Report - relvo.exe

Generic Malware Admin Tool (Sysinternals etc ...) Malicious Library PE File PE32
ScreenShot
Created 2021.06.18 09:46 Machine s1_win7_x6401
Filename relvo.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
2.6
ZERO API file : malware
VT API (file) 45 detected (AIDetect, malware2, malicious, high confidence, GenericKD, Artemis, Unsafe, Save, Chapak, ZelphiF, bHW@aCNQfcpI, QYRU, Attribute, HighConfidence, Raccoon, PWSX, ezrb, UMal, idswt@0, DealPly, Static AI, Malicious PE, Score, StellarStealer, cznhv, ai score=100, kcloud, Bunitucrypt, BScope, RaccoonStealer, susgen, PossibleThreat, PALLAS, confidence)
md5 3f891f4ea01741d664416c3b34f64208
sha256 dd1dea95bf17e3f135d2740e87d8b9f08ccf347e4ff832b9e747f775017ff346
ssdeep 24576:uscqzDohX1lerbtv1acwAyXIrt2go5pvxM+Yy5X1IVeY27:u4YhQbttyA1r3o5ZxNX1IVeY
imphash 8c3d2ce9c0756d959c7aa1c81b93d3a0
impfuzzy 96:8cfpHYU3O0MJ41Xhp4U8zS10+Ybbuu2DrSUvK9LVio1GqE6nDwPOQR8N:f3Fkk1QbbuuSrSUvK9RiooqE6EPOQRO
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 45 AntiVirus engines on VirusTotal as malicious
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x453118 DeleteCriticalSection
 0x45311c LeaveCriticalSection
 0x453120 EnterCriticalSection
 0x453124 InitializeCriticalSection
 0x453128 VirtualFree
 0x45312c VirtualAlloc
 0x453130 LocalFree
 0x453134 LocalAlloc
 0x453138 GetVersion
 0x45313c GetCurrentThreadId
 0x453140 InterlockedDecrement
 0x453144 InterlockedIncrement
 0x453148 VirtualQuery
 0x45314c WideCharToMultiByte
 0x453150 MultiByteToWideChar
 0x453154 lstrlenA
 0x453158 lstrcpynA
 0x45315c LoadLibraryExA
 0x453160 GetThreadLocale
 0x453164 GetStartupInfoA
 0x453168 GetProcAddress
 0x45316c GetModuleHandleA
 0x453170 GetModuleFileNameA
 0x453174 GetLocaleInfoA
 0x453178 GetCommandLineA
 0x45317c FreeLibrary
 0x453180 FindFirstFileA
 0x453184 FindClose
 0x453188 ExitProcess
 0x45318c WriteFile
 0x453190 UnhandledExceptionFilter
 0x453194 RtlUnwind
 0x453198 RaiseException
 0x45319c GetStdHandle
user32.dll
 0x4531a4 GetKeyboardType
 0x4531a8 LoadStringA
 0x4531ac MessageBoxA
 0x4531b0 CharNextA
advapi32.dll
 0x4531b8 RegQueryValueExA
 0x4531bc RegOpenKeyExA
 0x4531c0 RegCloseKey
oleaut32.dll
 0x4531c8 SysFreeString
 0x4531cc SysReAllocStringLen
 0x4531d0 SysAllocStringLen
kernel32.dll
 0x4531d8 TlsSetValue
 0x4531dc TlsGetValue
 0x4531e0 LocalAlloc
 0x4531e4 GetModuleHandleA
advapi32.dll
 0x4531ec RegQueryValueExA
 0x4531f0 RegOpenKeyExA
 0x4531f4 RegCloseKey
kernel32.dll
 0x4531fc lstrcpyA
 0x453200 WriteFile
 0x453204 WaitForSingleObject
 0x453208 VirtualQuery
 0x45320c VirtualAllocEx
 0x453210 VirtualAlloc
 0x453214 Sleep
 0x453218 SizeofResource
 0x45321c SetThreadLocale
 0x453220 SetFilePointer
 0x453224 SetEvent
 0x453228 SetErrorMode
 0x45322c SetEndOfFile
 0x453230 ResetEvent
 0x453234 ReadFile
 0x453238 MulDiv
 0x45323c LockResource
 0x453240 LoadResource
 0x453244 LoadLibraryA
 0x453248 LeaveCriticalSection
 0x45324c InitializeCriticalSection
 0x453250 GlobalUnlock
 0x453254 GlobalReAlloc
 0x453258 GlobalHandle
 0x45325c GlobalLock
 0x453260 GlobalFree
 0x453264 GlobalFindAtomA
 0x453268 GlobalDeleteAtom
 0x45326c GlobalAlloc
 0x453270 GlobalAddAtomA
 0x453274 GetVersionExA
 0x453278 GetVersion
 0x45327c GetTickCount
 0x453280 GetThreadLocale
 0x453284 GetSystemInfo
 0x453288 GetStringTypeExA
 0x45328c GetStdHandle
 0x453290 GetProcAddress
 0x453294 GetModuleHandleA
 0x453298 GetModuleFileNameA
 0x45329c GetLocaleInfoA
 0x4532a0 GetLocalTime
 0x4532a4 GetLastError
 0x4532a8 GetFullPathNameA
 0x4532ac GetDiskFreeSpaceA
 0x4532b0 GetDateFormatA
 0x4532b4 GetCurrentThreadId
 0x4532b8 GetCurrentProcessId
 0x4532bc GetCPInfo
 0x4532c0 GetACP
 0x4532c4 FreeResource
 0x4532c8 InterlockedExchange
 0x4532cc FreeLibrary
 0x4532d0 FormatMessageA
 0x4532d4 FindResourceA
 0x4532d8 EnumCalendarInfoA
 0x4532dc EnterCriticalSection
 0x4532e0 DeleteCriticalSection
 0x4532e4 CreateThread
 0x4532e8 CreateFileA
 0x4532ec CreateEventA
 0x4532f0 CompareStringA
 0x4532f4 CloseHandle
version.dll
 0x4532fc VerQueryValueA
 0x453300 GetFileVersionInfoSizeA
 0x453304 GetFileVersionInfoA
gdi32.dll
 0x45330c UnrealizeObject
 0x453310 StretchBlt
 0x453314 SetWindowOrgEx
 0x453318 SetViewportOrgEx
 0x45331c SetTextColor
 0x453320 SetStretchBltMode
 0x453324 SetROP2
 0x453328 SetPixel
 0x45332c SetDIBColorTable
 0x453330 SetBrushOrgEx
 0x453334 SetBkMode
 0x453338 SetBkColor
 0x45333c SelectPalette
 0x453340 SelectObject
 0x453344 SaveDC
 0x453348 RestoreDC
 0x45334c RectVisible
 0x453350 RealizePalette
 0x453354 PatBlt
 0x453358 MoveToEx
 0x45335c MaskBlt
 0x453360 LineTo
 0x453364 IntersectClipRect
 0x453368 GetWindowOrgEx
 0x45336c GetTextMetricsA
 0x453370 GetTextExtentPoint32A
 0x453374 GetSystemPaletteEntries
 0x453378 GetStockObject
 0x45337c GetPixel
 0x453380 GetPaletteEntries
 0x453384 GetObjectA
 0x453388 GetFontLanguageInfo
 0x45338c GetDeviceCaps
 0x453390 GetDIBits
 0x453394 GetDIBColorTable
 0x453398 GetDCOrgEx
 0x45339c GetCurrentPositionEx
 0x4533a0 GetClipBox
 0x4533a4 GetBrushOrgEx
 0x4533a8 GetBitmapBits
 0x4533ac ExcludeClipRect
 0x4533b0 DeleteObject
 0x4533b4 DeleteDC
 0x4533b8 CreateSolidBrush
 0x4533bc CreatePenIndirect
 0x4533c0 CreatePalette
 0x4533c4 CreateHalftonePalette
 0x4533c8 CreateFontIndirectA
 0x4533cc CreateDIBitmap
 0x4533d0 CreateDIBSection
 0x4533d4 CreateCompatibleDC
 0x4533d8 CreateCompatibleBitmap
 0x4533dc CreateBrushIndirect
 0x4533e0 CreateBitmap
 0x4533e4 BitBlt
user32.dll
 0x4533ec CreateWindowExA
 0x4533f0 WindowFromPoint
 0x4533f4 WinHelpA
 0x4533f8 WaitMessage
 0x4533fc UpdateWindow
 0x453400 UnregisterClassA
 0x453404 UnhookWindowsHookEx
 0x453408 TranslateMessage
 0x45340c TranslateMDISysAccel
 0x453410 TrackPopupMenu
 0x453414 SystemParametersInfoA
 0x453418 ShowWindow
 0x45341c ShowScrollBar
 0x453420 ShowOwnedPopups
 0x453424 ShowCursor
 0x453428 SetWindowsHookExA
 0x45342c SetWindowPos
 0x453430 SetWindowPlacement
 0x453434 SetWindowLongA
 0x453438 SetTimer
 0x45343c SetScrollRange
 0x453440 SetScrollPos
 0x453444 SetScrollInfo
 0x453448 SetRect
 0x45344c SetPropA
 0x453450 SetParent
 0x453454 SetMenuItemInfoA
 0x453458 SetMenu
 0x45345c SetForegroundWindow
 0x453460 SetFocus
 0x453464 SetCursor
 0x453468 SetClassLongA
 0x45346c SetCapture
 0x453470 SetActiveWindow
 0x453474 SendMessageA
 0x453478 ScrollWindow
 0x45347c ScreenToClient
 0x453480 RemovePropA
 0x453484 RemoveMenu
 0x453488 ReleaseDC
 0x45348c ReleaseCapture
 0x453490 RegisterWindowMessageA
 0x453494 RegisterClipboardFormatA
 0x453498 RegisterClassA
 0x45349c RedrawWindow
 0x4534a0 PtInRect
 0x4534a4 PostQuitMessage
 0x4534a8 PostMessageA
 0x4534ac PeekMessageA
 0x4534b0 OffsetRect
 0x4534b4 OemToCharA
 0x4534b8 MessageBoxA
 0x4534bc MapWindowPoints
 0x4534c0 MapVirtualKeyA
 0x4534c4 LoadStringA
 0x4534c8 LoadKeyboardLayoutA
 0x4534cc LoadIconA
 0x4534d0 LoadCursorFromFileW
 0x4534d4 LoadCursorFromFileA
 0x4534d8 LoadCursorA
 0x4534dc LoadBitmapA
 0x4534e0 KillTimer
 0x4534e4 IsZoomed
 0x4534e8 IsWindowVisible
 0x4534ec IsWindowEnabled
 0x4534f0 IsWindow
 0x4534f4 IsRectEmpty
 0x4534f8 IsIconic
 0x4534fc IsDialogMessageA
 0x453500 IsChild
 0x453504 InvalidateRect
 0x453508 IntersectRect
 0x45350c InsertMenuItemA
 0x453510 InsertMenuA
 0x453514 InflateRect
 0x453518 GetWindowThreadProcessId
 0x45351c GetWindowTextA
 0x453520 GetWindowRect
 0x453524 GetWindowPlacement
 0x453528 GetWindowLongA
 0x45352c GetWindowDC
 0x453530 GetTopWindow
 0x453534 GetSystemMetrics
 0x453538 GetSystemMenu
 0x45353c GetSysColorBrush
 0x453540 GetSysColor
 0x453544 GetSubMenu
 0x453548 GetScrollRange
 0x45354c GetScrollPos
 0x453550 GetScrollInfo
 0x453554 GetPropA
 0x453558 GetParent
 0x45355c GetWindow
 0x453560 GetMenuStringA
 0x453564 GetMenuState
 0x453568 GetMenuItemInfoA
 0x45356c GetMenuItemID
 0x453570 GetMenuItemCount
 0x453574 GetMenu
 0x453578 GetLastActivePopup
 0x45357c GetKeyboardState
 0x453580 GetKeyboardLayoutList
 0x453584 GetKeyboardLayout
 0x453588 GetKeyState
 0x45358c GetKeyNameTextA
 0x453590 GetIconInfo
 0x453594 GetForegroundWindow
 0x453598 GetFocus
 0x45359c GetDesktopWindow
 0x4535a0 GetDCEx
 0x4535a4 GetDC
 0x4535a8 GetCursorPos
 0x4535ac GetCursor
 0x4535b0 GetClientRect
 0x4535b4 GetClassNameA
 0x4535b8 GetClassInfoA
 0x4535bc GetCapture
 0x4535c0 GetActiveWindow
 0x4535c4 FrameRect
 0x4535c8 FindWindowA
 0x4535cc FillRect
 0x4535d0 EqualRect
 0x4535d4 EnumWindows
 0x4535d8 EnumThreadWindows
 0x4535dc EndPaint
 0x4535e0 EnableWindow
 0x4535e4 EnableScrollBar
 0x4535e8 EnableMenuItem
 0x4535ec DrawTextA
 0x4535f0 DrawMenuBar
 0x4535f4 DrawIconEx
 0x4535f8 DrawIcon
 0x4535fc DrawFrameControl
 0x453600 DrawEdge
 0x453604 DispatchMessageA
 0x453608 DestroyWindow
 0x45360c DestroyMenu
 0x453610 DestroyIcon
 0x453614 DestroyCursor
 0x453618 DeleteMenu
 0x45361c DefWindowProcA
 0x453620 DefMDIChildProcA
 0x453624 DefFrameProcA
 0x453628 CreatePopupMenu
 0x45362c CreateMenu
 0x453630 CreateIcon
 0x453634 ClientToScreen
 0x453638 CheckMenuItem
 0x45363c CallWindowProcA
 0x453640 CallNextHookEx
 0x453644 BeginPaint
 0x453648 CharNextA
 0x45364c CharLowerA
 0x453650 CharToOemA
 0x453654 AdjustWindowRectEx
 0x453658 ActivateKeyboardLayout
kernel32.dll
 0x453660 Sleep
oleaut32.dll
 0x453668 SafeArrayPtrOfIndex
 0x45366c SafeArrayGetUBound
 0x453670 SafeArrayGetLBound
 0x453674 SafeArrayCreate
 0x453678 VariantChangeType
 0x45367c VariantCopy
 0x453680 VariantClear
 0x453684 VariantInit
comctl32.dll
 0x45368c ImageList_SetIconSize
 0x453690 ImageList_GetIconSize
 0x453694 ImageList_Write
 0x453698 ImageList_Read
 0x45369c ImageList_GetDragImage
 0x4536a0 ImageList_DragShowNolock
 0x4536a4 ImageList_SetDragCursorImage
 0x4536a8 ImageList_DragMove
 0x4536ac ImageList_DragLeave
 0x4536b0 ImageList_DragEnter
 0x4536b4 ImageList_EndDrag
 0x4536b8 ImageList_BeginDrag
 0x4536bc ImageList_Remove
 0x4536c0 ImageList_DrawEx
 0x4536c4 ImageList_Draw
 0x4536c8 ImageList_GetBkColor
 0x4536cc ImageList_SetBkColor
 0x4536d0 ImageList_ReplaceIcon
 0x4536d4 ImageList_Add
 0x4536d8 ImageList_GetImageCount
 0x4536dc ImageList_Destroy
 0x4536e0 ImageList_Create

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure