imphash 7ed6c4038f63ccaac5c9ff583b7cffd2
impfuzzy 192:G/4KaJHzjFvmGXUKJggUP/39RLPYASQvcRcgc7QAqP2FCbRWB:IWzZvm+CRcbQvEdniCbIB
  Network IP location

Signature (13cnts)

Level Description
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Terminates another process
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info Queries for the computername
info The executable uses a known packer

Rules (3cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://117.54.250.246/tot92/TEST22-PC_W617601.CE37DE6BBFE09D0A2B7FB41F36253385/5/kps/
whois
ID INDO Internet, PT 117.54.250.246 clean
103.54.41.193
whois
BD Md. Manzurul Haque Khan T/A THE NET HEADS 103.54.41.193 mailcious
117.54.250.246
whois
ID INDO Internet, PT 117.54.250.246 clean
117.252.68.211
whois
IN National Internet Backbone 117.252.68.211 mailcious

Suricata ids

ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x478eb4 TerminateProcess
 0x478eb8 HeapFree
 0x478ebc CreateThread
 0x478ec0 ExitThread
 0x478ec4 RaiseException
 0x478ec8 GetTimeZoneInformation
 0x478ecc GetSystemTime
 0x478ed0 GetLocalTime
 0x478ed4 HeapReAlloc
 0x478ed8 HeapSize
 0x478edc GetACP
 0x478ee0 HeapDestroy
 0x478ee4 HeapCreate
 0x478ee8 VirtualFree
 0x478eec FatalAppExitA
 0x478ef0 VirtualAlloc
 0x478ef4 IsBadWritePtr
 0x478ef8 UnhandledExceptionFilter
 0x478efc FreeEnvironmentStringsA
 0x478f00 FreeEnvironmentStringsW
 0x478f04 GetEnvironmentStrings
 0x478f08 GetEnvironmentStringsW
 0x478f0c SetHandleCount
 0x478f10 GetCommandLineA
 0x478f14 GetFileType
 0x478f18 SetUnhandledExceptionFilter
 0x478f1c LCMapStringA
 0x478f20 LCMapStringW
 0x478f24 GetStringTypeA
 0x478f28 GetStringTypeW
 0x478f2c Sleep
 0x478f30 IsBadReadPtr
 0x478f34 IsBadCodePtr
 0x478f38 IsValidLocale
 0x478f3c IsValidCodePage
 0x478f40 GetLocaleInfoA
 0x478f44 EnumSystemLocalesA
 0x478f48 GetUserDefaultLCID
 0x478f4c GetVersionExA
 0x478f50 SetConsoleCtrlHandler
 0x478f54 SetStdHandle
 0x478f58 CompareStringA
 0x478f5c CompareStringW
 0x478f60 SetEnvironmentVariableA
 0x478f64 GetLocaleInfoW
 0x478f68 GetStartupInfoA
 0x478f6c HeapAlloc
 0x478f70 RtlUnwind
 0x478f74 GetProfileStringA
 0x478f78 SetFileAttributesA
 0x478f7c SetFileTime
 0x478f80 SystemTimeToFileTime
 0x478f84 LocalFileTimeToFileTime
 0x478f88 GetFileTime
 0x478f8c GetFileSize
 0x478f90 GetFileAttributesA
 0x478f94 GetTickCount
 0x478f98 GetShortPathNameA
 0x478f9c GetStringTypeExA
 0x478fa0 GetFullPathNameA
 0x478fa4 GetVolumeInformationA
 0x478fa8 FindFirstFileA
 0x478fac FindClose
 0x478fb0 DeleteFileA
 0x478fb4 MoveFileA
 0x478fb8 SetEndOfFile
 0x478fbc UnlockFile
 0x478fc0 LockFile
 0x478fc4 FlushFileBuffers
 0x478fc8 SetFilePointer
 0x478fcc WriteFile
 0x478fd0 ReadFile
 0x478fd4 CreateFileA
