popup

Report - file.exe

Malicious Library PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.09.28 16:17 Machine s1_win7_x6401
Filename file.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
2.6
ZERO API file : malware
VT API (file) 33 detected (malicious, high confidence, Ulise, Stop, Unsafe, Save, ZexaF, xuW@aiAu, Attribute, HighConfidence, FileRepMalware, ai score=81, kcloud, Sabsik, score, Azorult, Generic@ML, RDML, sjjp2+Ui4GAvYJgo+wki0w, Static AI, Malicious PE, confidence, 100%)
md5 881838479bd774a3e90aaba668a922d8
sha256 e0bc481d34f12788300cff55706ef6352f59e3c206b930ca08b2f7c76af3e795
ssdeep 6144:+fORZELOXqPWpjOrAhJjZ0eAUOa1EehKflZnlM+xV4wXnHKNaKv:+WfELAptOrNDUOa1E1HnK0V1XnHKE
imphash b3447c394869d3e708c4373cd10a2b6b
impfuzzy 48:zORcxXRinFXU7Y7fjOfcztXHacyIK9Jc+lf9J:iaxXRuFXU7+fjntX6cyIQJc+lfn
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 33 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x41c00c TlsGetValue
 0x41c010 InterlockedIncrement
 0x41c014 GetCommState
 0x41c018 GetProfileStringW
 0x41c01c UnlockFile
 0x41c020 CallNamedPipeW
 0x41c024 FreeEnvironmentStringsA
 0x41c028 GetNumberFormatA
 0x41c02c FindResourceExA
 0x41c030 GlobalAlloc
 0x41c034 GetPrivateProfileIntA
 0x41c038 GetConsoleAliasExesLengthW
 0x41c03c HeapDestroy
 0x41c040 CreateSemaphoreA
 0x41c044 EnumResourceLanguagesA
 0x41c048 GetModuleFileNameW
 0x41c04c GetCompressedFileSizeA
 0x41c050 GetSystemDirectoryA
 0x41c054 CreateActCtxA
 0x41c058 GetBinaryTypeW
 0x41c05c lstrlenW
 0x41c060 LCMapStringA
 0x41c064 GetStartupInfoA
 0x41c068 SetThreadLocale
 0x41c06c GetStdHandle
 0x41c070 CopyFileExW
 0x41c074 FreeLibraryAndExitThread
 0x41c078 GetLastError
 0x41c07c GetProcAddress
 0x41c080 CreateNamedPipeA
 0x41c084 EnterCriticalSection
 0x41c088 LoadLibraryA
 0x41c08c OpenMutexA
 0x41c090 WritePrivateProfileStringA
 0x41c094 SetThreadIdealProcessor
 0x41c098 FindAtomA
 0x41c09c SetSystemTime
 0x41c0a0 FindNextFileA
 0x41c0a4 WriteProfileStringA
 0x41c0a8 CreateIoCompletionPort
 0x41c0ac GetModuleHandleA
 0x41c0b0 FindFirstChangeNotificationA
 0x41c0b4 HeapSetInformation
 0x41c0b8 GetCurrentDirectoryA
 0x41c0bc SetFileShortNameA
 0x41c0c0 FindAtomW
 0x41c0c4 UnregisterWaitEx
 0x41c0c8 GetSystemTime
 0x41c0cc DeleteFileA
 0x41c0d0 GetVolumeInformationW
 0x41c0d4 LocalFileTimeToFileTime
 0x41c0d8 GetThreadContext
 0x41c0dc GetCPInfoExW
 0x41c0e0 GetCommandLineW
 0x41c0e4 WideCharToMultiByte
 0x41c0e8 EncodePointer
 0x41c0ec DecodePointer
 0x41c0f0 GetStartupInfoW
 0x41c0f4 TerminateProcess
 0x41c0f8 GetCurrentProcess
 0x41c0fc UnhandledExceptionFilter
 0x41c100 SetUnhandledExceptionFilter
 0x41c104 IsDebuggerPresent
 0x41c108 InterlockedDecrement
 0x41c10c GetACP
 0x41c110 GetOEMCP
 0x41c114 GetCPInfo
 0x41c118 IsValidCodePage
 0x41c11c TlsAlloc
 0x41c120 TlsSetValue
 0x41c124 GetCurrentThreadId
 0x41c128 TlsFree
 0x41c12c GetModuleHandleW
 0x41c130 SetLastError
 0x41c134 HeapValidate
 0x41c138 IsBadReadPtr
 0x41c13c ExitProcess
 0x41c140 LeaveCriticalSection
 0x41c144 SetHandleCount
 0x41c148 InitializeCriticalSectionAndSpinCount
 0x41c14c GetFileType
 0x41c150 DeleteCriticalSection
 0x41c154 QueryPerformanceCounter
 0x41c158 GetTickCount
 0x41c15c GetCurrentProcessId
 0x41c160 GetSystemTimeAsFileTime
 0x41c164 FreeEnvironmentStringsW
 0x41c168 GetEnvironmentStringsW
 0x41c16c HeapCreate
 0x41c170 WriteFile
 0x41c174 IsProcessorFeaturePresent
 0x41c178 OutputDebugStringA
 0x41c17c WriteConsoleW
 0x41c180 OutputDebugStringW
 0x41c184 LoadLibraryW
 0x41c188 RtlUnwind
 0x41c18c LCMapStringW
 0x41c190 MultiByteToWideChar
 0x41c194 GetStringTypeW
 0x41c198 SetFilePointer
 0x41c19c GetConsoleCP
 0x41c1a0 GetConsoleMode
 0x41c1a4 HeapAlloc
 0x41c1a8 GetModuleFileNameA
 0x41c1ac HeapReAlloc
 0x41c1b0 HeapSize
 0x41c1b4 HeapQueryInformation
 0x41c1b8 HeapFree
 0x41c1bc SetStdHandle
 0x41c1c0 FlushFileBuffers
 0x41c1c4 RaiseException
 0x41c1c8 CreateFileW
 0x41c1cc CloseHandle
ADVAPI32.dll
 0x41c000 InitiateSystemShutdownA
 0x41c004 AbortSystemShutdownA
WINHTTP.dll
 0x41c1d4 WinHttpOpen

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure