Report - Questions about the study of freedoms 78639846 docx.exe

PE File OS Processor Check PE32
ScreenShot
Created 2021.06.01 17:17 Machine s1_win7_x6402
Filename Questions about the study of freedoms 78639846 docx.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
3.8
ZERO API file : clean
VT API (file) 51 detected (malicious, high confidence, GenericKD, Bobik, Artemis, Delf, Save, confidence, 100%, ATRAPS, SIVT, Attribute, HighConfidence, impnnt, Molerats, CLOUD, Malware@#1h51v5zzgg9th, Siggen12, MOLERAT, susgen, ai score=99, kcloud, Ymacco, TScope, Unsafe, L7ls1PE, Score, PossibleThreat, GdSda)
md5 7833c0f413c1611f7281ac303bcef4b3
sha256 c9d7b5d06cd8ab1a01bf0c5bf41ef2a388e41b4c66b1728494f86ed255a95d48
ssdeep 49152:docG/eg7QUUZ13DhuSRprDK9bLRaHZJrVwHqQnGUWvv7rJwSI2MDc/Eb1HxTPt9I:doJegw1LELc5JV+bnQnwD70
imphash f173a5bbd9e9b54b79290922234532df
impfuzzy 192:rOjE9FTMncdqRUurdVYTexCWTOwI7uvQdOHuPyEO:rOjEvOcE3PTOGvQdOoO
  Network IP location

Signature (9cnts)

Level Description
danger File has been identified by 51 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates (office) documents on the filesystem
notice Creates hidden or system file
info Collects information to fingerprint the system (MachineGuid
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (3cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x625874 GetACP
 0x625878 LocalFree
 0x62587c CloseHandle
 0x625880 SizeofResource
 0x625884 GetCurrentProcessId
 0x625888 VirtualProtect
 0x62588c QueryPerformanceFrequency
 0x625890 IsDebuggerPresent
 0x625894 VirtualFree
 0x625898 GetFullPathNameW
 0x62589c ExitProcess
 0x6258a0 HeapAlloc
 0x6258a4 GetCPInfoExW
 0x6258a8 RtlUnwind
 0x6258ac GetCPInfo
 0x6258b0 EnumSystemLocalesW
 0x6258b4 GetStdHandle
 0x6258b8 GetModuleHandleW
 0x6258bc FreeLibrary
 0x6258c0 TryEnterCriticalSection
 0x6258c4 HeapDestroy
 0x6258c8 ReadFile
 0x6258cc GetLastError
 0x6258d0 GetModuleFileNameW
 0x6258d4 SetLastError
 0x6258d8 GlobalAlloc
 0x6258dc GlobalUnlock
 0x6258e0 FindResourceW
 0x6258e4 CreateThread
 0x6258e8 CompareStringW
 0x6258ec LoadLibraryA
 0x6258f0 ResetEvent
 0x6258f4 MulDiv
 0x6258f8 FreeResource
 0x6258fc GetVersion
 0x625900 RaiseException
 0x625904 GlobalAddAtomW
 0x625908 FormatMessageW
 0x62590c SwitchToThread
 0x625910 GetExitCodeThread
 0x625914 GetCurrentThread
 0x625918 LoadLibraryExW
 0x62591c LockResource
 0x625920 GetCurrentThreadId
 0x625924 UnhandledExceptionFilter
 0x625928 VirtualQuery
 0x62592c GlobalFindAtomW
 0x625930 VirtualQueryEx
 0x625934 GlobalFree
 0x625938 Sleep
 0x62593c EnterCriticalSection
 0x625940 SetFilePointer
 0x625944 LoadResource
 0x625948 SuspendThread
 0x62594c GetTickCount
 0x625950 GetStartupInfoW
 0x625954 GlobalDeleteAtom
 0x625958 GetFileAttributesW
 0x62595c InitializeCriticalSection
 0x625960 GetThreadPriority
 0x625964 SetThreadPriority
 0x625968 GlobalLock
 0x62596c GetCurrentProcess
 0x625970 VirtualAlloc
 0x625974 GetSystemInfo
 0x625978 GetCommandLineW
 0x62597c LeaveCriticalSection
 0x625980 GetProcAddress
 0x625984 ResumeThread
 0x625988 GetVersionExW
 0x62598c VerifyVersionInfoW
 0x625990 HeapCreate
 0x625994 VerSetConditionMask
 0x625998 GetDiskFreeSpaceW
 0x62599c FindFirstFileW
 0x6259a0 GetUserDefaultUILanguage
 0x6259a4 lstrlenW
 0x6259a8 QueryPerformanceCounter
 0x6259ac SetEndOfFile
 0x6259b0 HeapFree
 0x6259b4 WideCharToMultiByte
 0x6259b8 FindClose
 0x6259bc MultiByteToWideChar
 0x6259c0 LoadLibraryW
 0x6259c4 SetEvent
 0x6259c8 CreateFileW
 0x6259cc GetLocaleInfoW
 0x6259d0 EnumResourceNamesW
 0x6259d4 GetLocalTime
 0x6259d8 GetEnvironmentVariableW
 0x6259dc WaitForSingleObject
 0x6259e0 WriteFile
 0x6259e4 ExitThread
 0x6259e8 DeleteCriticalSection
 0x6259ec TlsGetValue
 0x6259f0 GetDateFormatW
 0x6259f4 SetErrorMode
 0x6259f8 IsValidLocale
 0x6259fc TlsSetValue
 0x625a00 GetSystemDefaultUILanguage
 0x625a04 EnumCalendarInfoW
 0x625a08 LocalAlloc
 0x625a0c CreateEventW
 0x625a10 WaitForMultipleObjectsEx
 0x625a14 SetThreadLocale
 0x625a18 GetThreadLocale
winspool.drv
 0x625a20 DocumentPropertiesW
 0x625a24 ClosePrinter
 0x625a28 OpenPrinterW
 0x625a2c GetDefaultPrinterW
 0x625a30 EnumPrintersW
comctl32.dll
 0x625a38 ImageList_GetImageInfo
 0x625a3c FlatSB_SetScrollInfo
 0x625a40 ImageList_DragMove
 0x625a44 ImageList_Destroy
 0x625a48 _TrackMouseEvent
 0x625a4c ImageList_DragShowNolock
 0x625a50 ImageList_Add
 0x625a54 FlatSB_SetScrollProp
 0x625a58 ImageList_GetDragImage
 0x625a5c ImageList_Create
 0x625a60 ImageList_EndDrag
 0x625a64 ImageList_DrawEx
 0x625a68 ImageList_SetImageCount
 0x625a6c FlatSB_GetScrollPos
 0x625a70 FlatSB_SetScrollPos
 0x625a74 InitializeFlatSB
 0x625a78 ImageList_Copy
 0x625a7c FlatSB_GetScrollInfo
 0x625a80 ImageList_Write
 0x625a84 ImageList_SetBkColor
 0x625a88 ImageList_GetBkColor
 0x625a8c ImageList_BeginDrag
 0x625a90 ImageList_GetIcon
 0x625a94 ImageList_Replace
 0x625a98 ImageList_GetImageCount
 0x625a9c ImageList_DragEnter
 0x625aa0 ImageList_GetIconSize
 0x625aa4 ImageList_SetIconSize
 0x625aa8 ImageList_Read
 0x625aac ImageList_DragLeave
 0x625ab0 ImageList_LoadImageW
 0x625ab4 ImageList_Draw
 0x625ab8 ImageList_Remove
 0x625abc ImageList_ReplaceIcon
 0x625ac0 ImageList_SetOverlayImage
shell32.dll
 0x625ac8 Shell_NotifyIconW
 0x625acc ShellExecuteW
ole32.dll
 0x625ad4 IsEqualGUID
 0x625ad8 OleInitialize
 0x625adc OleUninitialize
 0x625ae0 CoInitialize
 0x625ae4 CoCreateInstance
 0x625ae8 CoUninitialize
 0x625aec CoTaskMemFree
 0x625af0 CoTaskMemAlloc
version.dll
 0x625af8 GetFileVersionInfoSizeW
 0x625afc VerQueryValueW
 0x625b00 GetFileVersionInfoW
user32.dll
 0x625b08 CopyImage
 0x625b0c CreateWindowExW
 0x625b10 GetMenuItemInfoW
 0x625b14 SetMenuItemInfoW
 0x625b18 DefFrameProcW
 0x625b1c GetDCEx
 0x625b20 PeekMessageW
 0x625b24 MonitorFromWindow
 0x625b28 GetDlgCtrlID
 0x625b2c SetTimer
 0x625b30 WindowFromPoint
 0x625b34 BeginPaint
 0x625b38 RegisterClipboardFormatW
 0x625b3c FrameRect
 0x625b40 MapVirtualKeyW
 0x625b44 IsWindowUnicode
 0x625b48 RegisterWindowMessageW
 0x625b4c FillRect
 0x625b50 GetMenuStringW
 0x625b54 DispatchMessageW
 0x625b58 CreateAcceleratorTableW
 0x625b5c SendMessageA
 0x625b60 DefMDIChildProcW
 0x625b64 EnumWindows
 0x625b68 GetClassInfoW
 0x625b6c ShowOwnedPopups
 0x625b70 GetSystemMenu
 0x625b74 GetScrollRange
 0x625b78 SetScrollPos
 0x625b7c GetScrollPos
 0x625b80 GetActiveWindow
 0x625b84 SetActiveWindow
 0x625b88 DrawEdge
 0x625b8c GetKeyboardLayoutList
 0x625b90 LoadBitmapW
 0x625b94 DrawFocusRect
 0x625b98 EnumChildWindows
 0x625b9c ReleaseCapture
 0x625ba0 UnhookWindowsHookEx
 0x625ba4 LoadCursorW
 0x625ba8 GetCapture
 0x625bac SetCapture
 0x625bb0 CreatePopupMenu
 0x625bb4 ScrollWindow
 0x625bb8 ShowCaret
 0x625bbc GetMenuItemID
 0x625bc0 GetLastActivePopup
 0x625bc4 CharLowerBuffW
 0x625bc8 GetSystemMetrics
 0x625bcc SetWindowLongW
 0x625bd0 PostMessageW
 0x625bd4 DrawMenuBar
 0x625bd8 SetParent
 0x625bdc IsZoomed
 0x625be0 CharUpperBuffW
 0x625be4 GetClientRect
 0x625be8 IsChild
 0x625bec ClientToScreen
 0x625bf0 GetClipboardData
 0x625bf4 SetClipboardData
 0x625bf8 SetWindowPlacement
 0x625bfc IsIconic
 0x625c00 CallNextHookEx
 0x625c04 GetMonitorInfoW
 0x625c08 ShowWindow
 0x625c0c CheckMenuItem
 0x625c10 CharUpperW
 0x625c14 DefWindowProcW
 0x625c18 GetForegroundWindow
 0x625c1c SetForegroundWindow
 0x625c20 GetWindowTextW
 0x625c24 EnableWindow
 0x625c28 DestroyWindow
 0x625c2c IsDialogMessageW
 0x625c30 EndMenu
 0x625c34 RegisterClassW
 0x625c38 CharNextW
 0x625c3c GetWindowThreadProcessId
 0x625c40 RedrawWindow
 0x625c44 GetDC
 0x625c48 GetFocus
 0x625c4c SetFocus
 0x625c50 EndPaint
 0x625c54 ReleaseDC
 0x625c58 MsgWaitForMultipleObjectsEx
 0x625c5c LoadKeyboardLayoutW
 0x625c60 GetClassLongW
 0x625c64 ActivateKeyboardLayout
 0x625c68 GetParent
 0x625c6c DrawTextW
 0x625c70 SetScrollRange
 0x625c74 MonitorFromRect
 0x625c78 InsertMenuItemW
 0x625c7c PeekMessageA
 0x625c80 GetPropW
 0x625c84 SetClassLongW
 0x625c88 MessageBoxW
 0x625c8c MessageBeep
 0x625c90 SetPropW
 0x625c94 RemovePropW
 0x625c98 UpdateWindow
 0x625c9c GetSubMenu
 0x625ca0 MsgWaitForMultipleObjects
 0x625ca4 DestroyMenu
 0x625ca8 DestroyIcon
 0x625cac SetWindowsHookExW
 0x625cb0 EmptyClipboard
 0x625cb4 IsWindowVisible
 0x625cb8 DispatchMessageA
 0x625cbc UnregisterClassW
 0x625cc0 GetTopWindow
 0x625cc4 SendMessageW
 0x625cc8 AdjustWindowRectEx
 0x625ccc DrawIcon
 0x625cd0 IsWindow
 0x625cd4 EnumThreadWindows
 0x625cd8 InvalidateRect
 0x625cdc GetKeyboardState
 0x625ce0 DrawFrameControl
 0x625ce4 ScreenToClient
 0x625ce8 SetCursor
 0x625cec CreateIcon
 0x625cf0 CreateMenu
 0x625cf4 LoadStringW
 0x625cf8 CharLowerW
 0x625cfc SetWindowRgn
 0x625d00 SetWindowPos
 0x625d04 GetMenuItemCount
 0x625d08 RemoveMenu
 0x625d0c GetSysColorBrush
 0x625d10 GetKeyboardLayoutNameW
 0x625d14 GetWindowDC
 0x625d18 TranslateMessage
 0x625d1c OpenClipboard
 0x625d20 DrawTextExW
 0x625d24 MapWindowPoints
 0x625d28 EnumDisplayMonitors
 0x625d2c CallWindowProcW
 0x625d30 CloseClipboard
 0x625d34 DestroyCursor
 0x625d38 GetScrollInfo
 0x625d3c SetWindowTextW
 0x625d40 GetMessageExtraInfo
 0x625d44 EnableScrollBar
 0x625d48 GetSysColor
 0x625d4c TrackPopupMenu
 0x625d50 CopyIcon
 0x625d54 DrawIconEx
 0x625d58 PostQuitMessage
 0x625d5c GetClassNameW
 0x625d60 ShowScrollBar
 0x625d64 EnableMenuItem
 0x625d68 GetIconInfo
 0x625d6c GetMessagePos
 0x625d70 SetScrollInfo
 0x625d74 GetKeyNameTextW
 0x625d78 GetDesktopWindow
 0x625d7c GetCursorPos
 0x625d80 SetCursorPos
 0x625d84 HideCaret
 0x625d88 GetMenu
 0x625d8c GetMenuState
 0x625d90 SetMenu
 0x625d94 SetRect
 0x625d98 GetKeyState
 0x625d9c FindWindowExW
 0x625da0 MonitorFromPoint
 0x625da4 SystemParametersInfoW
 0x625da8 LoadIconW
 0x625dac GetCursor
 0x625db0 GetWindow
 0x625db4 GetWindowLongW
 0x625db8 GetWindowRect
 0x625dbc InsertMenuW
 0x625dc0 KillTimer
 0x625dc4 WaitMessage
 0x625dc8 IsWindowEnabled
 0x625dcc IsDialogMessageA
 0x625dd0 TranslateMDISysAccel
 0x625dd4 GetWindowPlacement
 0x625dd8 CreateIconIndirect
 0x625ddc FindWindowW
 0x625de0 DeleteMenu
 0x625de4 GetKeyboardLayout
oleaut32.dll
 0x625dec SysFreeString
 0x625df0 VariantClear
 0x625df4 VariantInit
 0x625df8 GetErrorInfo
 0x625dfc SysReAllocStringLen
 0x625e00 SafeArrayCreate
 0x625e04 SysAllocStringLen
 0x625e08 SafeArrayPtrOfIndex
 0x625e0c SafeArrayGetUBound
 0x625e10 SafeArrayGetLBound
 0x625e14 VariantCopy
 0x625e18 VariantChangeType
netapi32.dll
 0x625e20 NetWkstaGetInfo
 0x625e24 NetApiBufferFree
advapi32.dll
 0x625e2c RegSetValueExW
 0x625e30 RegConnectRegistryW
 0x625e34 RegEnumKeyExW
 0x625e38 RegLoadKeyW
 0x625e3c RegDeleteKeyW
 0x625e40 RegOpenKeyExW
 0x625e44 RegQueryInfoKeyW
 0x625e48 RegUnLoadKeyW
 0x625e4c RegSaveKeyW
 0x625e50 RegDeleteValueW
 0x625e54 RegReplaceKeyW
 0x625e58 RegFlushKey
 0x625e5c RegQueryValueExW
 0x625e60 RegEnumValueW
 0x625e64 RegCloseKey
 0x625e68 RegCreateKeyExW
 0x625e6c RegRestoreKeyW
gdi32.dll
 0x625e74 Pie
 0x625e78 SetBkMode
 0x625e7c CreateCompatibleBitmap
 0x625e80 GetEnhMetaFileHeader
 0x625e84 RectVisible
 0x625e88 AngleArc
 0x625e8c SetAbortProc
 0x625e90 SetTextColor
 0x625e94 StretchBlt
 0x625e98 RoundRect
 0x625e9c RestoreDC
 0x625ea0 SetRectRgn
 0x625ea4 GetTextMetricsW
 0x625ea8 GetWindowOrgEx
 0x625eac CreatePalette
 0x625eb0 PolyBezierTo
 0x625eb4 CreateICW
 0x625eb8 CreateDCW
 0x625ebc GetStockObject
 0x625ec0 CreateSolidBrush
 0x625ec4 Polygon
 0x625ec8 MoveToEx
 0x625ecc PlayEnhMetaFile
 0x625ed0 Ellipse
 0x625ed4 StartPage
 0x625ed8 GetBitmapBits
 0x625edc StartDocW
 0x625ee0 GetSystemPaletteEntries
 0x625ee4 GetEnhMetaFileBits
 0x625ee8 AbortDoc
 0x625eec GetEnhMetaFilePaletteEntries
 0x625ef0 CreatePenIndirect
 0x625ef4 CreateFontIndirectW
 0x625ef8 PolyBezier
 0x625efc EndDoc
 0x625f00 GetObjectW
 0x625f04 GetWinMetaFileBits
 0x625f08 SetROP2
 0x625f0c GetEnhMetaFileDescriptionW
 0x625f10 ArcTo
 0x625f14 Arc
 0x625f18 SelectPalette
 0x625f1c ExcludeClipRect
 0x625f20 MaskBlt
 0x625f24 SetWindowOrgEx
 0x625f28 EndPage
 0x625f2c DeleteEnhMetaFile
 0x625f30 Chord
 0x625f34 SetDIBits
 0x625f38 SetViewportOrgEx
 0x625f3c CreateRectRgn
 0x625f40 RealizePalette
 0x625f44 SetDIBColorTable
 0x625f48 GetDIBColorTable
 0x625f4c CreateBrushIndirect
 0x625f50 PatBlt
 0x625f54 SetEnhMetaFileBits
 0x625f58 Rectangle
 0x625f5c SaveDC
 0x625f60 DeleteDC
 0x625f64 FrameRgn
 0x625f68 BitBlt
 0x625f6c GetDeviceCaps
 0x625f70 GetTextExtentPoint32W
 0x625f74 GetClipBox
 0x625f78 IntersectClipRect
 0x625f7c Polyline
 0x625f80 CreateBitmap
 0x625f84 SetWinMetaFileBits
 0x625f88 GetStretchBltMode
 0x625f8c CreateDIBitmap
 0x625f90 SetStretchBltMode
 0x625f94 GetDIBits
 0x625f98 CreateDIBSection
 0x625f9c LineTo
 0x625fa0 GetRgnBox
 0x625fa4 EnumFontsW
 0x625fa8 CreateHalftonePalette
 0x625fac SelectObject
 0x625fb0 DeleteObject
 0x625fb4 ExtFloodFill
 0x625fb8 UnrealizeObject
 0x625fbc CopyEnhMetaFileW
 0x625fc0 SetBkColor
 0x625fc4 CreateCompatibleDC
 0x625fc8 GetBrushOrgEx
 0x625fcc GetCurrentPositionEx
 0x625fd0 GetTextExtentPointW
 0x625fd4 ExtTextOutW
 0x625fd8 SetBrushOrgEx
 0x625fdc GetPixel
 0x625fe0 GdiFlush
 0x625fe4 SetPixel
 0x625fe8 EnumFontFamiliesExW
 0x625fec StretchDIBits
 0x625ff0 GetPaletteEntries

EAT(Export Address Table) Library

0x4ddc38 TMethodImplementationIntercept
0x411068 __dbk_fcall_wrapper
0x62163c dbkFCallWrapperAddr


Similarity measure (PE file only) - Checking for service failure