popup

Report - test.exe

AntiDebug AntiVM
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.18 08:03 Machine s1_win7_x6401
Filename test.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
5.6
ZERO API file : clean
VT API (file) 52 detected (BehavesLike.Win32.Swrort.lh, HEUR:Trojan.Win32.Generic, Win32.Trojan.PSE.1E7D3G0, Trojan:Win32/Meterpreter.O, Malicious, malicious (high confidence), a variant of Win32/Rozena.CP, Trojan.Backdoor-Shell, TR/Patched.Gen2, Packed.Generic.347, W32.FamVT.RorenNHc.Trojan, Trojan.Malware.300983.susgen, Trojan.CryptZ.Gen, win/malicious_confidence_100% (D), Virus.Win32.Gen-Crypt.ccnc, Trojan.Win32.Elzob.Gen, Trojan.Rosena.Gen.1, Trojan:Win32/Swrort.A, Win32:SwPatch [Wrm, Trojan.Win32.Swrort, suspicious, Swrort.i, Win.Trojan.Swrort-5710536-0, Trojan.Win32.Save.a, Trojan.Swrort.A, W32/Swrort.D, Malicious (score: 100), malware (ai score=89), Generic.mg.d57237560c25aff3, Backdoor.Win32.SWRORT.SMAL01, TrojWare.Win32.Rozena.A@4jwdqr, Trojan.Win32.Swrort.zv!s2, Static AI - Malicious PE, Gen:NN.ZexaF.34744.eq1@aaQwlCmi, Unsafe, malicious.60c25a, Malware.Heuristic!ET#100% (RDMK:cmRtazrzd7ItU6iR3rla+ks3MQZe), Trojan.Rozena, Trojan.CryptZ.Gen (B), Trojan ( 004c49f81 ), MalwThreat!df3bIV, ML/PE-A + ATK/EncPk-TZ, Trojan/Win32.Shell.R1283)
md5 d57237560c25aff34850ab1980a0fb04
sha256 e8cf359cbd1253afda0ce97a26843784441d248054e6f4d1e9c7695731577a55
ssdeep 1536:IgugxzMtdRFSq5fg+PQI6SL+/Mb+KR0Nc8QsJq39:7xYtdR0Q36pe0Nc8QsC9
imphash 481f47bbb2c9c21e108d65f52b04c448
impfuzzy 48:K+x02G0oErgsXit/qOJLawRr+pe4yVj9hYykN6tqW:K+RGpErJXw/qmRr+pYjDkN6tqW
  Network IP location

Signature (13cnts)

Level Description
watch Communicates with host for which no DNS query was performed
watch Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic)
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice An application raised an exception which may be indicative of an exploit crash
notice Creates executable files on the filesystem
notice File has been identified by 6 AntiVirus engines on VirusTotal as malicious
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info One or more processes crashed

Rules (8cnts)

Level Name Description Collection
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://188.119.113.80/1/test.exe
whois
NL Serverius Holding B.V. 188.119.113.80 clean
188.119.113.80
whois
NL Serverius Holding B.V. 188.119.113.80 clean

Suricata ids

ET INFO Executable Download from dotted-quad Host
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

PE API

IAT(Import Address Table) Library

MSVCRT.dll
 0x40c0c8 _iob
 0x40c0cc _except_handler3
 0x40c0d0 __set_app_type
 0x40c0d4 __p__fmode
 0x40c0d8 __p__commode
 0x40c0dc _adjust_fdiv
 0x40c0e0 __setusermatherr
 0x40c0e4 _initterm
 0x40c0e8 __getmainargs
 0x40c0ec __p___initenv
 0x40c0f0 _XcptFilter
 0x40c0f4 _exit
 0x40c0f8 _onexit
 0x40c0fc __dllonexit
 0x40c100 strrchr
 0x40c104 wcsncmp
 0x40c108 _close
 0x40c10c wcslen
 0x40c110 wcscpy
 0x40c114 strerror
 0x40c118 modf
 0x40c11c strspn
 0x40c120 realloc
 0x40c124 __p__environ
 0x40c128 __p__wenviron
 0x40c12c _errno
 0x40c130 free
 0x40c134 strncmp
 0x40c138 strstr
 0x40c13c strncpy
 0x40c140 _ftol
 0x40c144 qsort
 0x40c148 fopen
 0x40c14c perror
 0x40c150 fclose
 0x40c154 fflush
 0x40c158 calloc
 0x40c15c malloc
 0x40c160 signal
 0x40c164 printf
 0x40c168 _isctype
 0x40c16c atoi
 0x40c170 exit
 0x40c174 __mb_cur_max
 0x40c178 _pctype
 0x40c17c strchr
 0x40c180 fprintf
 0x40c184 _controlfp
 0x40c188 _strdup
 0x40c18c _strnicmp
KERNEL32.dll
 0x40c00c PeekNamedPipe
 0x40c010 ReadFile
 0x40c014 WriteFile
 0x40c018 LoadLibraryA
 0x40c01c GetProcAddress
 0x40c020 GetVersionExA
 0x40c024 GetExitCodeProcess
 0x40c028 TerminateProcess
 0x40c02c LeaveCriticalSection
 0x40c030 SetEvent
 0x40c034 ReleaseMutex
 0x40c038 EnterCriticalSection
 0x40c03c DeleteCriticalSection
 0x40c040 InitializeCriticalSection
 0x40c044 CreateMutexA
 0x40c048 GetFileType
 0x40c04c SetLastError
 0x40c050 FreeEnvironmentStringsW
 0x40c054 GetEnvironmentStringsW
 0x40c058 GlobalFree
 0x40c05c GetCommandLineW
 0x40c060 TlsAlloc
 0x40c064 TlsFree
 0x40c068 DuplicateHandle
 0x40c06c GetCurrentProcess
 0x40c070 SetHandleInformation
 0x40c074 CloseHandle
 0x40c078 GetSystemTimeAsFileTime
 0x40c07c FileTimeToSystemTime
 0x40c080 GetTimeZoneInformation
 0x40c084 FileTimeToLocalFileTime
 0x40c088 SystemTimeToFileTime
 0x40c08c SystemTimeToTzSpecificLocalTime
 0x40c090 Sleep
 0x40c094 FormatMessageA
 0x40c098 GetLastError
 0x40c09c WaitForSingleObject
 0x40c0a0 CreateEventA
 0x40c0a4 SetStdHandle
 0x40c0a8 SetFilePointer
 0x40c0ac CreateFileA
 0x40c0b0 CreateFileW
 0x40c0b4 GetOverlappedResult
 0x40c0b8 DeviceIoControl
 0x40c0bc GetFileInformationByHandle
 0x40c0c0 LocalFree
ADVAPI32.dll
 0x40c000 FreeSid
 0x40c004 AllocateAndInitializeSid
WSOCK32.dll
 0x40c1a0 getsockopt
 0x40c1a4 connect
 0x40c1a8 htons
 0x40c1ac gethostbyname
 0x40c1b0 ntohl
 0x40c1b4 inet_ntoa
 0x40c1b8 setsockopt
 0x40c1bc socket
 0x40c1c0 closesocket
 0x40c1c4 select
 0x40c1c8 ioctlsocket
 0x40c1cc __WSAFDIsSet
 0x40c1d0 WSAStartup
 0x40c1d4 WSACleanup
 0x40c1d8 WSAGetLastError
WS2_32.dll
 0x40c194 WSARecv
 0x40c198 WSASend

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure