Report - credit.exe

Admin Tool (Sysinternals etc ...) Malicious Library PE File PE32
ScreenShot
Created 2021.08.23 12:11 Machine s1_win7_x6402
Filename credit.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
3.4
ZERO API file : malware
VT API (file) 34 detected (Malicious, high confidence, score, Unsafe, Fareit, confidence, Attribute, HighConfidence, GenKryptik, FJHZ, GenericKD, DownLoader41, FCVN, kcloud, Phonzy, R002H06HK21, Static AI, Suspicious PE, FIVH, ZelphiCO, 4GX@a0xg3Kpi)
md5 4338aca68fbaab846ec6345a7b85c15c
sha256 11f6a46954cdec78fec52771521926ff6917af81f79e3dc1198a38571b7d7519
ssdeep 12288:8GBapj1mg3ShbnM19hbLgBN0gj6rIU4zcSo6nVwxZzrSYf3ifItMI5WF9:8GUmgShbnM19hlw3HpyVfTt/5e
imphash eab6b00b3a7206039f5a8a9c3fe64584
impfuzzy 192:n3PeUxk13omkbuuArSUvK9YqoaqEKe72POQsK:n3vy1CAA9eFPOQj
  Network IP location

Signature (8cnts)

Level Description
danger File has been identified by 34 AntiVirus engines on VirusTotal as malicious
watch Network activity contains more than one unique useragent
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Performs some HTTP requests
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
watch Admin_Tool_IN_Zero Admin Tool Sysinternals binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1629687681&rver=7.3.6962.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fonedrive.live.com%2Fdownload%3Fcid%3DD6676A9A61E841F3%26resid%3DD6676A9A61E841F3%2521129%26authkey%3DALgOfs5uX8ML6NU&lc=1033&id=2502 KR MICROSOFT-CORP-MSN-AS-BLOCK 40.126.52.1 clean
https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21129&authkey=ALgOfs5uX8ML6NU US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 clean
login.live.com SG MICROSOFT-CORP-MSN-AS-BLOCK 40.126.35.129 clean
onedrive.live.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
40.126.52.1 KR MICROSOFT-CORP-MSN-AS-BLOCK 40.126.52.1 clean

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4a2168 DeleteCriticalSection
 0x4a216c LeaveCriticalSection
 0x4a2170 EnterCriticalSection
 0x4a2174 InitializeCriticalSection
 0x4a2178 VirtualFree
 0x4a217c VirtualAlloc
 0x4a2180 LocalFree
 0x4a2184 LocalAlloc
 0x4a2188 GetVersion
 0x4a218c GetCurrentThreadId
 0x4a2190 InterlockedDecrement
 0x4a2194 InterlockedIncrement
 0x4a2198 VirtualQuery
 0x4a219c WideCharToMultiByte
 0x4a21a0 SetCurrentDirectoryA
 0x4a21a4 MultiByteToWideChar
 0x4a21a8 lstrlenA
 0x4a21ac lstrcpynA
 0x4a21b0 LoadLibraryExA
 0x4a21b4 GetThreadLocale
 0x4a21b8 GetStartupInfoA
 0x4a21bc GetProcAddress
 0x4a21c0 GetModuleHandleA
 0x4a21c4 GetModuleFileNameA
 0x4a21c8 GetLocaleInfoA
 0x4a21cc GetLastError
 0x4a21d0 GetCurrentDirectoryA
 0x4a21d4 GetCommandLineA
 0x4a21d8 FreeLibrary
 0x4a21dc FindFirstFileA
 0x4a21e0 FindClose
 0x4a21e4 ExitProcess
 0x4a21e8 WriteFile
 0x4a21ec UnhandledExceptionFilter
 0x4a21f0 RtlUnwind
 0x4a21f4 RaiseException
 0x4a21f8 GetStdHandle
user32.dll
 0x4a2200 GetKeyboardType
 0x4a2204 LoadStringA
 0x4a2208 MessageBoxA
 0x4a220c CharNextA
advapi32.dll
 0x4a2214 RegQueryValueExA
 0x4a2218 RegOpenKeyExA
 0x4a221c RegCloseKey
oleaut32.dll
 0x4a2224 SysFreeString
 0x4a2228 SysReAllocStringLen
 0x4a222c SysAllocStringLen
kernel32.dll
 0x4a2234 TlsSetValue
 0x4a2238 TlsGetValue
 0x4a223c LocalAlloc
 0x4a2240 GetModuleHandleA
advapi32.dll
 0x4a2248 RegQueryValueExA
 0x4a224c RegOpenKeyExA
 0x4a2250 RegCloseKey
kernel32.dll
 0x4a2258 lstrcpyA
 0x4a225c lstrcmpiA
 0x4a2260 WriteFile
 0x4a2264 WaitForSingleObject
 0x4a2268 VirtualQuery
 0x4a226c VirtualProtect
 0x4a2270 VirtualAlloc
 0x4a2274 Sleep
 0x4a2278 SizeofResource
 0x4a227c SetThreadLocale
 0x4a2280 SetFilePointer
 0x4a2284 SetEvent
 0x4a2288 SetErrorMode
 0x4a228c SetEndOfFile
 0x4a2290 ResetEvent
 0x4a2294 ReadFile
 0x4a2298 MultiByteToWideChar
 0x4a229c MulDiv
 0x4a22a0 LockResource
 0x4a22a4 LoadResource
 0x4a22a8 LoadLibraryA
 0x4a22ac LeaveCriticalSection
 0x4a22b0 InitializeCriticalSection
 0x4a22b4 GlobalUnlock
 0x4a22b8 GlobalSize
 0x4a22bc GlobalReAlloc
 0x4a22c0 GlobalHandle
 0x4a22c4 GlobalLock
 0x4a22c8 GlobalFree
 0x4a22cc GlobalFindAtomA
 0x4a22d0 GlobalDeleteAtom
 0x4a22d4 GlobalAlloc
 0x4a22d8 GlobalAddAtomA
 0x4a22dc GetVolumeInformationA
 0x4a22e0 GetVersionExA
 0x4a22e4 GetVersion
 0x4a22e8 GetUserDefaultLCID
 0x4a22ec GetTickCount
 0x4a22f0 GetThreadLocale
 0x4a22f4 GetSystemInfo
 0x4a22f8 GetStringTypeExA
 0x4a22fc GetStdHandle
 0x4a2300 GetProcAddress
 0x4a2304 GetModuleHandleA
 0x4a2308 GetModuleFileNameA
 0x4a230c GetLogicalDrives
 0x4a2310 GetLocaleInfoA
 0x4a2314 GetLocalTime
 0x4a2318 GetLastError
 0x4a231c GetFullPathNameA
 0x4a2320 GetFileAttributesA
 0x4a2324 GetDriveTypeA
 0x4a2328 GetDiskFreeSpaceA
 0x4a232c GetDateFormatA
 0x4a2330 GetCurrentThreadId
 0x4a2334 GetCurrentProcessId
 0x4a2338 GetCPInfo
 0x4a233c GetACP
 0x4a2340 FreeResource
 0x4a2344 InterlockedExchange
 0x4a2348 FreeLibrary
 0x4a234c FormatMessageA
 0x4a2350 FindResourceA
 0x4a2354 FindNextFileA
 0x4a2358 FindFirstFileA
 0x4a235c FindClose
 0x4a2360 FileTimeToLocalFileTime
 0x4a2364 FileTimeToDosDateTime
 0x4a2368 EnumCalendarInfoA
 0x4a236c EnterCriticalSection
 0x4a2370 DeleteCriticalSection
 0x4a2374 CreateThread
 0x4a2378 CreateFileA
 0x4a237c CreateEventA
 0x4a2380 CompareStringA
 0x4a2384 CloseHandle
mpr.dll
 0x4a238c WNetGetConnectionA
version.dll
 0x4a2394 VerQueryValueA
 0x4a2398 GetFileVersionInfoSizeA
 0x4a239c GetFileVersionInfoA
gdi32.dll
 0x4a23a4 UnrealizeObject
 0x4a23a8 StretchBlt
 0x4a23ac SetWindowOrgEx
 0x4a23b0 SetWinMetaFileBits
 0x4a23b4 SetViewportOrgEx
 0x4a23b8 SetTextColor
 0x4a23bc SetStretchBltMode
 0x4a23c0 SetROP2
 0x4a23c4 SetPixel
 0x4a23c8 SetEnhMetaFileBits
 0x4a23cc SetDIBColorTable
 0x4a23d0 SetBrushOrgEx
 0x4a23d4 SetBkMode
 0x4a23d8 SetBkColor
 0x4a23dc SelectPalette
 0x4a23e0 SelectObject
 0x4a23e4 SaveDC
 0x4a23e8 RestoreDC
 0x4a23ec Rectangle
 0x4a23f0 RectVisible
 0x4a23f4 RealizePalette
 0x4a23f8 Polyline
 0x4a23fc PlayEnhMetaFile
 0x4a2400 PatBlt
 0x4a2404 MoveToEx
 0x4a2408 MaskBlt
 0x4a240c LineTo
 0x4a2410 IntersectClipRect
 0x4a2414 GetWindowOrgEx
 0x4a2418 GetWinMetaFileBits
 0x4a241c GetTextMetricsA
 0x4a2420 GetTextExtentPoint32A
 0x4a2424 GetSystemPaletteEntries
 0x4a2428 GetStockObject
 0x4a242c GetPixel
 0x4a2430 GetPaletteEntries
 0x4a2434 GetObjectA
 0x4a2438 GetEnhMetaFilePaletteEntries
 0x4a243c GetEnhMetaFileHeader
 0x4a2440 GetEnhMetaFileDescriptionA
 0x4a2444 GetEnhMetaFileBits
 0x4a2448 GetDeviceCaps
 0x4a244c GetDIBits
 0x4a2450 GetDIBColorTable
 0x4a2454 GetDCOrgEx
 0x4a2458 GetCurrentPositionEx
 0x4a245c GetClipBox
 0x4a2460 GetBrushOrgEx
 0x4a2464 GetBitmapBits
 0x4a2468 GdiFlush
 0x4a246c ExtTextOutA
 0x4a2470 ExcludeClipRect
 0x4a2474 DeleteObject
 0x4a2478 DeleteEnhMetaFile
 0x4a247c DeleteDC
 0x4a2480 CreateSolidBrush
 0x4a2484 CreatePenIndirect
 0x4a2488 CreatePalette
 0x4a248c CreateHalftonePalette
 0x4a2490 CreateFontIndirectA
 0x4a2494 CreateEnhMetaFileA
 0x4a2498 CreateDIBitmap
 0x4a249c CreateDIBSection
 0x4a24a0 CreateCompatibleDC
 0x4a24a4 CreateCompatibleBitmap
 0x4a24a8 CreateBrushIndirect
 0x4a24ac CreateBitmap
 0x4a24b0 CopyEnhMetaFileA
 0x4a24b4 CloseEnhMetaFile
 0x4a24b8 BitBlt
user32.dll
 0x4a24c0 CreateWindowExA
 0x4a24c4 WindowFromPoint
 0x4a24c8 WinHelpA
 0x4a24cc WaitMessage
 0x4a24d0 UpdateWindow
 0x4a24d4 UnregisterClassA
 0x4a24d8 UnhookWindowsHookEx
 0x4a24dc TranslateMessage
 0x4a24e0 TranslateMDISysAccel
 0x4a24e4 TrackPopupMenu
 0x4a24e8 SystemParametersInfoA
 0x4a24ec ShowWindow
 0x4a24f0 ShowScrollBar
 0x4a24f4 ShowOwnedPopups
 0x4a24f8 ShowCursor
 0x4a24fc SetWindowsHookExA
 0x4a2500 SetWindowTextA
 0x4a2504 SetWindowPos
 0x4a2508 SetWindowPlacement
 0x4a250c SetWindowLongA
 0x4a2510 SetTimer
 0x4a2514 SetScrollRange
 0x4a2518 SetScrollPos
 0x4a251c SetScrollInfo
 0x4a2520 SetRect
 0x4a2524 SetPropA
 0x4a2528 SetParent
 0x4a252c SetMenuItemInfoA
 0x4a2530 SetMenu
 0x4a2534 SetForegroundWindow
 0x4a2538 SetFocus
 0x4a253c SetCursor
 0x4a2540 SetClassLongA
 0x4a2544 SetCapture
 0x4a2548 SetActiveWindow
 0x4a254c SendMessageA
 0x4a2550 ScrollWindow
 0x4a2554 ScreenToClient
 0x4a2558 RemovePropA
 0x4a255c RemoveMenu
 0x4a2560 ReleaseDC
 0x4a2564 ReleaseCapture
 0x4a2568 RegisterWindowMessageA
 0x4a256c RegisterClipboardFormatA
 0x4a2570 RegisterClassA
 0x4a2574 RedrawWindow
 0x4a2578 PtInRect
 0x4a257c PostQuitMessage
 0x4a2580 PostMessageA
 0x4a2584 PeekMessageA
 0x4a2588 OffsetRect
 0x4a258c OemToCharA
 0x4a2590 MessageBoxA
 0x4a2594 MessageBeep
 0x4a2598 MapWindowPoints
 0x4a259c MapVirtualKeyA
 0x4a25a0 LoadStringA
 0x4a25a4 LoadKeyboardLayoutA
 0x4a25a8 LoadIconA
 0x4a25ac LoadCursorA
 0x4a25b0 LoadBitmapA
 0x4a25b4 KillTimer
 0x4a25b8 IsZoomed
 0x4a25bc IsWindowVisible
 0x4a25c0 IsWindowEnabled
 0x4a25c4 IsWindow
 0x4a25c8 IsRectEmpty
 0x4a25cc IsIconic
 0x4a25d0 IsDialogMessageA
 0x4a25d4 IsChild
 0x4a25d8 InvalidateRect
 0x4a25dc IntersectRect
 0x4a25e0 InsertMenuItemA
 0x4a25e4 InsertMenuA
 0x4a25e8 InflateRect
 0x4a25ec GetWindowThreadProcessId
 0x4a25f0 GetWindowTextA
 0x4a25f4 GetWindowRect
 0x4a25f8 GetWindowPlacement
 0x4a25fc GetWindowLongA
 0x4a2600 GetWindowDC
 0x4a2604 GetTopWindow
 0x4a2608 GetSystemMetrics
 0x4a260c GetSystemMenu
 0x4a2610 GetSysColorBrush
 0x4a2614 GetSysColor
 0x4a2618 GetSubMenu
 0x4a261c GetScrollRange
 0x4a2620 GetScrollPos
 0x4a2624 GetScrollInfo
 0x4a2628 GetPropA
 0x4a262c GetParent
 0x4a2630 GetWindow
 0x4a2634 GetMessageTime
 0x4a2638 GetMenuStringA
 0x4a263c GetMenuState
 0x4a2640 GetMenuItemInfoA
 0x4a2644 GetMenuItemID
 0x4a2648 GetMenuItemCount
 0x4a264c GetMenu
 0x4a2650 GetLastActivePopup
 0x4a2654 GetKeyboardState
 0x4a2658 GetKeyboardLayoutList
 0x4a265c GetKeyboardLayout
 0x4a2660 GetKeyState
 0x4a2664 GetKeyNameTextA
 0x4a2668 GetIconInfo
 0x4a266c GetForegroundWindow
 0x4a2670 GetFocus
 0x4a2674 GetDesktopWindow
 0x4a2678 GetDCEx
 0x4a267c GetDC
 0x4a2680 GetCursorPos
 0x4a2684 GetCursor
 0x4a2688 GetClipboardData
 0x4a268c GetClientRect
 0x4a2690 GetClassNameA
 0x4a2694 GetClassInfoA
 0x4a2698 GetCapture
 0x4a269c GetActiveWindow
 0x4a26a0 FrameRect
 0x4a26a4 FindWindowA
 0x4a26a8 FillRect
 0x4a26ac EqualRect
 0x4a26b0 EnumWindows
 0x4a26b4 EnumThreadWindows
 0x4a26b8 EndPaint
 0x4a26bc EnableWindow
 0x4a26c0 EnableScrollBar
 0x4a26c4 EnableMenuItem
 0x4a26c8 DrawTextA
 0x4a26cc DrawMenuBar
 0x4a26d0 DrawIconEx
 0x4a26d4 DrawIcon
 0x4a26d8 DrawFrameControl
 0x4a26dc DrawFocusRect
 0x4a26e0 DrawEdge
 0x4a26e4 DispatchMessageA
 0x4a26e8 DestroyWindow
 0x4a26ec DestroyMenu
 0x4a26f0 DestroyIcon
 0x4a26f4 DestroyCursor
 0x4a26f8 DeleteMenu
 0x4a26fc DefWindowProcA
 0x4a2700 DefMDIChildProcA
 0x4a2704 DefFrameProcA
 0x4a2708 CreatePopupMenu
 0x4a270c CreateMenu
 0x4a2710 CreateIcon
 0x4a2714 ClientToScreen
 0x4a2718 CheckMenuItem
 0x4a271c CallWindowProcA
 0x4a2720 CallNextHookEx
 0x4a2724 BeginPaint
 0x4a2728 CharNextA
 0x4a272c CharLowerBuffA
 0x4a2730 CharLowerA
 0x4a2734 CharUpperBuffA
 0x4a2738 CharToOemA
 0x4a273c AdjustWindowRectEx
 0x4a2740 ActivateKeyboardLayout
kernel32.dll
 0x4a2748 Sleep
oleaut32.dll
 0x4a2750 SafeArrayPtrOfIndex
 0x4a2754 SafeArrayGetUBound
 0x4a2758 SafeArrayGetLBound
 0x4a275c SafeArrayCreate
 0x4a2760 VariantChangeType
 0x4a2764 VariantCopy
 0x4a2768 VariantClear
 0x4a276c VariantInit
ole32.dll
 0x4a2774 CreateStreamOnHGlobal
 0x4a2778 IsAccelerator
 0x4a277c OleDraw
 0x4a2780 OleSetMenuDescriptor
 0x4a2784 OleUninitialize
 0x4a2788 OleInitialize
 0x4a278c CoCreateInstance
 0x4a2790 CoGetClassObject
 0x4a2794 CoUninitialize
 0x4a2798 CoInitialize
 0x4a279c IsEqualGUID
oleaut32.dll
 0x4a27a4 GetErrorInfo
 0x4a27a8 SysFreeString
comctl32.dll
 0x4a27b0 ImageList_SetIconSize
 0x4a27b4 ImageList_GetIconSize
 0x4a27b8 ImageList_Write
 0x4a27bc ImageList_Read
 0x4a27c0 ImageList_GetDragImage
 0x4a27c4 ImageList_DragShowNolock
 0x4a27c8 ImageList_SetDragCursorImage
 0x4a27cc ImageList_DragMove
 0x4a27d0 ImageList_DragLeave
 0x4a27d4 ImageList_DragEnter
 0x4a27d8 ImageList_EndDrag
 0x4a27dc ImageList_BeginDrag
 0x4a27e0 ImageList_Remove
 0x4a27e4 ImageList_DrawEx
 0x4a27e8 ImageList_Replace
 0x4a27ec ImageList_Draw
 0x4a27f0 ImageList_GetBkColor
 0x4a27f4 ImageList_SetBkColor
 0x4a27f8 ImageList_ReplaceIcon
 0x4a27fc ImageList_Add
 0x4a2800 ImageList_SetImageCount
 0x4a2804 ImageList_GetImageCount
 0x4a2808 ImageList_Destroy
 0x4a280c ImageList_Create
shell32.dll
 0x4a2814 SHGetSpecialFolderLocation
 0x4a2818 SHGetMalloc
 0x4a281c SHGetDesktopFolder

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure