popup

Report - 28347623.jpg

Malicious Library PE File OS Processor Check PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.09.30 09:16 Machine s1_win7_x6402
Filename 28347623.jpg
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
2.8
ZERO API file : malware
VT API (file) 42 detected (AIDetect, malware1, Malicious, high confidence, Fragtor, Stop, Ulise, Unsafe, Save, confidence, 100%, Raccrypt, ZexaF, HuW@a0pxuqfO, Attribute, HighConfidence, Kryptik, HMQN, score, Generic@ML, RDML, CVHK5ZzLoyfxIuJ4KNE87g, DownLoader42, Azorult, ai score=85, GdSda, R002C0PIS21, Pbfn, Static AI, Malicious PE, GenKryptik, FLGE, FileRepMalware)
md5 481bd2e89355de9a8e2393eec9ee41d7
sha256 9924bd5f366254f985a742ce76fbbbdecfb963c81920e2ebccbe433ca48516af
ssdeep 12288:0snE+k3cLXmlPSMMMpe60MFzeg7X+AX1XOup9:0uU3cLM1MV6vogbdD
imphash 56c207817e66e7690a43bf97b1ee7374
impfuzzy 48:7OPdL3inFXU7d7wwOfSX2CNxtxma2IK9Jc9rh9J:KVL3uFXU7NwwLXlxtxj2IQJc9rhn
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 42 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x41c00c TlsGetValue
 0x41c010 SetLocalTime
 0x41c014 InterlockedIncrement
 0x41c018 GetCommState
 0x41c01c GetProfileStringW
 0x41c020 UnlockFile
 0x41c024 CallNamedPipeW
 0x41c028 FreeEnvironmentStringsA
 0x41c02c GetNumberFormatA
 0x41c030 FindResourceExA
 0x41c034 GlobalAlloc
 0x41c038 GetPrivateProfileIntA
 0x41c03c LoadLibraryW
 0x41c040 GetConsoleAliasExesLengthW
 0x41c044 HeapDestroy
 0x41c048 CreateSemaphoreA
 0x41c04c EnumResourceLanguagesA
 0x41c050 GetModuleFileNameW
 0x41c054 GetCompressedFileSizeA
 0x41c058 GetSystemDirectoryA
 0x41c05c CreateActCtxA
 0x41c060 GetBinaryTypeW
 0x41c064 LCMapStringA
 0x41c068 GetStartupInfoA
 0x41c06c lstrlenA
 0x41c070 GetStdHandle
 0x41c074 FreeLibraryAndExitThread
 0x41c078 GetLastError
 0x41c07c GetProcAddress
 0x41c080 CreateNamedPipeA
 0x41c084 EnterCriticalSection
 0x41c088 LoadLibraryA
 0x41c08c OpenMutexA
 0x41c090 WritePrivateProfileStringA
 0x41c094 SetThreadIdealProcessor
 0x41c098 FindAtomA
 0x41c09c SetSystemTime
 0x41c0a0 FindNextFileA
 0x41c0a4 WriteProfileStringA
 0x41c0a8 CreateIoCompletionPort
 0x41c0ac FindFirstChangeNotificationA
 0x41c0b0 HeapSetInformation
 0x41c0b4 GetCurrentDirectoryA
 0x41c0b8 SetFileShortNameA
 0x41c0bc UnregisterWaitEx
 0x41c0c0 CopyFileExA
 0x41c0c4 DeleteFileA
 0x41c0c8 GetVolumeInformationW
 0x41c0cc LocalFileTimeToFileTime
 0x41c0d0 GetThreadContext
 0x41c0d4 SetThreadLocale
 0x41c0d8 GetCommandLineW
 0x41c0dc WideCharToMultiByte
 0x41c0e0 EncodePointer
 0x41c0e4 DecodePointer
 0x41c0e8 GetCommandLineA
 0x41c0ec GetStartupInfoW
 0x41c0f0 InterlockedDecrement
 0x41c0f4 GetModuleHandleW
 0x41c0f8 ExitProcess
 0x41c0fc TerminateProcess
 0x41c100 GetCurrentProcess
 0x41c104 UnhandledExceptionFilter
 0x41c108 SetUnhandledExceptionFilter
 0x41c10c IsDebuggerPresent
 0x41c110 WriteFile
 0x41c114 GetACP
 0x41c118 GetOEMCP
 0x41c11c GetCPInfo
 0x41c120 IsValidCodePage
 0x41c124 TlsAlloc
 0x41c128 TlsSetValue
 0x41c12c GetCurrentThreadId
 0x41c130 TlsFree
 0x41c134 SetLastError
 0x41c138 HeapValidate
 0x41c13c IsBadReadPtr
 0x41c140 LeaveCriticalSection
 0x41c144 SetHandleCount
 0x41c148 InitializeCriticalSectionAndSpinCount
 0x41c14c GetFileType
 0x41c150 DeleteCriticalSection
 0x41c154 QueryPerformanceCounter
 0x41c158 GetTickCount
 0x41c15c GetCurrentProcessId
 0x41c160 GetSystemTimeAsFileTime
 0x41c164 GetModuleFileNameA
 0x41c168 FreeEnvironmentStringsW
 0x41c16c GetEnvironmentStringsW
 0x41c170 HeapCreate
 0x41c174 IsProcessorFeaturePresent
 0x41c178 OutputDebugStringA
 0x41c17c WriteConsoleW
 0x41c180 OutputDebugStringW
 0x41c184 RtlUnwind
 0x41c188 LCMapStringW
 0x41c18c MultiByteToWideChar
 0x41c190 GetStringTypeW
 0x41c194 SetFilePointer
 0x41c198 GetConsoleCP
 0x41c19c GetConsoleMode
 0x41c1a0 HeapAlloc
 0x41c1a4 HeapReAlloc
 0x41c1a8 HeapSize
 0x41c1ac HeapQueryInformation
 0x41c1b0 HeapFree
 0x41c1b4 SetStdHandle
 0x41c1b8 FlushFileBuffers
 0x41c1bc RaiseException
 0x41c1c0 CreateFileW
 0x41c1c4 CloseHandle
ADVAPI32.dll
 0x41c000 InitiateSystemShutdownA
 0x41c004 AbortSystemShutdownA
WINHTTP.dll
 0x41c1cc WinHttpOpen

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure