popup

Report - f13058cb1065b13600fcb4a4f48e8ef9.exe

Malicious Library PE File OS Processor Check PE32 DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.09.15 09:25 Machine s1_win7_x6401
Filename f13058cb1065b13600fcb4a4f48e8ef9.exe
Type PE32 executable (console) Intel 80386, for MS Windows
AI Score
2
 Behavior Score
4.8
ZERO API file : malware
VT API (file) 40 detected (Zenlod, trSL, Midie, Unsafe, Attribute, HighConfidence, Malicious, PWSX, Gencirc, Inject4, jzjrk, ASMalwS, TrojDownloader, kcloud, Sabsik, score, GenericRXAA, ai score=85, BScope, mADlXNWinFs, GdSda, confidence, 100%)
md5 dc0b13c9d739e5bd085ed2e8a8a263ab
sha256 62e37fc3978558112a3b09722240c1dec37d08fa56a2b3bee251f91d24bf3b3f
ssdeep 3072:eqSBzzamtOr4iXAtjosMGtAyzqRgZuSabhK/:eqgmmWiaRDdK/
imphash 5421d0320549bc5bd6f824ce3af1039d
impfuzzy 24:FXlpgbD3UMUGviucHRGcSt9S18YbJh9roHOovbOuqNKTPwxCEYBq1EHEQm:hQHbvcSt9S1RDZB3dTHYZk9
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
warning Uses WMI to create a new process
watch One or more of the buffers contains an embedded PE file
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
info Checks amount of memory in system
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (8cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://a.goatgame.co/userf/dat/2202/sqlite.dat
whois
US CLOUDFLARENET 172.67.146.70 clean
https://a.goatgame.co/userf/dat/sqlite.dll
whois
US CLOUDFLARENET 172.67.146.70 4717 malware
a.goatgame.co
whois
US CLOUDFLARENET 104.21.79.144 malware
172.67.146.70
whois
US CLOUDFLARENET 172.67.146.70 malware

Suricata ids

SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x410000 WriteFile
 0x410004 InterlockedDecrement
 0x410008 InitializeCriticalSectionAndSpinCount
 0x41000c CreateFileW
 0x410010 GetModuleHandleA
 0x410014 GetLastError
 0x410018 lstrcatW
 0x41001c CloseHandle
 0x410020 RaiseException
 0x410024 DecodePointer
 0x410028 GetProcAddress
 0x41002c DeleteCriticalSection
 0x410030 WriteConsoleW
 0x410034 SetFilePointerEx
 0x410038 GetConsoleMode
 0x41003c GetConsoleCP
 0x410040 FlushFileBuffers
 0x410044 GetStringTypeW
 0x410048 SetStdHandle
 0x41004c GetFileType
 0x410050 GetProcessHeap
 0x410054 SetEnvironmentVariableA
 0x410058 FreeEnvironmentStringsW
 0x41005c GetEnvironmentStringsW
 0x410060 GetCPInfo
 0x410064 GetOEMCP
 0x410068 IsValidCodePage
 0x41006c FindNextFileA
 0x410070 IsDebuggerPresent
 0x410074 OutputDebugStringW
 0x410078 EnterCriticalSection
 0x41007c LeaveCriticalSection
 0x410080 MultiByteToWideChar
 0x410084 WideCharToMultiByte
 0x410088 LocalFree
 0x41008c UnhandledExceptionFilter
 0x410090 SetUnhandledExceptionFilter
 0x410094 GetCurrentProcess
 0x410098 TerminateProcess
 0x41009c IsProcessorFeaturePresent
 0x4100a0 GetStartupInfoW
 0x4100a4 GetModuleHandleW
 0x4100a8 QueryPerformanceCounter
 0x4100ac GetCurrentProcessId
 0x4100b0 GetCurrentThreadId
 0x4100b4 GetSystemTimeAsFileTime
 0x4100b8 InitializeSListHead
 0x4100bc EncodePointer
 0x4100c0 RtlUnwind
 0x4100c4 SetLastError
 0x4100c8 TlsAlloc
 0x4100cc TlsGetValue
 0x4100d0 TlsSetValue
 0x4100d4 TlsFree
 0x4100d8 FreeLibrary
 0x4100dc LoadLibraryExW
 0x4100e0 ExitProcess
 0x4100e4 GetModuleHandleExW
 0x4100e8 GetModuleFileNameA
 0x4100ec GetStdHandle
 0x4100f0 GetCommandLineA
 0x4100f4 GetCommandLineW
 0x4100f8 GetACP
 0x4100fc HeapFree
 0x410100 HeapAlloc
 0x410104 HeapSize
 0x410108 HeapReAlloc
 0x41010c CompareStringW
 0x410110 LCMapStringW
 0x410114 FindClose
 0x410118 FindFirstFileExA
ole32.dll
 0x410160 CoSetProxyBlanket
 0x410164 CoInitializeSecurity
 0x410168 CoInitialize
 0x41016c CoCreateInstance
OLEAUT32.dll
 0x410120 SafeArrayGetDim
 0x410124 VariantInit
 0x410128 SafeArrayGetUBound
 0x41012c SafeArrayGetLBound
 0x410130 SysFreeString
 0x410134 SysStringByteLen
 0x410138 SysAllocStringByteLen
 0x41013c SysAllocString
 0x410140 VariantCopy
 0x410144 SysStringLen
 0x410148 SafeArrayUnaccessData
 0x41014c SysAllocStringLen
 0x410150 SafeArrayAccessData
 0x410154 VariantClear
 0x410158 GetErrorInfo

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure