popup

Report - ssetup.exe

Antivirus PE32 PE File PE64
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.06.25 14:40 Machine s1_win7_x6401
Filename ssetup.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
7.0
ZERO API file : clean
VT API (file) 35 detected (AIDetect, malware2, malicious, high confidence, GenericKD, Unsafe, AgentCRTD, Save, Witch, R002H0CFO21, DDLives, CLASSIC, xmmpz@0, Artemis, Score, ai score=81, kcloud, HackTool, AutoKMS, R426870, BScope, Pasta)
md5 5e8f78570b9610d10fe961dd12e8dba6
sha256 d2517e4a148f49f87722265abdfb091cc8655e78edb715c70aafc46cc6e75d64
ssdeep 12288:fj+BuagU0y60p1u8lES1PBD7aJOth+no0Ukhf/kGIQr:L+BIU0GO8lEEPN75tSBlf/TIQr
imphash 27d98d594bfdbab5c9c0e077fa659f6c
impfuzzy 48:5fowgSIJI7k3t8qG+x02GStEZAFoM5RtteyKAom:5fFgSDnqG+RGSMyKAom
  Network IP location

Signature (16cnts)

Level Description
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
watch Attempts to create or modify system certificates
watch Creates and runs a batch file to remove the original binary
watch Deletes executed files from disk
watch Installs itself for autorun at Windows startup
notice Creates a service
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
notice Searches running processes potentially to identify processes for sandbox evasion
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Command line console output was observed
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (7cnts)

Level Name Description Collection
watch Antivirus Contains references to security software binaries (download)
watch Antivirus Contains references to security software binaries (upload)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
s5_down.listw.top
whois
CN Hangzhou Alibaba Advertising Co.,Ltd. 120.79.176.83 clean
s5_rep.listw.top
whois
Unknown 8.135.96.89 clean
120.79.176.83
whois
CN Hangzhou Alibaba Advertising Co.,Ltd. 120.79.176.83 clean
8.135.96.89
whois
Unknown 8.135.96.89 clean
114.114.114.114
whois
CN COGENT-174 114.114.114.114 clean

Suricata ids

ET DNS Query to a *.top domain - Likely Hostile

PE API

IAT(Import Address Table) Library

MFC42.DLL
 0x4030c8 None
 0x4030cc None
 0x4030d0 None
 0x4030d4 None
 0x4030d8 None
 0x4030dc None
 0x4030e0 None
 0x4030e4 None
 0x4030e8 None
 0x4030ec None
 0x4030f0 None
 0x4030f4 None
 0x4030f8 None
 0x4030fc None
 0x403100 None
 0x403104 None
 0x403108 None
 0x40310c None
 0x403110 None
 0x403114 None
 0x403118 None
 0x40311c None
 0x403120 None
 0x403124 None
 0x403128 None
 0x40312c None
 0x403130 None
 0x403134 None
 0x403138 None
 0x40313c None
 0x403140 None
 0x403144 None
 0x403148 None
 0x40314c None
 0x403150 None
 0x403154 None
 0x403158 None
 0x40315c None
 0x403160 None
 0x403164 None
 0x403168 None
 0x40316c None
 0x403170 None
 0x403174 None
 0x403178 None
 0x40317c None
 0x403180 None
 0x403184 None
 0x403188 None
 0x40318c None
 0x403190 None
 0x403194 None
 0x403198 None
 0x40319c None
 0x4031a0 None
 0x4031a4 None
 0x4031a8 None
 0x4031ac None
 0x4031b0 None
 0x4031b4 None
 0x4031b8 None
 0x4031bc None
 0x4031c0 None
 0x4031c4 None
 0x4031c8 None
 0x4031cc None
 0x4031d0 None
 0x4031d4 None
 0x4031d8 None
 0x4031dc None
 0x4031e0 None
 0x4031e4 None
 0x4031e8 None
 0x4031ec None
 0x4031f0 None
 0x4031f4 None
 0x4031f8 None
 0x4031fc None
 0x403200 None
 0x403204 None
 0x403208 None
 0x40320c None
 0x403210 None
MSVCRT.dll
 0x403218 _setmbcp
 0x40321c _stricmp
 0x403220 rand
 0x403224 sprintf
 0x403228 srand
 0x40322c free
 0x403230 malloc
 0x403234 __CxxFrameHandler
 0x403238 __dllonexit
 0x40323c _onexit
 0x403240 _controlfp
 0x403244 _except_handler3
 0x403248 __set_app_type
 0x40324c __p__fmode
 0x403250 __p__commode
 0x403254 _adjust_fdiv
 0x403258 __setusermatherr
 0x40325c _initterm
 0x403260 __getmainargs
 0x403264 _acmdln
 0x403268 exit
 0x40326c _XcptFilter
 0x403270 _exit
KERNEL32.dll
 0x403050 SetFilePointerEx
 0x403054 WriteFile
 0x403058 SetEndOfFile
 0x40305c SetFileAttributesA
 0x403060 CreateFileA
 0x403064 CloseHandle
 0x403068 GetLastError
 0x40306c GetExitCodeProcess
 0x403070 WaitForSingleObject
 0x403074 CreateProcessA
 0x403078 GetTempPathA
 0x40307c GetModuleFileNameA
 0x403080 GetTickCount
 0x403084 ExitProcess
 0x403088 GetVersionExA
 0x40308c GetCurrentProcess
 0x403090 GetProcAddress
 0x403094 GetModuleHandleA
 0x403098 SizeofResource
 0x40309c LockResource
 0x4030a0 LoadResource
 0x4030a4 FindResourceA
 0x4030a8 Process32Next
 0x4030ac Process32First
 0x4030b0 CreateToolhelp32Snapshot
 0x4030b4 Sleep
 0x4030b8 GetSystemDirectoryA
 0x4030bc FlushFileBuffers
 0x4030c0 GetStartupInfoA
USER32.dll
 0x403278 EnableWindow
 0x40327c IsIconic
 0x403280 GetSystemMetrics
 0x403284 GetClientRect
 0x403288 DrawIcon
 0x40328c SendMessageA
ADVAPI32.dll
 0x403000 RegQueryValueExA
 0x403004 CreateServiceA
 0x403008 StartServiceA
 0x40300c OpenServiceA
 0x403010 RegDeleteKeyA
 0x403014 RegCreateKeyA
 0x403018 RegCreateKeyExA
 0x40301c CloseServiceHandle
 0x403020 RegOpenKeyExA
 0x403024 RegSetValueExA
 0x403028 RegCloseKey
 0x40302c OpenSCManagerA
CRYPT32.dll
 0x403034 CertCloseStore
 0x403038 CertAddCertificateContextToStore
 0x40303c CertOpenStore
 0x403040 CertCreateCertificateContext
 0x403044 CertFreeCertificateContext
 0x403048 CryptStringToBinaryA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure