Report - EHH.exe

Generic Malware Admin Tool (Sysinternals Devolutions inc) Malicious Packer PE File PE32
ScreenShot
Created 2021.06.02 11:34 Machine s1_win7_x6401
Filename EHH.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
Behavior Score
1.6
ZERO API file : malware
VT API (file) 18 detected (malicious, high confidence, Artemis, Unsafe, Save, ZevbaF, hm0@ai6DUehi, Attribute, HighConfidence, FileRepMalware, Scarsi, axce, Static AI, Suspicious PE, Wacatac, AvsArher, bTx33N, confidence)
md5 979555d563632cad528a128a3af233bb
sha256 3169e214328f82d65732fc3590b677154c0e1932e549fcd11c4b84f34f0afd4e
ssdeep 1536:KpNAipDQlK8h4AKvkzf772JEoN3X/lU9xya9zgDVqpIbACUPv60k:++flv4AM+fGJEI3vibnYMSZ860k
imphash 153a31799770099c7b08b378cdd5eb59
impfuzzy 48:nh/w3QZwgmoweTnOkU8lxzwxkM3zGhdcr1SxgXEUATqFNBzj+PHw+seqH7k/MWXw:nh/6QZfmoZTnOkUyxzrMjGhdcrwxgXEe
  Network IP location

Signature (4cnts)

Level Description
watch File has been identified by 18 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
info One or more processes crashed

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 None
 0x401004 _CIcos
 0x401008 _adj_fptan
 0x40100c __vbaVarMove
 0x401010 __vbaFreeVar
 0x401014 None
 0x401018 __vbaStrVarMove
 0x40101c __vbaLenBstr
 0x401020 __vbaFreeVarList
 0x401024 __vbaEnd
 0x401028 _adj_fdiv_m64
 0x40102c None
 0x401030 __vbaFreeObjList
 0x401034 _adj_fprem1
 0x401038 __vbaRecAnsiToUni
 0x40103c None
 0x401040 __vbaStrCat
 0x401044 None
 0x401048 __vbaSetSystemError
 0x40104c __vbaRecDestruct
 0x401050 None
 0x401054 __vbaHresultCheckObj
 0x401058 None
 0x40105c _adj_fdiv_m32
 0x401060 None
 0x401064 None
 0x401068 None
 0x40106c __vbaAryDestruct
 0x401070 None
 0x401074 None
 0x401078 __vbaBoolStr
 0x40107c None
 0x401080 None
 0x401084 __vbaOnError
 0x401088 __vbaObjSet
 0x40108c _adj_fdiv_m16i
 0x401090 None
 0x401094 _adj_fdivr_m16i
 0x401098 None
 0x40109c None
 0x4010a0 __vbaFpR8
 0x4010a4 _CIsin
 0x4010a8 __vbaErase
 0x4010ac None
 0x4010b0 __vbaChkstk
 0x4010b4 None
 0x4010b8 EVENT_SINK_AddRef
 0x4010bc __vbaGenerateBoundsError
 0x4010c0 __vbaStrCmp
 0x4010c4 __vbaAryConstruct2
 0x4010c8 __vbaI2I4
 0x4010cc None
 0x4010d0 DllFunctionCall
 0x4010d4 None
 0x4010d8 _adj_fpatan
 0x4010dc __vbaRedim
 0x4010e0 __vbaRecUniToAnsi
 0x4010e4 EVENT_SINK_Release
 0x4010e8 __vbaUI1I2
 0x4010ec _CIsqrt
 0x4010f0 EVENT_SINK_QueryInterface
 0x4010f4 __vbaExceptHandler
 0x4010f8 _adj_fprem
 0x4010fc _adj_fdivr_m64
 0x401100 None
 0x401104 None
 0x401108 None
 0x40110c __vbaFPException
 0x401110 None
 0x401114 None
 0x401118 None
 0x40111c None
 0x401120 _CIlog
 0x401124 None
 0x401128 __vbaErrorOverflow
 0x40112c __vbaNew2
 0x401130 __vbaInStr
 0x401134 None
 0x401138 _adj_fdiv_m32i
 0x40113c _adj_fdivr_m32i
 0x401140 __vbaStrCopy
 0x401144 None
 0x401148 None
 0x40114c __vbaI4Str
 0x401150 __vbaFreeStrList
 0x401154 _adj_fdivr_m32
 0x401158 _adj_fdiv_r
 0x40115c None
 0x401160 __vbaVarTstNe
 0x401164 __vbaI4Var
 0x401168 None
 0x40116c __vbaLateMemCall
 0x401170 None
 0x401174 __vbaVarAdd
 0x401178 __vbaInStrB
 0x40117c __vbaVarDup
 0x401180 None
 0x401184 __vbaStrToAnsi
 0x401188 None
 0x40118c __vbaFpI4
 0x401190 __vbaVarCopy
 0x401194 __vbaRecDestructAnsi
 0x401198 _CIatan
 0x40119c __vbaStrMove
 0x4011a0 None
 0x4011a4 __vbaCastObj
 0x4011a8 None
 0x4011ac None
 0x4011b0 None
 0x4011b4 _allmul
 0x4011b8 __vbaLateIdSt
 0x4011bc _CItan
 0x4011c0 None
 0x4011c4 _CIexp
 0x4011c8 __vbaFreeObj
 0x4011cc __vbaFreeStr
 0x4011d0 None

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure