Report - Vids.exe

Malicious Library PE File PE32 OS Processor Check
ScreenShot
Created 2021.09.07 19:08 Machine s1_win7_x6402
Filename Vids.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
2
Behavior Score
1.8
ZERO API file : malware
VT API (file) 23 detected (Stop, Unsafe, Save, malicious, confidence, 100%, ZexaF, PqW@a88LKHfO, Kryptik, Eldorado, Attribute, HighConfidence, Chapak, Emotet, Static AI, Malicious PE, Score, Sabsik, BScope, Generic@ML, RDML, wANwZJ7i69uYuxgjFwaqsw, WinGo, Ranumbot)
md5 09f9f48eea4e7bf45dc549f15e4d27e8
sha256 1a7791d5b04285493cd09bcffbcde55a71a3049e493bbe535d9e0b80966a7a61
ssdeep 12288:3AJkh+4pKQQRdipCd+hzcs8K9OINGXlHcSDnmThbbgfsFPsDao03JUj:wigSicsYkdDnGhIfQPQ0
imphash b9983337585a5531070ddcc78e55fc2d
impfuzzy 96:tLy4X1D0LXtd8B8Xlq+fcUt6EGJUccq4q:ZbFDkf8e1Hqr
  Network IP location

Signature (4cnts)

Level Description
warning File has been identified by 23 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x41e000 FileTimeToDosDateTime
 0x41e004 FindFirstChangeNotificationW
 0x41e008 lstrlenA
 0x41e00c CopyFileExW
 0x41e010 GetStringTypeA
 0x41e014 GetCPInfo
 0x41e018 InterlockedIncrement
 0x41e01c GetQueuedCompletionStatus
 0x41e020 ReadConsoleA
 0x41e024 CompareFileTime
 0x41e028 GlobalLock
 0x41e02c CancelWaitableTimer
 0x41e030 GetModuleHandleW
 0x41e034 GetCurrentThread
 0x41e038 GetSystemTimeAsFileTime
 0x41e03c WriteFile
 0x41e040 SetCommState
 0x41e044 GetCommandLineA
 0x41e048 GetPrivateProfileIntA
 0x41e04c LoadLibraryW
 0x41e050 CopyFileW
 0x41e054 GetSystemWindowsDirectoryA
 0x41e058 GetConsoleAliasExesLengthW
 0x41e05c GetVersionExW
 0x41e060 GlobalFlags
 0x41e064 IsProcessorFeaturePresent
 0x41e068 TerminateProcess
 0x41e06c SetThreadPriority
 0x41e070 GetStartupInfoW
 0x41e074 GetNamedPipeHandleStateW
 0x41e078 LCMapStringA
 0x41e07c GetPrivateProfileIntW
 0x41e080 CreateDirectoryA
 0x41e084 InterlockedExchange
 0x41e088 GetStartupInfoA
 0x41e08c SetThreadLocale
 0x41e090 GetLastError
 0x41e094 GetCurrentDirectoryW
 0x41e098 GetProcAddress
 0x41e09c SetFirmwareEnvironmentVariableW
 0x41e0a0 SearchPathA
 0x41e0a4 GetPrivateProfileStringA
 0x41e0a8 OpenWaitableTimerA
 0x41e0ac LoadLibraryA
 0x41e0b0 Process32FirstW
 0x41e0b4 LocalAlloc
 0x41e0b8 GetFileType
 0x41e0bc CreateFileMappingW
 0x41e0c0 SetCurrentDirectoryW
 0x41e0c4 SetThreadIdealProcessor
 0x41e0c8 HeapWalk
 0x41e0cc FindAtomA
 0x41e0d0 SetEnvironmentVariableA
 0x41e0d4 QueryMemoryResourceNotification
 0x41e0d8 FreeEnvironmentStringsW
 0x41e0dc EnumResourceNamesA
 0x41e0e0 RequestWakeupLatency
 0x41e0e4 GetCPInfoExA
 0x41e0e8 TlsAlloc
 0x41e0ec FindAtomW
 0x41e0f0 ReadConsoleOutputCharacterW
 0x41e0f4 GetSystemTime
 0x41e0f8 GetProfileSectionW
 0x41e0fc DeleteFileA
 0x41e100 CreateFileA
 0x41e104 InterlockedDecrement
 0x41e108 Sleep
 0x41e10c InitializeCriticalSection
 0x41e110 DeleteCriticalSection
 0x41e114 EnterCriticalSection
 0x41e118 LeaveCriticalSection
 0x41e11c MultiByteToWideChar
 0x41e120 UnhandledExceptionFilter
 0x41e124 SetUnhandledExceptionFilter
 0x41e128 GetModuleFileNameW
 0x41e12c HeapValidate
 0x41e130 IsBadReadPtr
 0x41e134 RaiseException
 0x41e138 RtlUnwind
 0x41e13c GetCurrentProcess
 0x41e140 IsDebuggerPresent
 0x41e144 GetACP
 0x41e148 GetOEMCP
 0x41e14c IsValidCodePage
 0x41e150 TlsGetValue
 0x41e154 TlsSetValue
 0x41e158 GetCurrentThreadId
 0x41e15c TlsFree
 0x41e160 SetLastError
 0x41e164 QueryPerformanceCounter
 0x41e168 GetTickCount
 0x41e16c GetCurrentProcessId
 0x41e170 ExitProcess
 0x41e174 GetEnvironmentStringsW
 0x41e178 GetCommandLineW
 0x41e17c SetHandleCount
 0x41e180 GetStdHandle
 0x41e184 HeapDestroy
 0x41e188 HeapCreate
 0x41e18c HeapFree
 0x41e190 VirtualFree
 0x41e194 GetModuleFileNameA
 0x41e198 FlushFileBuffers
 0x41e19c WideCharToMultiByte
 0x41e1a0 GetConsoleCP
 0x41e1a4 GetConsoleMode
 0x41e1a8 DebugBreak
 0x41e1ac OutputDebugStringA
 0x41e1b0 WriteConsoleW
 0x41e1b4 OutputDebugStringW
 0x41e1b8 HeapAlloc
 0x41e1bc HeapSize
 0x41e1c0 HeapReAlloc
 0x41e1c4 VirtualAlloc
 0x41e1c8 InitializeCriticalSectionAndSpinCount
 0x41e1cc LCMapStringW
 0x41e1d0 GetStringTypeW
 0x41e1d4 GetLocaleInfoA
 0x41e1d8 SetStdHandle
 0x41e1dc WriteConsoleA
 0x41e1e0 GetConsoleOutputCP
 0x41e1e4 SetFilePointer
 0x41e1e8 CloseHandle
USER32.dll
 0x41e1f8 GetComboBoxInfo
MSIMG32.dll
 0x41e1f0 TransparentBlt

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure