popup

Report - Winvoke.exe

Lazarus Generic Malware PE64 PE File OS Processor Check GIF Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
    Created 2021.06.16 10:04 Machine s1_win7_x6401
    Filename Winvoke.exe
    Type PE32+ executable (GUI) x86-64, for MS Windows
    AI Score
    7
    		 Behavior Score
    5.6
    ZERO API file : clean
    VT API (file) 49 detected (Siggen13, 274944L, NukeSped, Lazarus, Razy, malicious, AVEE, score, xahodw, Crat, DropperX, Malware@#3ryquvlqv8obx, 0NA103DT21, fsmds, ai score=100, ASMalwS, NukeSpeed, Akdoor, Generic Dropper, Unsafe, susgen, confidence, 100%)
    md5 f4d46629ca15313b94992f3798718df7
    sha256 0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c
    ssdeep 6144:w33Tn+SJX6hDGRPJNJyPhkK1228jVdXRHZPJwQC8O:w36qRbJyZH1228j/TPu0
    imphash 0e15d4b92e4de8ce71e3c186bb853030
    impfuzzy 48:5+vCqSs/3c5fz80thcjLECDGAnf49RhgTFoXVz:5+vNSs/3c5r80th4qz
      Network IP location
    2
    +−
    Leaflet

    Signature (13cnts)

    Level Description
    danger File has been identified by 49 AntiVirus engines on VirusTotal as malicious
    watch Installs itself for autorun at Windows startup
    notice Allocates read-write-execute memory (usually to unpack itself)
    notice Creates a shortcut to an executable file
    notice Creates executable files on the filesystem
    notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
    notice Performs some HTTP requests
    notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
    notice Sends data using the HTTP POST Method
    notice The binary likely contains encrypted or compressed data indicative of a packer
    info Checks amount of memory in system
    info Queries for the computername
    info The executable contains unknown PE section names indicative of a packer (could be a false positive)

    Rules (6cnts)

    Level Name Description Collection
    danger Lazarus_Zero Lazarus Generic Malware binaries (upload)
    warning Generic_Malware_Zero Generic Malware binaries (upload)
    info IsPE64 (no description) binaries (upload)
    info Lnk_Format_Zero LNK Format binaries (download)
    info OS_Processor_Check_Zero OS Processor Check binaries (upload)
    info PE_Header_Zero PE File Signature binaries (upload)

    Network (6cnts) ?

    Request CC ASN Co IP4 Rule ? ZERO ?
    http://www.jinjinpig.co.kr/Anyboard/skin/board.php
    whois
    		KR Korea Telecom 222.122.49.28 2091 mailcious
    http://mail.namusoft.kr/jsp/user/eam/board.jsp
    whois
    		KR LG DACOM Corporation 182.162.89.146 2092 mailcious
    mail.namusoft.kr
    whois
    		KR LG DACOM Corporation 182.162.89.146 mailcious
    www.jinjinpig.co.kr
    whois
    		KR Korea Telecom 222.122.49.28 mailcious
    182.162.89.146
    whois
    		KR LG DACOM Corporation 182.162.89.146 mailcious
    222.122.49.28
    whois
    		KR Korea Telecom 222.122.49.28 mailcious

    Suricata ids

    PE API

    IAT(Import Address Table) Library

    KERNEL32.dll
     0x140011020 CloseHandle
     0x140011028 GetTickCount
     0x140011030 Sleep
     0x140011038 CreateProcessA
     0x140011040 VirtualFree
     0x140011048 LoadResource
     0x140011050 SizeofResource
     0x140011058 VirtualAlloc
     0x140011060 LockResource
     0x140011068 CreateFileA
     0x140011070 GetFileSize
     0x140011078 FindResourceExW
     0x140011080 FindResourceW
     0x140011088 WriteFile
     0x140011090 WideCharToMultiByte
     0x140011098 ReadFile
     0x1400110a0 GetModuleFileNameA
     0x1400110a8 GetProcAddress
     0x1400110b0 LoadLibraryA
     0x1400110b8 GetLogicalDrives
     0x1400110c0 GetSystemTimeAsFileTime
     0x1400110c8 GetLocalTime
     0x1400110d0 LocalFileTimeToFileTime
     0x1400110d8 GetModuleHandleA
     0x1400110e0 WriteConsoleW
     0x1400110e8 SetFilePointerEx
     0x1400110f0 FlushFileBuffers
     0x1400110f8 SetStdHandle
     0x140011100 GetConsoleMode
     0x140011108 GetConsoleCP
     0x140011110 GetStringTypeW
     0x140011118 LCMapStringW
     0x140011120 FreeEnvironmentStringsW
     0x140011128 GetEnvironmentStringsW
     0x140011130 GetCurrentProcessId
     0x140011138 QueryPerformanceCounter
     0x140011140 GetFileType
     0x140011148 GetCurrentThreadId
     0x140011150 GetCPInfo
     0x140011158 GetOEMCP
     0x140011160 GetACP
     0x140011168 IsValidCodePage
     0x140011170 LoadLibraryExW
     0x140011178 GetModuleFileNameW
     0x140011180 GetStdHandle
     0x140011188 GetModuleHandleW
     0x140011190 GetStartupInfoW
     0x140011198 DeleteCriticalSection
     0x1400111a0 DecodePointer
     0x1400111a8 HeapSize
     0x1400111b0 GetLastError
     0x1400111b8 RaiseException
     0x1400111c0 InitializeCriticalSectionEx
     0x1400111c8 HeapDestroy
     0x1400111d0 GetProcessHeap
     0x1400111d8 HeapFree
     0x1400111e0 HeapAlloc
     0x1400111e8 CreateFileW
     0x1400111f0 HeapReAlloc
     0x1400111f8 IsDebuggerPresent
     0x140011200 OutputDebugStringW
     0x140011208 EnterCriticalSection
     0x140011210 LeaveCriticalSection
     0x140011218 EncodePointer
     0x140011220 ExitProcess
     0x140011228 GetModuleHandleExW
     0x140011230 MultiByteToWideChar
     0x140011238 GetCommandLineA
     0x140011240 RtlPcToFileHeader
     0x140011248 RtlLookupFunctionEntry
     0x140011250 RtlUnwindEx
     0x140011258 IsProcessorFeaturePresent
     0x140011260 RtlCaptureContext
     0x140011268 RtlVirtualUnwind
     0x140011270 UnhandledExceptionFilter
     0x140011278 SetUnhandledExceptionFilter
     0x140011280 SetLastError
     0x140011288 InitializeCriticalSectionAndSpinCount
     0x140011290 GetCurrentProcess
     0x140011298 TerminateProcess
     0x1400112a0 TlsAlloc
     0x1400112a8 TlsGetValue
     0x1400112b0 TlsSetValue
     0x1400112b8 TlsFree
    USER32.dll
     0x1400112c8 GetClassNameA
     0x1400112d0 GetWindowRect
     0x1400112d8 GetWindowTextA
     0x1400112e0 GetCursorPos
     0x1400112e8 GetSysColorBrush
     0x1400112f0 GetCursor
     0x1400112f8 LoadImageA
     0x140011300 LoadCursorA
     0x140011308 ChangeDisplaySettingsA
     0x140011310 GetWindow
     0x140011318 LoadCursorFromFileA
     0x140011320 DispatchMessageA
     0x140011328 GetRawInputDeviceList
    GDI32.dll
     0x140011000 GetFontLanguageInfo
     0x140011008 CreateBitmap
     0x140011010 GetFontUnicodeRanges

    EAT(Export Address Table) is none


    Similarity measure (PE file only) - Checking for service failure