popup

Report - 60e40fb428612.dll

Generic Malware PE File DLL OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.06 18:01 Machine s1_win7_x6401
Filename 60e40fb428612.dll
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score
1
 Behavior Score
2.2
ZERO API file : clean
VT API (file) 7 detected (malicious, high confidence, Artemis, score, Dridex)
md5 c6bfea479b46b9eb7a69667e0165179f
sha256 62dbfe723197430a3af1ec9262fcd2a5c2bfc8e81b97c313101f0a5388d587fc
ssdeep 6144:vC8nRa6tXFOspzA7n6NZVeC8i795fubASK9beZTX3l8Eo:J0SVOsphVWi7PWoBeZTX36
imphash 4c29865e356872ef0757b58734cbbb11
impfuzzy 48:T43n9Qc+RGuW8thwuFZeN0SkjGALo0E6x91ttk:T4XWc+RGr8thpeWScc
  Network IP location

Signature (7cnts)

Level Description
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by 7 AntiVirus engines on VirusTotal as malicious
notice Performs some HTTP requests
info One or more processes crashed
info Queries for the computername
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (24cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://vuredosite.club/grower/tGpatr1IrHVle34MNp_2BwV/BiQncvOCpX/SzgNxHn40ykWRA74M/9WAEuffVHZa1/zmdjfq3GOBC/WrV59k1EKiwPVD/_2B0KCK2JXuSY6lNUqyYK/8_2BqrTPxHaEJ2mo/ucom_2Br8Luache/KZ_2BqyzD72aPqTj2H/Uf1VfcvQM/SbX9eKEQ_2Fne8rlKJhI/cJvEd2AOUMwjRYi4Hwf/_2Fyptu
whois
DE M247 Ltd 37.120.222.6 clean
http://auredosite.club/grower/Rra3zlxR7zMWiivWxnvk03/RkV2y9lC_2Bd0/XhNZR8GP/NJZVBBkxMjnjHaCoFOLD1w4/zTfWnbRB6B/8kkiNzbsBgc1INuUM/Uxy_2B_2FM0q/NnEgFt_2B4F/soJn03X60ILS62/2V5OIf_2F_2FLtQpHnrLx/uA_2F4dcNfzkof4b/ADxxOMhs_2Fa50N/IXVPXT743Pv7qUWt9b/b9_2Fjn8T/e.
whois
DE M247 Ltd 37.120.222.61 clean
http://outlook.com/grower/NGPFCrhlBzT/Jw2TiZi8iifvHo/rqSgG8jqn5QV3VOmrr1nI/_2FsUJsnAdRfYdR7/qLe_2F84lRZZn_2/BmPGdVwBnqQV7OEuXq/xyFIrCvnL/UMwmL0GmidmrTmLNFNcd/P2DKY8iz6cow0mbx_2F/sbJGtbbd_2BGwyI_2Bxw0S/we1LziCYkQ0Cx/_2F0rJ9S/F5wpSAIpNSNFFpRxGE86IR5/pGNpT_2
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 40.97.148.226 clean
http://auredosite.club/grower/t8AjypHnwO6h71YmbjXGTpx/ej_2B_2F6d/Jdn3yxfUvYN4tijpi/YnqB9ivIS_2F/0p6hTDq2gSB/ZkzTd4Bjgg_2FT/LVJMloJMj2t23Q6E1Typz/o0Doo9aGJccGgJi8/7CHSvWKDHjDG_2B/KvBE_2Fvlc0EgipWY3/UnADWVp5Q/rWwJlVapqZTijZgllzvy/6g9SE1MMzW4S6DRKOkZ/RX6rh1i
whois
DE M247 Ltd 37.120.222.61 clean
http://outlook.com/grower/HifhyQ_2FFA_/2BrB_2FLHP8/6XtvMolaVkbxNG/M87QW6j_2FP_2BvYHNtwk/wfNbuE8KybHLWY5O/SVLd6tAjqwt4I3O/CmoDOXGju5EqxmqADg/SZkchW1YF/eCs7OitMTPagVSYN1ln9/udSEMdxezj42VmEKleq/cmc_2BUQ6tbT7wSAKbXwcE/jF1hnY59qkPpk/JIwZneIZ/DEUHT_2BkDBM9BJJm1
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 40.97.148.226 clean
