popup

Report - clip.exe

Malicious Library PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.09.09 09:55 Machine s1_win7_x6401
Filename clip.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
2
 Behavior Score
1.8
ZERO API file : malware
VT API (file) 21 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, confidence, 100%, ZexaF, rqW@a06WqefO, Kryptik, Eldorado, Convagent, Static AI, Suspicious PE, Sabsik, score, Generic@ML, RDML, X0+zDvf, MAF5HoyZ2O4rHw, Glupteba, susgen)
md5 cbdd7e3ccea8e6cfae0dddf8fe6f6599
sha256 349d8acfa7f788d6c886016688df9857ee7a915f7690871231c8ca39a5bf2948
ssdeep 6144:SU34+HN5h87kcCYjPKs16qiAi6DyHhBkMmvsg:j4+H7h87kcCYjFIT6DEg
imphash 96b0c0b056f44468723aefb84fe936ee
impfuzzy 48:CQo60OYs5X1uv50IdJSFzMKaEBcltgnPS7wbr0NvB:loILX1uvSIdJMzwEBcltgnPS7kr0D
  Network IP location

Signature (4cnts)

Level Description
warning File has been identified by 21 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x421000 GetCommandLineW
 0x421004 FileTimeToDosDateTime
 0x421008 FindFirstChangeNotificationW
 0x42100c lstrlenA
 0x421010 CopyFileExW
 0x421014 SetLocalTime
 0x421018 GetCPInfo
 0x42101c GetConsoleAliasExesLengthA
 0x421020 HeapAlloc
 0x421024 ReadConsoleA
 0x421028 InterlockedDecrement
 0x42102c GlobalSize
 0x421030 GetSystemWindowsDirectoryW
 0x421034 GetNamedPipeHandleStateA
 0x421038 CreateDirectoryW
 0x42103c GlobalLock
 0x421040 GetModuleHandleW
 0x421044 GetTickCount
 0x421048 GetCurrentThread
 0x42104c GetSystemTimeAsFileTime
 0x421050 SetCommState
 0x421054 SetProcessPriorityBoost
 0x421058 TlsSetValue
 0x42105c ActivateActCtx
 0x421060 GetPrivateProfileIntA
 0x421064 GetVolumeInformationA
 0x421068 LoadLibraryW
 0x42106c GetVersionExW
 0x421070 IsProcessorFeaturePresent
 0x421074 TerminateProcess
 0x421078 GetCompressedFileSizeA
 0x42107c SetThreadPriority
 0x421080 LCMapStringA
 0x421084 GetPrivateProfileIntW
 0x421088 SetCurrentDirectoryA
 0x42108c GetStartupInfoA
 0x421090 GetCPInfoExW
 0x421094 GetLastError
 0x421098 GetThreadLocale
 0x42109c GetProcAddress
 0x4210a0 SetFirmwareEnvironmentVariableW
 0x4210a4 SetStdHandle
 0x4210a8 DisableThreadLibraryCalls
 0x4210ac GetPrivateProfileStringA
 0x4210b0 Process32FirstW
 0x4210b4 LocalAlloc
 0x4210b8 WritePrivateProfileStringA
 0x4210bc SetCurrentDirectoryW
 0x4210c0 SetEnvironmentVariableA
 0x4210c4 GetThreadPriority
 0x4210c8 CreateIoCompletionPort
 0x4210cc QueryMemoryResourceNotification
 0x4210d0 HeapSetInformation
 0x4210d4 FreeEnvironmentStringsW
 0x4210d8 EnumResourceNamesA
 0x4210dc GetStringTypeW
 0x4210e0 RequestWakeupLatency
 0x4210e4 FindAtomW
 0x4210e8 GetFileInformationByHandle
 0x4210ec ReadConsoleOutputCharacterW
 0x4210f0 GetProfileSectionW
 0x4210f4 CopyFileExA
 0x4210f8 CreateFileA
 0x4210fc GetCommandLineA
 0x421100 HeapValidate
 0x421104 IsBadReadPtr
 0x421108 RaiseException
 0x42110c EnterCriticalSection
 0x421110 LeaveCriticalSection
 0x421114 GetCurrentProcess
 0x421118 UnhandledExceptionFilter
 0x42111c SetUnhandledExceptionFilter
 0x421120 IsDebuggerPresent
 0x421124 GetModuleFileNameW
 0x421128 DeleteCriticalSection
 0x42112c TlsGetValue
 0x421130 TlsAlloc
 0x421134 GetCurrentThreadId
 0x421138 TlsFree
 0x42113c InterlockedIncrement
 0x421140 SetLastError
 0x421144 QueryPerformanceCounter
 0x421148 GetCurrentProcessId
 0x42114c Sleep
 0x421150 ExitProcess
 0x421154 GetModuleFileNameA
 0x421158 FreeEnvironmentStringsA
 0x42115c GetEnvironmentStrings
 0x421160 WideCharToMultiByte
 0x421164 GetEnvironmentStringsW
 0x421168 SetHandleCount
 0x42116c GetStdHandle
 0x421170 GetFileType
 0x421174 HeapDestroy
 0x421178 HeapCreate
 0x42117c HeapFree
 0x421180 VirtualFree
 0x421184 WriteFile
 0x421188 HeapSize
 0x42118c HeapReAlloc
 0x421190 VirtualAlloc
 0x421194 GetACP
 0x421198 GetOEMCP
 0x42119c IsValidCodePage
 0x4211a0 DebugBreak
 0x4211a4 OutputDebugStringA
 0x4211a8 WriteConsoleW
 0x4211ac OutputDebugStringW
 0x4211b0 RtlUnwind
 0x4211b4 MultiByteToWideChar
 0x4211b8 InitializeCriticalSectionAndSpinCount
 0x4211bc LoadLibraryA
 0x4211c0 LCMapStringW
 0x4211c4 GetStringTypeA
 0x4211c8 GetLocaleInfoA
 0x4211cc FlushFileBuffers
 0x4211d0 GetConsoleCP
 0x4211d4 GetConsoleMode
 0x4211d8 ReadFile
 0x4211dc SetFilePointer
 0x4211e0 CloseHandle
 0x4211e4 WriteConsoleA
 0x4211e8 GetConsoleOutputCP
USER32.dll
 0x4211f8 GetComboBoxInfo
MSIMG32.dll
 0x4211f0 AlphaBlend

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure