popup

Report - sat1_0609_2.dll

PE File DLL OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.10 22:46 Machine s1_win7_x6402
Filename sat1_0609_2.dll
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
9.0
ZERO API file : clean
VT API (file) 17 detected (Kryptik, HLHF, GenericKD, DangerousSig, Artemis, ai score=84, kcloud, Wacatac, Q0NRGS, Malicious, Behavior)
md5 1e2385b6c669ba98831b97915f6aceba
sha256 337a487f1cb8f16200a5d14cac1dac3478e95cf3077b3872d319970131bea702
ssdeep 6144:rCqCGToDHEHD7pPV25vyGOZYjbLvD6RVioO6gZ6xv4hCZWrVcXRYpmPBOA:uTGTGkn5gqufLvDcVzPR0kWA
imphash f222d139f35da09cdd72f2c456fb7acb
impfuzzy 192:8hm+bNT1UKhM2h+gvCVr2qacRcacT/kPKV3O5:cxTVhLYaEXjKV3O5
  Network IP location

Signature (20cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
warning Generates some ICMP traffic
watch Communicates with host for which no DNS query was performed
watch File has been identified by 17 AntiVirus engines on VirusTotal as malicious
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a suspicious process
notice Foreign language identified in PE resource
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Terminates another process
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://180.178.106.50/sat1/TEST22-PC_W617601.5D67FB324A9D0823B317377F32B3F2A7/5/file/
whois
ID PT. HIPERNET INDODATA 180.178.106.50 clean
178.72.192.20
whois
CZ Nej.cz s.r.o. 178.72.192.20 clean
180.178.106.50
whois
ID PT. HIPERNET INDODATA 180.178.106.50 clean
114.7.240.222
whois
ID INDOSAT Internet Network Provider 114.7.240.222 clean

Suricata ids

ET CNC Feodo Tracker Reported CnC Server group 8
ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x100250d0 HeapDestroy
 0x100250d4 HeapCreate
 0x100250d8 VirtualFree
 0x100250dc VirtualAlloc
 0x100250e0 IsBadWritePtr
 0x100250e4 SetHandleCount
 0x100250e8 GetStdHandle
 0x100250ec GetFileType
 0x100250f0 GetStartupInfoA
 0x100250f4 FreeEnvironmentStringsA
 0x100250f8 FreeEnvironmentStringsW
 0x100250fc GetEnvironmentStrings
 0x10025100 GetEnvironmentStringsW
 0x10025104 SetUnhandledExceptionFilter
 0x10025108 LCMapStringA
 0x1002510c GetTimeZoneInformation
 0x10025110 GetStringTypeA
 0x10025114 GetStringTypeW
 0x10025118 IsBadReadPtr
 0x1002511c IsBadCodePtr
 0x10025120 SetStdHandle
 0x10025124 CompareStringA
 0x10025128 CompareStringW
 0x1002512c SetEnvironmentVariableA
 0x10025130 GetACP
 0x10025134 HeapReAlloc
 0x10025138 HeapSize
 0x1002513c GetProfileStringA
 0x10025140 TerminateProcess
 0x10025144 ExitProcess
 0x10025148 RaiseException
 0x1002514c HeapFree
 0x10025150 GetCommandLineA
 0x10025154 HeapAlloc
 0x10025158 RtlUnwind
 0x1002515c GetFileTime
 0x10025160 GetFileSize
 0x10025164 GetFileAttributesA
 0x10025168 GetTickCount
 0x1002516c FileTimeToLocalFileTime
 0x10025170 FileTimeToSystemTime
 0x10025174 GetFullPathNameA
 0x10025178 GetVolumeInformationA
 0x1002517c FindFirstFileA
 0x10025180 FindClose
 0x10025184 SetEndOfFile
 0x10025188 UnlockFile
 0x1002518c LockFile
 0x10025190 FlushFileBuffers
 0x10025194 SetFilePointer
 0x10025198 WriteFile
 0x1002519c ReadFile
 0x100251a0 CreateFileA
 0x100251a4 DuplicateHandle
 0x100251a8 GetThreadLocale
 0x100251ac SizeofResource
 0x100251b0 WritePrivateProfileStringA
 0x100251b4 GetOEMCP
 0x100251b8 GetCPInfo
 0x100251bc GetProcessVersion
 0x100251c0 TlsGetValue
 0x100251c4 LocalReAlloc
 0x100251c8 TlsSetValue
 0x100251cc GlobalReAlloc
 0x100251d0 TlsFree
 0x100251d4 GlobalHandle
 0x100251d8 TlsAlloc
 0x100251dc LocalAlloc
 0x100251e0 EnterCriticalSection
 0x100251e4 LeaveCriticalSection
 0x100251e8 DeleteCriticalSection
 0x100251ec InitializeCriticalSection
 0x100251f0 GlobalFlags
 0x100251f4 GlobalFree
 0x100251f8 CloseHandle
 0x100251fc GetModuleFileNameA
 0x10025200 GlobalAlloc
 0x10025204 lstrcmpA
 0x10025208 GetCurrentThread
 0x1002520c lstrcpynA
 0x10025210 FormatMessageA
 0x10025214 LocalFree
 0x10025218 MultiByteToWideChar
 0x1002521c WideCharToMultiByte
 0x10025220 InterlockedDecrement
 0x10025224 InterlockedIncrement
 0x10025228 GlobalLock
 0x1002522c GlobalUnlock
 0x10025230 SetLastError
 0x10025234 FreeLibrary
 0x10025238 FindResourceA
 0x1002523c LoadResource
 0x10025240 LockResource
 0x10025244 GetVersion
 0x10025248 lstrcatA
 0x1002524c GetCurrentThreadId
 0x10025250 GlobalGetAtomNameA
 0x10025254 lstrcmpiA
 0x10025258 GlobalAddAtomA
 0x1002525c GlobalFindAtomA
 0x10025260 GlobalDeleteAtom
 0x10025264 lstrcpyA
 0x10025268 GetModuleHandleA
 0x1002526c GetProcAddress
 0x10025270 lstrlenA
 0x10025274 LoadLibraryA
 0x10025278 LoadLibraryW
 0x1002527c GetCurrentProcess
 0x10025280 GetLastError
 0x10025284 LCMapStringW
 0x10025288 MulDiv
USER32.dll
 0x100252c0 InvalidateRect
 0x100252c4 CharUpperA
 0x100252c8 RegisterClipboardFormatA
 0x100252cc PostThreadMessageA
 0x100252d0 BeginPaint
 0x100252d4 GetWindowDC
 0x100252d8 ClientToScreen
 0x100252dc GetMenuCheckMarkDimensions
 0x100252e0 LoadBitmapA
 0x100252e4 GetMenuState
 0x100252e8 ModifyMenuA
 0x100252ec SetMenuItemBitmaps
 0x100252f0 CheckMenuItem
 0x100252f4 EnableMenuItem
 0x100252f8 GetNextDlgTabItem
 0x100252fc IsWindowEnabled
 0x10025300 MoveWindow
 0x10025304 SetWindowTextA
 0x10025308 IsDialogMessageA
 0x1002530c PostMessageA
 0x10025310 UpdateWindow
 0x10025314 SendDlgItemMessageA
 0x10025318 MapWindowPoints
 0x1002531c PeekMessageA
 0x10025320 DispatchMessageA
 0x10025324 SetActiveWindow
 0x10025328 IsWindow
 0x1002532c SetFocus
 0x10025330 AdjustWindowRectEx
 0x10025334 ScreenToClient
 0x10025338 IsWindowVisible
 0x1002533c GetTopWindow
 0x10025340 MessageBoxA
 0x10025344 IsChild
 0x10025348 GetParent
 0x1002534c GetCapture
 0x10025350 CopyAcceleratorTableA
 0x10025354 wsprintfA
 0x10025358 GetClassInfoA
 0x1002535c RegisterClassA
 0x10025360 GetMenu
 0x10025364 GetMenuItemCount
 0x10025368 GetSubMenu
 0x1002536c GetMenuItemID
 0x10025370 GetDlgItem
 0x10025374 GetWindowTextLengthA
 0x10025378 GetWindowTextA
 0x1002537c GetDlgCtrlID
 0x10025380 GetKeyState
 0x10025384 DefWindowProcA
 0x10025388 GetNextDlgGroupItem
 0x1002538c CreateWindowExA
 0x10025390 SetWindowsHookExA
 0x10025394 CallNextHookEx
 0x10025398 GetClassLongA
 0x1002539c SetPropA
 0x100253a0 UnhookWindowsHookEx
 0x100253a4 GetPropA
 0x100253a8 CallWindowProcA
 0x100253ac RemovePropA
 0x100253b0 GetMessageTime
 0x100253b4 GetMessagePos
 0x100253b8 GetLastActivePopup
 0x100253bc GetForegroundWindow
 0x100253c0 GetSysColor
 0x100253c4 InflateRect
 0x100253c8 GetFocus
 0x100253cc HideCaret
 0x100253d0 ShowCaret
 0x100253d4 ExcludeUpdateRgn
 0x100253d8 DrawFocusRect
 0x100253dc DefDlgProcA
 0x100253e0 SetForegroundWindow
 0x100253e4 GetWindow
 0x100253e8 GetWindowLongA
 0x100253ec SetWindowLongA
 0x100253f0 SetWindowPos
 0x100253f4 RegisterWindowMessageA
 0x100253f8 OffsetRect
 0x100253fc IntersectRect
 0x10025400 SystemParametersInfoA
 0x10025404 GetWindowPlacement
 0x10025408 CopyRect
 0x1002540c GetDC
 0x10025410 ReleaseDC
 0x10025414 MessageBeep
 0x10025418 IsIconic
 0x1002541c GetSystemMetrics
 0x10025420 GetClientRect
 0x10025424 DrawIcon
 0x10025428 GetSystemMenu
 0x1002542c AppendMenuA
 0x10025430 ShowWindow
 0x10025434 LoadIconA
 0x10025438 EnableWindow
 0x1002543c GetWindowRect
 0x10025440 IsWindowUnicode
 0x10025444 SendMessageA
 0x10025448 CharNextA
 0x1002544c GetSysColorBrush
 0x10025450 LoadCursorA
 0x10025454 GetDesktopWindow
 0x10025458 PtInRect
 0x1002545c GetClassNameA
 0x10025460 DestroyMenu
 0x10025464 LoadStringA
 0x10025468 MapDialogRect
 0x1002546c SetWindowContextHelpId
 0x10025470 EndDialog
 0x10025474 CreateDialogIndirectParamA
 0x10025478 GetMessageA
 0x1002547c TranslateMessage
 0x10025480 GetActiveWindow
 0x10025484 ValidateRect
 0x10025488 GetCursorPos
 0x1002548c SetCursor
 0x10025490 PostQuitMessage
 0x10025494 GrayStringA
 0x10025498 DestroyWindow
 0x1002549c SetRect
 0x100254a0 DrawTextA
 0x100254a4 WinHelpA
 0x100254a8 EndPaint
 0x100254ac TabbedTextOutA
GDI32.dll
 0x10025020 OffsetViewportOrgEx
 0x10025024 SetViewportExtEx
 0x10025028 ScaleViewportExtEx
 0x1002502c SetWindowExtEx
 0x10025030 ScaleWindowExtEx
 0x10025034 SelectClipRgn
 0x10025038 IntersectClipRect
 0x1002503c DeleteObject
 0x10025040 SetViewportOrgEx
 0x10025044 GetDeviceCaps
 0x10025048 GetViewportExtEx
 0x1002504c GetWindowExtEx
 0x10025050 CreateSolidBrush
 0x10025054 PtVisible
 0x10025058 RectVisible
 0x1002505c TextOutA
 0x10025060 ExtTextOutA
 0x10025064 Escape
 0x10025068 GetMapMode
 0x1002506c DPtoLP
 0x10025070 GetTextColor
 0x10025074 GetBkColor
 0x10025078 LPtoDP
 0x1002507c SetMapMode
 0x10025080 SetBkMode
 0x10025084 GetStockObject
 0x10025088 SelectObject
 0x1002508c RestoreDC
 0x10025090 SaveDC
 0x10025094 DeleteDC
 0x10025098 CreateBitmap
 0x1002509c GetObjectA
 0x100250a0 SetBkColor
 0x100250a4 SetTextColor
 0x100250a8 GetClipBox
 0x100250ac PatBlt
 0x100250b0 Rectangle
 0x100250b4 CreateRectRgnIndirect
 0x100250b8 CreateDIBitmap
 0x100250bc GetTextExtentPointA
 0x100250c0 BitBlt
 0x100250c4 CreateCompatibleDC
 0x100250c8 SetRectRgn
comdlg32.dll
 0x100254c4 GetFileTitleA
WINSPOOL.DRV
 0x100254b4 ClosePrinter
 0x100254b8 DocumentPropertiesA
 0x100254bc OpenPrinterA
ADVAPI32.dll
 0x10025000 RegCreateKeyExA
 0x10025004 RegOpenKeyExA
 0x10025008 RegSetValueExA
 0x1002500c RegCloseKey
COMCTL32.dll
 0x10025014 ImageList_Destroy
 0x10025018 None
oledlg.dll
 0x1002550c None
ole32.dll
 0x100254cc CoFreeUnusedLibraries
 0x100254d0 OleInitialize
 0x100254d4 CoTaskMemAlloc
 0x100254d8 CoTaskMemFree
 0x100254dc CreateILockBytesOnHGlobal
 0x100254e0 StgCreateDocfileOnILockBytes
 0x100254e4 StgOpenStorageOnILockBytes
 0x100254e8 CoGetClassObject
 0x100254ec CLSIDFromString
 0x100254f0 CLSIDFromProgID
 0x100254f4 CoRegisterMessageFilter
 0x100254f8 CoRevokeClassObject
 0x100254fc OleFlushClipboard
 0x10025500 OleIsCurrentClipboard
 0x10025504 OleUninitialize
OLEPRO32.DLL
 0x100252b8 None
OLEAUT32.dll
 0x10025290 VariantClear
 0x10025294 SysFreeString
 0x10025298 VariantTimeToSystemTime
 0x1002529c VariantCopy
 0x100252a0 VariantChangeType
 0x100252a4 SysAllocString
 0x100252a8 SysAllocStringByteLen
 0x100252ac SysStringLen
 0x100252b0 SysAllocStringLen

EAT(Export Address Table) Library

0x10002e00 DllRegisterServer

Similarity measure (PE file only) - Checking for service failure