 0x478fd8 GetCurrentProcess
 0x478fdc DuplicateHandle
 0x478fe0 SetErrorMode
 0x478fe4 CopyFileA
 0x478fe8 GlobalSize
 0x478fec GetOEMCP
 0x478ff0 GetCPInfo
 0x478ff4 GetThreadLocale
 0x478ff8 SizeofResource
 0x478ffc GetProcessVersion
 0x479000 GetCurrentDirectoryA
 0x479004 WritePrivateProfileStringA
 0x479008 GetPrivateProfileStringA
 0x47900c GetPrivateProfileIntA
 0x479010 GlobalFlags
 0x479014 TlsGetValue
 0x479018 LocalReAlloc
 0x47901c TlsSetValue
 0x479020 EnterCriticalSection
 0x479024 GlobalReAlloc
 0x479028 LeaveCriticalSection
 0x47902c TlsFree
 0x479030 GlobalHandle
 0x479034 DeleteCriticalSection
 0x479038 TlsAlloc
 0x47903c InitializeCriticalSection
 0x479040 LocalAlloc
 0x479044 FileTimeToLocalFileTime
 0x479048 FileTimeToSystemTime
 0x47904c lstrlenW
 0x479050 GetLastError
 0x479054 lstrcpynA
 0x479058 MulDiv
 0x47905c SetLastError
 0x479060 FormatMessageA
 0x479064 LocalFree
 0x479068 WideCharToMultiByte
 0x47906c InterlockedIncrement
 0x479070 InterlockedDecrement
 0x479074 LoadLibraryA
 0x479078 FreeLibrary
 0x47907c lstrcatA
 0x479080 GlobalGetAtomNameA
 0x479084 GlobalAddAtomA
 0x479088 GlobalFindAtomA
 0x47908c lstrcpyA
 0x479090 GlobalUnlock
 0x479094 GlobalFree
 0x479098 LockResource
 0x47909c FindResourceA
 0x4790a0 LoadResource
 0x4790a4 CreateEventA
 0x4790a8 SuspendThread
 0x4790ac SetThreadPriority
 0x4790b0 ResumeThread
 0x4790b4 SetEvent
 0x4790b8 WaitForSingleObject
 0x4790bc CloseHandle
 0x4790c0 GetModuleFileNameA
 0x4790c4 GlobalLock
 0x4790c8 GlobalAlloc
 0x4790cc GlobalDeleteAtom
 0x4790d0 lstrcmpA
 0x4790d4 lstrcmpiA
 0x4790d8 GetCurrentThread
 0x4790dc GetCurrentThreadId
 0x4790e0 GetVersion
 0x4790e4 ExitProcess
 0x4790e8 GetModuleHandleA
 0x4790ec GetProcAddress
 0x4790f0 lstrlenA
 0x4790f4 GetStdHandle
 0x4790f8 MultiByteToWideChar
USER32.dll
 0x4792e8 InsertMenuA
 0x4792ec DeleteMenu
 0x4792f0 GetMenuStringA
 0x4792f4 GetSysColorBrush
 0x4792f8 GetDialogBaseUnits
 0x4792fc CharNextA
 0x479300 CopyAcceleratorTableA
 0x479304 SetRect
 0x479308 GetNextDlgGroupItem
 0x47930c MessageBeep
 0x479310 RemoveMenu
 0x479314 wvsprintfA
 0x479318 SetRectEmpty
 0x47931c LoadAcceleratorsA
 0x479320 TranslateAcceleratorA
 0x479324 SetMenu
 0x479328 ReuseDDElParam
 0x47932c UnpackDDElParam
 0x479330 BringWindowToTop
 0x479334 CharUpperA
 0x479338 RegisterClipboardFormatA
 0x47933c PostThreadMessageA
 0x479340 DestroyIcon
 0x479344 GetScrollRange
 0x479348 SetScrollRange
 0x47934c GetScrollPos
 0x479350 SetScrollPos
 0x479354 GetTopWindow
 0x479358 IsChild
 0x47935c GetCapture
 0x479360 WinHelpA
 0x479364 wsprintfA
 0x479368 GetClassInfoA
 0x47936c RegisterClassA
 0x479370 GetMenu
 0x479374 GetMenuItemCount
 0x479378 SetWindowPlacement
 0x47937c GetWindowTextLengthA
 0x479380 GetWindowTextA
 0x479384 GetDlgCtrlID
 0x479388 DefWindowProcA
 0x47938c CreateWindowExA
 0x479390 GetClassLongA
 0x479394 SetPropA
 0x479398 UnhookWindowsHookEx
 0x47939c GetPropA
 0x4793a0 CallWindowProcA
 0x4793a4 RemovePropA
 0x4793a8 GetMessageTime
 0x4793ac GetMessagePos
 0x4793b0 SetWindowLongA
 0x4793b4 RegisterWindowMessageA
 0x4793b8 OffsetRect
 0x4793bc IntersectRect
 0x4793c0 SystemParametersInfoA
 0x4793c4 GetWindowPlacement
 0x4793c8 GetWindowRect
 0x4793cc MapDialogRect
 0x4793d0 SetWindowPos
 0x4793d4 GetWindow
 0x4793d8 SetWindowContextHelpId
 0x4793dc GetClassNameA
 0x4793e0 SetActiveWindow
 0x4793e4 CreateDialogIndirectParamA
 0x4793e8 TabbedTextOutA
 0x4793ec GetDlgItem
 0x4793f0 GetMenuCheckMarkDimensions
 0x4793f4 LoadBitmapA
 0x4793f8 GetMenuState
 0x4793fc ModifyMenuA
 0x479400 SetMenuItemBitmaps
 0x479404 CheckMenuItem
 0x479408 EnableMenuItem
 0x47940c GetFocus
 0x479410 GetNextDlgTabItem
 0x479414 GetMessageA
 0x479418 TranslateMessage
 0x47941c DispatchMessageA
 0x479420 GetActiveWindow
 0x479424 CallNextHookEx
 0x479428 GrayStringA
 0x47942c PeekMessageA
 0x479430 SetWindowsHookExA
 0x479434 GetParent
 0x479438 GetLastActivePopup
 0x47943c IsWindowEnabled
 0x479440 GetWindowLongA
 0x479444 MessageBoxA
 0x479448 SetCursor
 0x47944c ShowOwnedPopups
 0x479450 PostQuitMessage
 0x479454 GetCursorPos
 0x479458 TrackPopupMenu
 0x47945c PostMessageA
 0x479460 GetMenuItemID
 0x479464 LoadMenuA
 0x479468 GetSubMenu
 0x47946c SetMenuDefaultItem
 0x479470 KillTimer
 0x479474 EnableWindow
 0x479478 IsWindowVisible
 0x47947c InvalidateRect
 0x479480 SetForegroundWindow
 0x479484 SetFocus
 0x479488 LoadIconA
 0x47948c SetTimer
 0x479490 SendMessageA
 0x479494 UnregisterClassA
 0x479498 HideCaret
 0x47949c ShowCaret
 0x4794a0 ExcludeUpdateRgn
 0x4794a4 DrawFocusRect
 0x4794a8 GetForegroundWindow
 0x4794ac IsWindow
 0x4794b0 AttachThreadInput
 0x4794b4 GetWindowThreadProcessId
 0x4794b8 PtInRect
 0x4794bc VkKeyScanA
 0x4794c0 GetKeyState
 0x4794c4 keybd_event
 0x4794c8 IsIconic
 0x4794cc GetSystemMetrics
 0x4794d0 DrawIcon
 0x4794d4 InflateRect
 0x4794d8 GetSysColor
 0x4794dc WindowFromPoint
 0x4794e0 GetDesktopWindow
 0x4794e4 WaitMessage
 0x4794e8 ReleaseCapture
 0x4794ec SetCapture
 0x4794f0 EndDialog
 0x4794f4 LoadCursorA
 0x4794f8 GetClientRect
 0x4794fc GetSystemMenu
 0x479500 DefDlgProcA
 0x479504 IsWindowUnicode
 0x479508 AppendMenuA
 0x47950c EndPaint
 0x479510 BeginPaint
 0x479514 GetWindowDC
 0x479518 ReleaseDC
 0x47951c GetDC
 0x479520 ClientToScreen
 0x479524 DestroyMenu
 0x479528 LoadStringA
 0x47952c OemToCharA
 0x479530 CharToOemA
 0x479534 ShowWindow
 0x479538 MoveWindow
 0x47953c SetWindowTextA
 0x479540 IsDialogMessageA
 0x479544 ScrollWindowEx
 0x479548 IsDlgButtonChecked
 0x47954c SetDlgItemTextA
 0x479550 SetDlgItemInt
 0x479554 GetDlgItemTextA
 0x479558 GetDlgItemInt
 0x47955c CheckRadioButton
 0x479560 CheckDlgButton
 0x479564 UpdateWindow
 0x479568 SendDlgItemMessageA
 0x47956c MapWindowPoints
 0x479570 ShowScrollBar
 0x479574 ScreenToClient
 0x479578 EqualRect
 0x47957c DeferWindowPos
 0x479580 BeginDeferWindowPos
 0x479584 CopyRect
 0x479588 EndDeferWindowPos
 0x47958c ValidateRect
 0x479590 DrawTextA
 0x479594 ScrollWindow
 0x479598 GetScrollInfo
 0x47959c DestroyWindow
 0x4795a0 SetScrollInfo
 0x4795a4 AdjustWindowRectEx
GDI32.dll
 0x478cf8 SetBkMode
 0x478cfc SetPolyFillMode
 0x478d00 SetROP2
 0x478d04 SetStretchBltMode
 0x478d08 SetMapMode
 0x478d0c SetViewportOrgEx
 0x478d10 OffsetViewportOrgEx
 0x478d14 SetViewportExtEx
 0x478d18 ScaleViewportExtEx
 0x478d1c SetWindowOrgEx
 0x478d20 OffsetWindowOrgEx
 0x478d24 SetWindowExtEx
 0x478d28 ScaleWindowExtEx
 0x478d2c SelectClipRgn
 0x478d30 ExcludeClipRect
 0x478d34 IntersectClipRect
 0x478d38 OffsetClipRgn
 0x478d3c MoveToEx
 0x478d40 LineTo
 0x478d44 SetTextAlign
 0x478d48 SetTextJustification
 0x478d4c SetTextCharacterExtra
 0x478d50 SetMapperFlags
 0x478d54 GetCurrentPositionEx
 0x478d58 ArcTo
 0x478d5c SetArcDirection
 0x478d60 PolyDraw
 0x478d64 PolylineTo
 0x478d68 SetColorAdjustment
 0x478d6c PolyBezierTo
 0x478d70 DeleteObject
 0x478d74 GetClipRgn
 0x478d78 SelectPalette
 0x478d7c SelectClipPath
 0x478d80 ExtSelectClipRgn
 0x478d84 PlayMetaFileRecord
 0x478d88 GetObjectType
 0x478d8c EnumMetaFile
 0x478d90 PlayMetaFile
 0x478d94 GetDeviceCaps
 0x478d98 GetViewportExtEx
 0x478d9c GetWindowExtEx
 0x478da0 CreatePen
 0x478da4 ExtCreatePen
 0x478da8 CreateSolidBrush
 0x478dac CreateHatchBrush
 0x478db0 CreatePatternBrush
 0x478db4 CreateDIBPatternBrushPt
 0x478db8 PtVisible
 0x478dbc RectVisible
 0x478dc0 TextOutA
 0x478dc4 ExtTextOutA
 0x478dc8 Escape
 0x478dcc GetMapMode
 0x478dd0 PatBlt
 0x478dd4 SetRectRgn
 0x478dd8 CombineRgn
 0x478ddc CreateFontIndirectA
 0x478de0 DPtoLP
 0x478de4 GetTextMetricsA
 0x478de8 GetTextColor
 0x478dec GetBkColor
 0x478df0 LPtoDP
 0x478df4 CopyMetaFileA
 0x478df8 CreateDCA
 0x478dfc RestoreDC
 0x478e00 SaveDC
 0x478e04 StartDocA
 0x478e08 DeleteDC
 0x478e0c GetObjectA
 0x478e10 SetBkColor
 0x478e14 SetTextColor
 0x478e18 GetClipBox
 0x478e1c GetDCOrgEx
 0x478e20 CreateBitmap
 0x478e24 CreateRectRgnIndirect
 0x478e28 GetStockObject
 0x478e2c SelectObject
 0x478e30 CreateRectRgn
 0x478e34 CreateDIBitmap
 0x478e38 GetTextExtentPointA
 0x478e3c BitBlt
 0x478e40 CreateCompatibleDC
 0x478e44 GetTextExtentPoint32A
comdlg32.dll
 0x479698 GetSaveFileNameA
 0x47969c GetFileTitleA
 0x4796a0 GetOpenFileNameA
WINSPOOL.DRV
 0x479660 ClosePrinter
 0x479664 DocumentPropertiesA
 0x479668 OpenPrinterA
ADVAPI32.dll
 0x478c64 RegDeleteKeyA
 0x478c68 RegCreateKeyA
 0x478c6c RegEnumKeyA
 0x478c70 RegQueryValueA
 0x478c74 RegOpenKeyA
 0x478c78 RegSetValueA
 0x478c7c RegCloseKey
 0x478c80 RegDeleteValueA
 0x478c84 RegSetValueExA
 0x478c88 RegQueryValueExA
 0x478c8c RegOpenKeyExA
 0x478c90 RegCreateKeyExA
SHELL32.dll
 0x4792a0 SHGetFileInfoA
 0x4792a4 DragQueryFileA
 0x4792a8 DragFinish
 0x4792ac DragAcceptFiles
 0x4792b0 Shell_NotifyIconA
 0x4792b4 ExtractIconA
COMCTL32.dll
 0x478cc8 None
oledlg.dll
 0x479794 None
ole32.dll
 0x4796d0 OleUninitialize
 0x4796d4 OleInitialize
 0x4796d8 CoDisconnectObject
 0x4796dc OleRun
 0x4796e0 ReleaseStgMedium
 0x4796e4 CoTreatAsClass
 0x4796e8 StringFromCLSID
 0x4796ec ReadClassStg
 0x4796f0 ReadFmtUserTypeStg
 0x4796f4 OleRegGetUserType
 0x4796f8 WriteClassStg
 0x4796fc CoFreeUnusedLibraries
 0x479700 SetConvertStg
 0x479704 CreateBindCtx
 0x479708 OleDuplicateData
 0x47970c CoTaskMemAlloc
 0x479710 CoTaskMemFree
 0x479714 CreateILockBytesOnHGlobal
 0x479718 StgCreateDocfileOnILockBytes
 0x47971c StgOpenStorageOnILockBytes
 0x479720 CoGetClassObject
 0x479724 CoCreateInstance
 0x479728 CLSIDFromString
 0x47972c CLSIDFromProgID
 0x479730 CoRegisterMessageFilter
 0x479734 CoRegisterClassObject
 0x479738 CoRevokeClassObject
 0x47973c OleSetClipboard
 0x479740 OleFlushClipboard
 0x479744 OleIsCurrentClipboard
 0x479748 CreateStreamOnHGlobal
 0x47974c WriteFmtUserTypeStg
OLEPRO32.DLL
 0x479270 None
OLEAUT32.dll
 0x47919c SafeArrayAccessData
 0x4791a0 SysFreeString
 0x4791a4 SysAllocStringLen
 0x4791a8 SafeArrayGetUBound
 0x4791ac SafeArrayGetLBound
 0x4791b0 SafeArrayGetElemsize
 0x4791b4 SafeArrayGetDim
 0x4791b8 SafeArrayCreate
 0x4791bc VariantClear
 0x4791c0 SafeArrayRedim
 0x4791c4 VariantCopy
 0x4791c8 SysAllocString
 0x4791cc SysAllocStringByteLen
 0x4791d0 VariantChangeType
 0x4791d4 SysStringByteLen
 0x4791d8 VarCyFromStr
 0x4791dc VarBstrFromCy
 0x4791e0 VarDateFromStr
 0x4791e4 VarBstrFromDate
 0x4791e8 SafeArrayCopy
 0x4791ec SafeArrayAllocData
 0x4791f0 SafeArrayAllocDescriptor
 0x4791f4 SafeArrayGetElement
 0x4791f8 SafeArrayPtrOfIndex
 0x4791fc SafeArrayPutElement
 0x479200 SafeArrayLock
 0x479204 SafeArrayUnlock
 0x479208 SafeArrayDestroy
 0x47920c SafeArrayDestroyData
 0x479210 SafeArrayDestroyDescriptor
 0x479214 VariantTimeToSystemTime
 0x479218 SysReAllocStringLen
 0x47921c SysStringLen
 0x479220 LoadTypeLib
 0x479224 SafeArrayUnaccessData

EAT(Export Address Table) Library

0x401221 wrgeegthxdtykyuthb

Similarity measure (PE file only) - Checking for service failure