http://outlook.com/grower/LbPHPEF4_/2BZMDYmlyUUAIwzdjYlF/IsCiLt23gG2XX0dR8Mg/QIW4lE_2FuyJABPJiQy2_2/BxIjtj_2BJJr_/2BKFSEPm/uM39a7A3gSMfSIZBzC4TJ02/LsKoFEhJ1f/JG7niGi3Pi5y50kbt/gOVmuchXk4qS/sIRcFDw1CZ2/NDEIwheRVvw8JO/MALZOuQCTneqoYkZaMTB7/P_2BRCYmPsNzvA78/
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 40.97.148.226 clean
http://vuredosite.club/grower/Chfj9hsaDeXs0R/tFsvi_2By9SJewZBpb0ho/e1dMX20jG3CmCVzn/FB3nLwD9e_2BwoA/mC23TtygtmeXn6ZnoJ/_2B4pSfOj/uWXg_2BqYVGC70EyI6VK/Gtsy3x20uUh2oNCMAM_/2BTMM2tKkjS5vFoYlfoTSc/5w4YbRyEZnClB/dc4ckOkR/Jgwj3c91k_2Bt19eFIlYxx8/BB8Nu5Kfv1/g8FS
whois
DE M247 Ltd 37.120.222.6 clean
https://outlook.office365.com/grower/NGPFCrhlBzT/Jw2TiZi8iifvHo/rqSgG8jqn5QV3VOmrr1nI/_2FsUJsnAdRfYdR7/qLe_2F84lRZZn_2/BmPGdVwBnqQV7OEuXq/xyFIrCvnL/UMwmL0GmidmrTmLNFNcd/P2DKY8iz6cow0mbx_2F/sbJGtbbd_2BGwyI_2Bxw0S/we1LziCYkQ0Cx/_2F0rJ9S/F5wpSAIpNSNFFpRxGE86
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.100.50.114 clean
https://outlook.office365.com/grower/HifhyQ_2FFA_/2BrB_2FLHP8/6XtvMolaVkbxNG/M87QW6j_2FP_2BvYHNtwk/wfNbuE8KybHLWY5O/SVLd6tAjqwt4I3O/CmoDOXGju5EqxmqADg/SZkchW1YF/eCs7OitMTPagVSYN1ln9/udSEMdxezj42VmEKleq/cmc_2BUQ6tbT7wSAKbXwcE/jF1hnY59qkPpk/JIwZneIZ/DEUHT_2
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 52.98.51.178 clean
https://outlook.office365.com/grower/LbPHPEF4_/2BZMDYmlyUUAIwzdjYlF/IsCiLt23gG2XX0dR8Mg/QIW4lE_2FuyJABPJiQy2_2/BxIjtj_2BJJr_/2BKFSEPm/uM39a7A3gSMfSIZBzC4TJ02/LsKoFEhJ1f/JG7niGi3Pi5y50kbt/gOVmuchXk4qS/sIRcFDw1CZ2/NDEIwheRVvw8JO/MALZOuQCTneqoYkZaMTB7/P_2BRC
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.100.50.114 clean
vuredosite.club
whois
DE M247 Ltd 37.120.222.6 clean
www.redtube.com
whois
US REFLECTED 66.254.114.238 clean
outlook.com
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 40.97.164.146 clean
www.outlook.com
whois
JP MICROSOFT-CORP-MSN-AS-BLOCK 52.98.89.34 clean
auredosite.club
whois
DE M247 Ltd 37.120.222.61 clean
outlook.office365.com
whois
JP MICROSOFT-CORP-MSN-AS-BLOCK 52.98.83.2 clean
40.100.49.210
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.100.49.210 clean
40.97.153.146
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 40.97.153.146 clean
52.98.51.178
whois
US MICROSOFT-CORP-MSN-AS-BLOCK 52.98.51.178 clean
37.120.222.61
whois
DE M247 Ltd 37.120.222.61 clean
40.100.50.114
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.100.50.114 clean
66.254.114.238
whois
US REFLECTED 66.254.114.238 clean
37.120.222.6
whois
DE M247 Ltd 37.120.222.6 clean
40.100.49.34
whois
KR MICROSOFT-CORP-MSN-AS-BLOCK 40.100.49.34 clean

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x1044018 CreateProcessA
 0x104401c GetSystemDirectoryA
 0x1044020 GetTempPathA
 0x1044024 GetWindowsDirectoryA
 0x1044028 GetCurrentDirectoryA
 0x104402c SetSystemPowerState
 0x1044030 SetConsoleCP
 0x1044034 SetConsoleOutputCP
 0x1044038 GetModuleHandleA
 0x104403c CreateFileW
 0x1044040 ReadConsoleW
 0x1044044 WriteConsoleW
 0x1044048 SetStdHandle
 0x104404c OutputDebugStringW
 0x1044050 LoadLibraryExW
 0x1044054 GetTimeZoneInformation
 0x1044058 GetModuleFileNameA
 0x104405c FormatMessageA
 0x1044060 GetSystemTimeAsFileTime
 0x1044064 GetProcessHeap
 0x1044068 VirtualProtect
 0x104406c WideCharToMultiByte
 0x1044070 MultiByteToWideChar
 0x1044074 GetStringTypeW
 0x1044078 EnterCriticalSection
 0x104407c LeaveCriticalSection
 0x1044080 DeleteCriticalSection
 0x1044084 EncodePointer
 0x1044088 DecodePointer
 0x104408c GetLastError
 0x1044090 HeapFree
 0x1044094 HeapAlloc
 0x1044098 RaiseException
 0x104409c RtlUnwind
 0x10440a0 GetCommandLineA
 0x10440a4 GetCurrentThreadId
 0x10440a8 GetCPInfo
 0x10440ac UnhandledExceptionFilter
 0x10440b0 SetUnhandledExceptionFilter
 0x10440b4 SetLastError
 0x10440b8 InitializeCriticalSectionAndSpinCount
 0x10440bc Sleep
 0x10440c0 GetCurrentProcess
 0x10440c4 TerminateProcess
 0x10440c8 TlsAlloc
 0x10440cc TlsGetValue
 0x10440d0 TlsSetValue
 0x10440d4 TlsFree
 0x10440d8 GetStartupInfoW
 0x10440dc GetModuleHandleW
 0x10440e0 GetProcAddress
 0x10440e4 IsProcessorFeaturePresent
 0x10440e8 GetDateFormatW
 0x10440ec GetTimeFormatW
 0x10440f0 CompareStringW
 0x10440f4 LCMapStringW
 0x10440f8 GetLocaleInfoW
 0x10440fc IsValidLocale
 0x1044100 GetUserDefaultLCID
 0x1044104 EnumSystemLocalesW
 0x1044108 ExitProcess
 0x104410c GetModuleHandleExW
 0x1044110 HeapSize
 0x1044114 GetStdHandle
 0x1044118 WriteFile
 0x104411c GetModuleFileNameW
 0x1044120 IsDebuggerPresent
 0x1044124 IsValidCodePage
 0x1044128 GetACP
 0x104412c GetOEMCP
 0x1044130 GetFileType
 0x1044134 QueryPerformanceCounter
 0x1044138 GetCurrentProcessId
 0x104413c GetEnvironmentStringsW
 0x1044140 FreeEnvironmentStringsW
 0x1044144 HeapReAlloc
 0x1044148 CloseHandle
 0x104414c FlushFileBuffers
 0x1044150 GetConsoleCP
 0x1044154 GetConsoleMode
 0x1044158 ReadFile
 0x104415c SetFilePointerEx
 0x1044160 SetEnvironmentVariableA
USER32.dll
 0x1044168 GetWindowThreadProcessId
 0x104416c GetSysColorBrush
 0x1044170 GetWindowRect
 0x1044174 GetClientRect
 0x1044178 GetForegroundWindow
 0x104417c CreatePopupMenu
 0x1044180 DialogBoxIndirectParamA
 0x1044184 CreateDialogIndirectParamA
GDI32.dll
 0x1044000 SetPixel
 0x1044004 SelectObject
 0x1044008 PatBlt
 0x104400c GetTextExtentPoint32A
 0x1044010 StretchBlt

EAT(Export Address Table) Library

0x1021070 Clockcondition
0x1021fa0 Dogwhen
0x1022080 Sing
0x1022270 Wholegray

Similarity measure (PE file only) - Checking for service failure