popup

Report - toolspab1.exe

UPX Malicious Library PE32 OS Processor Check PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.25 12:08 Machine s1_win7_x6402
Filename toolspab1.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
2.8
ZERO API file : clean
VT API (file) 26 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, confidence, 100%, Attribute, HighConfidence, Mokes, Kryptik, CLASSIC, A + Troj, Azorult, Score, Artemis, BScope, Static AI, Malicious PE, susgen, ZexaF, tuW@aW, gkmcG, QVM10)
md5 66599922c76c5fba265f7a0a9d544dff
sha256 b898d01b3d8f40436dacd14388774a2a9a578f90635890bcce6f711d648bd443
ssdeep 6144:yviOHyACKskrgdk4i8GNoiSEB6c/WcHNyTwU7WnnkZdn15:eHLCKzUdk4imi7jWQY8hnO
imphash df9f8478a5324ab8dd6d2dd50515fa50
impfuzzy 48:sAteXO5YerVnciEp0tOCKaEZtn6c+JUXBr/E2Gg:sRehrxch0t7EZtn6c+JURr/EO
  Network IP location

Signature (7cnts)

Level Description
warning File has been identified by 26 AntiVirus engines on VirusTotal as malicious
watch Tries to unhook Windows functions monitored by Cuckoo
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x42a000 GetFileSize
 0x42a004 GlobalDeleteAtom
 0x42a008 SetFilePointer
 0x42a00c lstrlenA
 0x42a010 CopyFileExW
 0x42a014 SetLocalTime
 0x42a018 CommConfigDialogA
 0x42a01c MapUserPhysicalPages
 0x42a020 FreeLibrary
 0x42a024 InterlockedIncrement
 0x42a028 GetCommState
 0x42a02c InterlockedDecrement
 0x42a030 ZombifyActCtx
 0x42a034 SetFirmwareEnvironmentVariableA
 0x42a038 GetSystemWindowsDirectoryW
 0x42a03c GlobalLock
 0x42a040 GetComputerNameW
 0x42a044 CreateDirectoryExA
 0x42a048 FreeEnvironmentStringsA
 0x42a04c GetProcessPriorityBoost
 0x42a050 GetTickCount
 0x42a054 GetCommConfig
 0x42a058 GetConsoleAliasesLengthA
 0x42a05c GetWindowsDirectoryA
 0x42a060 GetConsoleAliasExesW
 0x42a064 WriteFile
 0x42a068 FindActCtxSectionStringA
 0x42a06c TlsSetValue
 0x42a070 GlobalAlloc
 0x42a074 GetSystemDirectoryW
 0x42a078 VirtualFreeEx
 0x42a07c LoadLibraryW
 0x42a080 GetConsoleMode
 0x42a084 _hread
 0x42a088 GetSystemWow64DirectoryW
 0x42a08c SetSystemTimeAdjustment
 0x42a090 GlobalFlags
 0x42a094 GetBinaryTypeA
 0x42a098 GetAtomNameW
 0x42a09c ReadFile
 0x42a0a0 ExitThread
 0x42a0a4 SetConsoleTitleA
 0x42a0a8 VirtualUnlock
 0x42a0ac DeactivateActCtx
 0x42a0b0 GetNamedPipeHandleStateW
 0x42a0b4 ReleaseActCtx
 0x42a0b8 GetStartupInfoA
 0x42a0bc GetCPInfoExW
 0x42a0c0 GetCurrentDirectoryW
 0x42a0c4 ReadConsoleOutputCharacterA
 0x42a0c8 GetProcAddress
 0x42a0cc GetProcessHeaps
 0x42a0d0 GetComputerNameExW
 0x42a0d4 CreateNamedPipeA
 0x42a0d8 SetStdHandle
 0x42a0dc SetComputerNameA
 0x42a0e0 VerLanguageNameW
 0x42a0e4 LoadLibraryA
 0x42a0e8 Process32FirstW
 0x42a0ec CreateSemaphoreW
 0x42a0f0 SetCalendarInfoW
 0x42a0f4 SetConsoleCtrlHandler
 0x42a0f8 SetCurrentDirectoryW
 0x42a0fc WriteProfileSectionW
 0x42a100 SetConsoleWindowInfo
 0x42a104 FindAtomA
 0x42a108 Process32NextW
 0x42a10c QueryMemoryResourceNotification
 0x42a110 WriteProfileStringW
 0x42a114 BuildCommDCBA
 0x42a118 VirtualProtect
 0x42a11c CompareStringA
 0x42a120 GetFileAttributesExW
 0x42a124 _lopen
 0x42a128 TlsAlloc
 0x42a12c GetVolumeNameForVolumeMountPointW
 0x42a130 GetCurrentProcessId
 0x42a134 GetProfileSectionW
 0x42a138 LCMapStringW
 0x42a13c DeleteFileA
 0x42a140 GetLastError
 0x42a144 WideCharToMultiByte
 0x42a148 GetCommandLineA
 0x42a14c HeapValidate
 0x42a150 IsBadReadPtr
 0x42a154 RaiseException
 0x42a158 TerminateProcess
 0x42a15c GetCurrentProcess
 0x42a160 UnhandledExceptionFilter
 0x42a164 SetUnhandledExceptionFilter
 0x42a168 IsDebuggerPresent
 0x42a16c GetModuleFileNameW
 0x42a170 GetACP
 0x42a174 GetOEMCP
 0x42a178 GetCPInfo
 0x42a17c IsValidCodePage
 0x42a180 TlsGetValue
 0x42a184 GetModuleHandleW
 0x42a188 GetCurrentThreadId
 0x42a18c TlsFree
 0x42a190 SetLastError
 0x42a194 EnterCriticalSection
 0x42a198 LeaveCriticalSection
 0x42a19c DeleteCriticalSection
 0x42a1a0 QueryPerformanceCounter
 0x42a1a4 GetSystemTimeAsFileTime
 0x42a1a8 Sleep
 0x42a1ac ExitProcess
 0x42a1b0 GetModuleFileNameA
 0x42a1b4 GetEnvironmentStrings
 0x42a1b8 FreeEnvironmentStringsW
 0x42a1bc GetEnvironmentStringsW
 0x42a1c0 SetHandleCount
 0x42a1c4 GetStdHandle
 0x42a1c8 GetFileType
 0x42a1cc HeapDestroy
 0x42a1d0 HeapCreate
 0x42a1d4 HeapFree
 0x42a1d8 VirtualFree
 0x42a1dc HeapAlloc
 0x42a1e0 HeapSize
 0x42a1e4 HeapReAlloc
 0x42a1e8 VirtualAlloc
 0x42a1ec DebugBreak
 0x42a1f0 OutputDebugStringA
 0x42a1f4 WriteConsoleW
 0x42a1f8 OutputDebugStringW
 0x42a1fc RtlUnwind
 0x42a200 MultiByteToWideChar
 0x42a204 LCMapStringA
 0x42a208 GetStringTypeA
 0x42a20c GetStringTypeW
 0x42a210 GetLocaleInfoA
 0x42a214 GetConsoleCP
 0x42a218 InitializeCriticalSectionAndSpinCount
 0x42a21c FlushFileBuffers
 0x42a220 WriteConsoleA
 0x42a224 GetConsoleOutputCP
 0x42a228 CloseHandle
 0x42a22c CreateFileA
 0x42a230 GetModuleHandleA
USER32.dll
 0x42a238 GetMenuInfo
 0x42a23c GetListBoxInfo

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure