popup

Report - Reds.exe

UPX Malicious Library PE32 OS Processor Check PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.29 11:05 Machine s1_win7_x6401
Filename Reds.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
2.8
ZERO API file : malware
VT API (file) 30 detected (AIDetect, malware1, malicious, high confidence, Artemis, Unsafe, Save, None, ZexaF, uuW@auVKyQpG, Attribute, HighConfidence, Kryptik, HLWH, Fragtor, CLASSIC, Static AI, Malicious PE, susgen, ai score=80, kcloud, Caynamer, score, BScope, confidence, 100%, QVM10)
md5 74b6287a45b3fe5949ffa87f2019f1b2
sha256 fca68250f0af2ea4d2ae1747c92b89e67799cd41db4b6dfe8eed57cdcf1cb07b
ssdeep 6144:IgoKwTZewoSYKSChl1PDUZdQTixtkfJNmsalgCvmAq/4GFVoli8nBwb8X:iKwdewoSYKSChl1PYdQTic+sauCvmA+W
imphash 613f2e4a97d34083c947d866c86b0b7d
impfuzzy 48:MZzCFwOYoJdplhwW4pMYsFOWKaE8fcRhV85oceLXk7BY:MZyLplaVXSbE8fcRhV85leLXkO
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Tries to unhook Windows functions monitored by Cuckoo
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x421000 GetComputerNameA
 0x421004 UnregisterWait
 0x421008 SetFilePointer
 0x42100c lstrlenA
 0x421010 GetConsoleAliasesLengthW
 0x421014 CopyFileExW
 0x421018 TlsGetValue
 0x42101c GetConsoleAliasExesLengthA
 0x421020 MapUserPhysicalPages
 0x421024 InterlockedIncrement
 0x421028 VerSetConditionMask
 0x42102c InterlockedDecrement
 0x421030 ZombifyActCtx
 0x421034 CompareFileTime
 0x421038 GetSystemWindowsDirectoryW
 0x42103c SetEnvironmentVariableW
 0x421040 GlobalLock
 0x421044 WriteConsoleInputA
 0x421048 FreeEnvironmentStringsA
 0x42104c CreateNamedPipeW
 0x421050 VirtualFree
 0x421054 GenerateConsoleCtrlEvent
 0x421058 GetConsoleAliasExesW
 0x42105c WriteFile
 0x421060 SetCommState
 0x421064 SetProcessPriorityBoost
 0x421068 FindResourceExA
 0x42106c LoadLibraryW
 0x421070 GetCalendarInfoA
 0x421074 GetVersionExW
 0x421078 InitAtomTable
 0x42107c GlobalFlags
 0x421080 GetComputerNameExA
 0x421084 GetConsoleAliasW
 0x421088 SetConsoleCursorPosition
 0x42108c GetBinaryTypeW
 0x421090 VirtualUnlock
 0x421094 InterlockedExchange
 0x421098 GetFileSizeEx
 0x42109c SetCurrentDirectoryA
 0x4210a0 GetStartupInfoA
 0x4210a4 GetCPInfoExW
 0x4210a8 FreeLibraryAndExitThread
 0x4210ac GetCurrentDirectoryW
 0x4210b0 ReadConsoleOutputCharacterA
 0x4210b4 GetProcAddress
 0x4210b8 SetFirmwareEnvironmentVariableW
 0x4210bc ReadFileEx
 0x4210c0 SetStdHandle
 0x4210c4 SetComputerNameA
 0x4210c8 GetLocalTime
 0x4210cc LoadLibraryA
 0x4210d0 OpenMutexA
 0x4210d4 CreateSemaphoreW
 0x4210d8 LocalAlloc
 0x4210dc WriteProfileSectionW
 0x4210e0 FindAtomA
 0x4210e4 SetSystemTime
 0x4210e8 CreateIoCompletionPort
 0x4210ec SetConsoleTitleW
 0x4210f0 EnumResourceNamesA
 0x4210f4 WriteProfileStringW
 0x4210f8 BuildCommDCBA
 0x4210fc CompareStringA
 0x421100 GetFileAttributesExW
 0x421104 GetConsoleCursorInfo
 0x421108 GetCPInfoExA
 0x42110c _lopen
 0x421110 FindAtomW
 0x421114 GetVolumeNameForVolumeMountPointW
 0x421118 GetProfileSectionW
 0x42111c AreFileApisANSI
 0x421120 CommConfigDialogW
 0x421124 DeleteFileA
 0x421128 FlushFileBuffers
 0x42112c GetLastError
 0x421130 MoveFileA
 0x421134 GetCommandLineA
 0x421138 HeapValidate
 0x42113c IsBadReadPtr
 0x421140 RaiseException
 0x421144 DeleteCriticalSection
 0x421148 EnterCriticalSection
 0x42114c LeaveCriticalSection
 0x421150 GetModuleFileNameW
 0x421154 SetUnhandledExceptionFilter
 0x421158 QueryPerformanceCounter
 0x42115c GetTickCount
 0x421160 GetCurrentThreadId
 0x421164 GetCurrentProcessId
 0x421168 GetSystemTimeAsFileTime
 0x42116c GetModuleHandleW
 0x421170 Sleep
 0x421174 ExitProcess
 0x421178 GetModuleFileNameA
 0x42117c GetEnvironmentStrings
 0x421180 FreeEnvironmentStringsW
 0x421184 WideCharToMultiByte
 0x421188 GetEnvironmentStringsW
 0x42118c SetHandleCount
 0x421190 GetStdHandle
 0x421194 GetFileType
 0x421198 TlsAlloc
 0x42119c TlsSetValue
 0x4211a0 TlsFree
 0x4211a4 SetLastError
 0x4211a8 HeapDestroy
 0x4211ac HeapCreate
 0x4211b0 HeapFree
 0x4211b4 HeapAlloc
 0x4211b8 TerminateProcess
 0x4211bc GetCurrentProcess
 0x4211c0 UnhandledExceptionFilter
 0x4211c4 IsDebuggerPresent
 0x4211c8 HeapSize
 0x4211cc HeapReAlloc
 0x4211d0 VirtualAlloc
 0x4211d4 GetACP
 0x4211d8 GetOEMCP
 0x4211dc GetCPInfo
 0x4211e0 IsValidCodePage
 0x4211e4 RtlUnwind
 0x4211e8 InitializeCriticalSectionAndSpinCount
 0x4211ec DebugBreak
 0x4211f0 OutputDebugStringA
 0x4211f4 WriteConsoleW
 0x4211f8 OutputDebugStringW
 0x4211fc MultiByteToWideChar
 0x421200 LCMapStringA
 0x421204 LCMapStringW
 0x421208 GetStringTypeA
 0x42120c GetStringTypeW
 0x421210 GetLocaleInfoA
 0x421214 GetConsoleCP
 0x421218 GetConsoleMode
 0x42121c WriteConsoleA
 0x421220 GetConsoleOutputCP
 0x421224 CreateFileA
 0x421228 CloseHandle
 0x42122c GetModuleHandleA
USER32.dll
 0x421234 GetMessageTime
 0x421238 GetMenuInfo

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure