popup

Report - 7213.exe

Generic Malware Themida Packer Malicious Library Anti_VM ASPack Malicious Packer PE File OS Processor Check PE32 DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.08.24 12:37 Machine s1_win7_x6401
Filename 7213.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
AI Score Not founds Behavior Score
1.8
ZERO API file : clean
VT API (file)
md5 b293c3038385e59e5fe7d851b53dc76b
sha256 8b366eb1d6c2c558154131e350708add274315d91733f89a29d8306f53c4d09c
ssdeep 393216:YfVI3PkpFSHq5Gc2Rc1ljkXSgdqNzZi8KaNz4sAmF6qB/4Vq9QD11E/INYtX38zq:cVI/qk02sp0Sgdr5a5KrVq+RNzzCgi
imphash 9d1f0da408c33eebb70b9bfa17b7fddc
impfuzzy 48:nOIUhKfTfSXFSx+fcmX1n6L23dCGi2dtzZhm:nWhKfWXFSx+fcmX1nPtCGrdtzZhm
  Network IP location

Signature (5cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
info This executable has a PDB path

Rules (14cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning themida_packer themida packer binaries (download)
watch ASPack_Zero ASPack packed file binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x42b000 GetLastError
 0x42b004 SetLastError
 0x42b008 CloseHandle
 0x42b00c GetCurrentProcess
 0x42b010 CreateHardLinkW
 0x42b014 DeleteFileW
 0x42b018 RemoveDirectoryW
 0x42b01c DeviceIoControl
 0x42b020 CreateDirectoryW
 0x42b024 CreateFileW
 0x42b028 SetFileTime
 0x42b02c MoveFileW
 0x42b030 GetShortPathNameW
 0x42b034 GetLongPathNameW
 0x42b038 WriteFile
 0x42b03c GetStdHandle
 0x42b040 SetFilePointer
 0x42b044 SetEndOfFile
 0x42b048 FlushFileBuffers
 0x42b04c GetFileType
 0x42b050 ReadFile
 0x42b054 GetFileAttributesW
 0x42b058 SetFileAttributesW
 0x42b05c FindClose
 0x42b060 FindNextFileW
 0x42b064 FindFirstFileW
 0x42b068 GetVersionExW
 0x42b06c GetCurrentDirectoryW
 0x42b070 FoldStringW
 0x42b074 GetFullPathNameW
 0x42b078 GetModuleFileNameW
 0x42b07c FindResourceW
 0x42b080 GetModuleHandleW
 0x42b084 FreeLibrary
 0x42b088 GetProcAddress
 0x42b08c GetCurrentProcessId
 0x42b090 GetLocaleInfoW
 0x42b094 GetNumberFormatW
 0x42b098 SetEnvironmentVariableW
 0x42b09c ExpandEnvironmentStringsW
 0x42b0a0 WaitForSingleObject
 0x42b0a4 GetDateFormatW
 0x42b0a8 GetTimeFormatW
 0x42b0ac FileTimeToSystemTime
 0x42b0b0 FileTimeToLocalFileTime
 0x42b0b4 GetExitCodeProcess
 0x42b0b8 GetTempPathW
 0x42b0bc MoveFileExW
 0x42b0c0 UnmapViewOfFile
 0x42b0c4 Sleep
 0x42b0c8 MapViewOfFile
 0x42b0cc GetCommandLineW
 0x42b0d0 CreateFileMappingW
 0x42b0d4 GetTickCount
 0x42b0d8 GetLocalTime
 0x42b0dc OpenFileMappingW
 0x42b0e0 SetThreadExecutionState
 0x42b0e4 LoadLibraryW
 0x42b0e8 GetSystemDirectoryW
 0x42b0ec ExitProcess
 0x42b0f0 FreeConsole
 0x42b0f4 WriteConsoleW
 0x42b0f8 AttachConsole
 0x42b0fc AllocConsole
 0x42b100 InitializeCriticalSection
 0x42b104 DeleteCriticalSection
 0x42b108 EnterCriticalSection
 0x42b10c LeaveCriticalSection
 0x42b110 CreateThread
 0x42b114 GetProcessAffinityMask
 0x42b118 CreateEventW
 0x42b11c CreateSemaphoreW
 0x42b120 ReleaseSemaphore
 0x42b124 ResetEvent
 0x42b128 SetEvent
 0x42b12c SetThreadPriority
 0x42b130 SystemTimeToFileTime
 0x42b134 GetSystemTime
 0x42b138 SystemTimeToTzSpecificLocalTime
 0x42b13c TzSpecificLocalTimeToSystemTime
 0x42b140 LocalFileTimeToFileTime
 0x42b144 WideCharToMultiByte
 0x42b148 MultiByteToWideChar
 0x42b14c CompareStringW
 0x42b150 IsDBCSLeadByte
 0x42b154 GetCPInfo
 0x42b158 GlobalAlloc
 0x42b15c SetCurrentDirectoryW
 0x42b160 LocalAlloc
 0x42b164 InterlockedExchange
 0x42b168 LoadLibraryA
 0x42b16c RaiseException
 0x42b170 RtlUnwind
 0x42b174 HeapFree
 0x42b178 HeapReAlloc
 0x42b17c HeapAlloc
 0x42b180 GetSystemTimeAsFileTime
 0x42b184 GetCommandLineA
 0x42b188 GetStartupInfoA
 0x42b18c TlsGetValue
 0x42b190 TlsAlloc
 0x42b194 TlsSetValue
 0x42b198 TlsFree
 0x42b19c InterlockedIncrement
 0x42b1a0 GetCurrentThreadId
 0x42b1a4 InterlockedDecrement
 0x42b1a8 HeapCreate
 0x42b1ac VirtualFree
 0x42b1b0 VirtualAlloc
 0x42b1b4 TerminateProcess
 0x42b1b8 UnhandledExceptionFilter
 0x42b1bc SetUnhandledExceptionFilter
 0x42b1c0 IsDebuggerPresent
 0x42b1c4 HeapSize
 0x42b1c8 GetModuleFileNameA
 0x42b1cc GetACP
 0x42b1d0 GetOEMCP
 0x42b1d4 IsValidCodePage
 0x42b1d8 LCMapStringA
 0x42b1dc LCMapStringW
 0x42b1e0 GetModuleHandleA
 0x42b1e4 FreeEnvironmentStringsA
 0x42b1e8 GetEnvironmentStrings
 0x42b1ec FreeEnvironmentStringsW
 0x42b1f0 GetEnvironmentStringsW
 0x42b1f4 SetHandleCount
 0x42b1f8 QueryPerformanceCounter
 0x42b1fc InitializeCriticalSectionAndSpinCount
 0x42b200 GetConsoleCP
 0x42b204 GetConsoleMode
 0x42b208 GetStringTypeA
 0x42b20c GetStringTypeW
 0x42b210 GetLocaleInfoA
 0x42b214 SetStdHandle
 0x42b218 WriteConsoleA
 0x42b21c GetConsoleOutputCP
 0x42b220 CreateFileA

EAT(Export Address Table) Library


Similarity measure (PE file only) - Checking for service failure