popup

Report - file2.exe

PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.05.27 09:56 Machine s1_win7_x6402
Filename file2.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
 Behavior Score
2.6
ZERO API file : malware
VT API (file) 27 detected (AIDetect, malware1, Unsafe, Save, malicious, Kryptik, Eldorado, Attribute, HighConfidence, A + Mal, GandCrypt, Emotet, Static AI, Malicious PE, Score, kcloud, Azorult, ZexaF, IqW@amDn, BScope, CLASSIC, susgen, confidence, 100%)
md5 8e459aae5e232ee1e29e70645cd0fa83
sha256 5fd1dd59bf5bab111013850c2a213a72e70e0d8db132a8ae8cad3779b5ee7261
ssdeep 12288:NhjFvirdUAGA4pssxSd4nrEk0umulMqIEtbOF6H/d6rgCuE:rFvcfpCS+nrR0uFiytb2rgE
imphash b0ea5360984cd75edf9d1528f542b372
impfuzzy 48:9wzpGoWcUz2aJX1cdkJAA69WPEO76Eauefc9tfSXvG54+Y:qd1KpX1so68E0yuefc9tfS/G5g
  Network IP location

Signature (6cnts)

Level Description
warning File has been identified by 27 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info This executable has a PDB path

Rules (3cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x421000 GetComputerNameA
 0x421004 EnumResourceNamesW
 0x421008 SetVolumeLabelA
 0x42100c GetThreadIOPendingFlag
 0x421010 SetPriorityClass
 0x421014 WriteConsoleInputW
 0x421018 SetFilePointer
 0x42101c lstrlenA
 0x421020 GetConsoleAliasesLengthW
 0x421024 TlsGetValue
 0x421028 CommConfigDialogA
 0x42102c CallNamedPipeA
 0x421030 LoadResource
 0x421034 WritePrivateProfileSectionA
 0x421038 GlobalSize
 0x42103c SetHandleInformation
 0x421040 WaitForSingleObject
 0x421044 SignalObjectAndWait
 0x421048 SetComputerNameW
 0x42104c AddConsoleAliasW
 0x421050 SetVolumeMountPointW
 0x421054 GetProcessPriorityBoost
 0x421058 GetTickCount
 0x42105c GetPrivateProfileStringW
 0x421060 EnumTimeFormatsA
 0x421064 FindResourceExA
 0x421068 GlobalAlloc
 0x42106c GetVolumeInformationA
 0x421070 GetConsoleMode
 0x421074 TerminateThread
 0x421078 ReadConsoleInputA
 0x42107c GetPrivateProfileStructW
 0x421080 SizeofResource
 0x421084 SetVolumeMountPointA
 0x421088 DnsHostnameToComputerNameW
 0x42108c SetConsoleMode
 0x421090 SetConsoleCursorPosition
 0x421094 GetFileAttributesW
 0x421098 SetTimeZoneInformation
 0x42109c LocalReAlloc
 0x4210a0 WriteConsoleW
 0x4210a4 IsDBCSLeadByte
 0x4210a8 ReadFile
 0x4210ac CompareStringW
 0x4210b0 SetThreadPriority
 0x4210b4 DeactivateActCtx
 0x4210b8 CreateJobObjectA
 0x4210bc VerifyVersionInfoW
 0x4210c0 InterlockedExchange
 0x4210c4 GetFileSizeEx
 0x4210c8 GetStdHandle
 0x4210cc FillConsoleOutputCharacterW
 0x4210d0 FindFirstFileExA
 0x4210d4 GetLastError
 0x4210d8 SetLastError
 0x4210dc ReadConsoleOutputCharacterA
 0x4210e0 GetProcAddress
 0x4210e4 VirtualAlloc
 0x4210e8 WriteProfileSectionA
 0x4210ec SetStdHandle
 0x4210f0 SetFileApisToOEM
 0x4210f4 LoadLibraryA
 0x4210f8 OpenMutexA
 0x4210fc ProcessIdToSessionId
 0x421100 MoveFileA
 0x421104 AddAtomW
 0x421108 SetCurrentDirectoryW
 0x42110c SetFileApisToANSI
 0x421110 WriteProfileSectionW
 0x421114 GetPrivateProfileSectionNamesA
 0x421118 DebugBreakProcess
 0x42111c GetStringTypeW
 0x421120 BuildCommDCBA
 0x421124 WaitForDebugEvent
 0x421128 ScrollConsoleScreenBufferA
 0x42112c GetCurrentThreadId
 0x421130 SetProcessShutdownParameters
 0x421134 OpenSemaphoreW
 0x421138 GetVersionExA
 0x42113c LocalSize
 0x421140 FindAtomW
 0x421144 DebugBreak
 0x421148 FindActCtxSectionStringW
 0x42114c CloseHandle
 0x421150 CreateFileW
 0x421154 DeleteFileA
 0x421158 InterlockedIncrement
 0x42115c InterlockedDecrement
 0x421160 DecodePointer
 0x421164 GetModuleHandleW
 0x421168 ExitProcess
 0x42116c GetCommandLineA
 0x421170 HeapSetInformation
 0x421174 GetStartupInfoW
 0x421178 EncodePointer
 0x42117c IsProcessorFeaturePresent
 0x421180 HeapValidate
 0x421184 IsBadReadPtr
 0x421188 GetModuleFileNameW
 0x42118c WriteFile
 0x421190 GetACP
 0x421194 GetOEMCP
 0x421198 GetCPInfo
 0x42119c IsValidCodePage
 0x4211a0 TlsAlloc
 0x4211a4 TlsSetValue
 0x4211a8 TlsFree
 0x4211ac InitializeCriticalSectionAndSpinCount
 0x4211b0 DeleteCriticalSection
 0x4211b4 EnterCriticalSection
 0x4211b8 LeaveCriticalSection
 0x4211bc LoadLibraryW
 0x4211c0 TerminateProcess
 0x4211c4 GetCurrentProcess
 0x4211c8 UnhandledExceptionFilter
 0x4211cc SetUnhandledExceptionFilter
 0x4211d0 IsDebuggerPresent
 0x4211d4 QueryPerformanceCounter
 0x4211d8 GetCurrentProcessId
 0x4211dc GetSystemTimeAsFileTime
 0x4211e0 GetModuleFileNameA
 0x4211e4 FreeEnvironmentStringsW
 0x4211e8 WideCharToMultiByte
 0x4211ec GetEnvironmentStringsW
 0x4211f0 SetHandleCount
 0x4211f4 GetFileType
 0x4211f8 HeapCreate
 0x4211fc RaiseException
 0x421200 HeapAlloc
 0x421204 HeapReAlloc
 0x421208 HeapSize
 0x42120c HeapQueryInformation
 0x421210 HeapFree
 0x421214 RtlUnwind
 0x421218 LCMapStringW
 0x42121c MultiByteToWideChar
 0x421220 OutputDebugStringA
 0x421224 OutputDebugStringW
 0x421228 GetConsoleCP
 0x42122c FlushFileBuffers
USER32.dll
 0x421234 GetComboBoxInfo
 0x421238 GetMenuInfo

EAT(Export Address Table) Library

0x41fb60 _get@12

Similarity measure (PE file only) - Checking for service failure