ScreenShot
| Created | 2021.10.22 09:34 | Machine | s1_win7_x6401 |
| Filename | DRAFTCOPY-BILL-PDF309874847.scr | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 34 detected (AIDetect, malware2, malicious, high confidence, Nanocore, Artemis, Save, Lisk, ODRX, score, Dnoper, MdeClass, HLLW, Autoruner3, Generic ML PUA, FormBook, Razy, Gen2, ai score=86, Wacatac, Jenxcus, ZemsilF, Gm0@aeb33Lh, Static AI, Malicious SFX, Unsafe) | ||
| md5 | 4fb831a65cce2392df4c5f792dad31e2 | ||
| sha256 | 2e4d9754a395aa51d9d35a6af209c4b041b8fa5c7fdad41bfc0df97d841091f6 | ||
| ssdeep | 24576:5AOcZ1svEiDery6uC+7CzDZS7ske7Cx38CJfyESnSUA6WftHb5pO0i0buNTbeUKI:zJEiyhz1S7ZsHEcSUA6WN3O31eb6ThZB | ||
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 | ||
| impfuzzy | 48:J9jOX8LKc1XFjsX1Pfc++6WQYgeBtDXMunCHFa:JdJLKc1XFgX1Pfc++VVdBtDXMunMFa | ||
Network IP location
Signature (33cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| danger | File has been identified by 34 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Executes one or more WMI queries |
| watch | Installs itself for autorun at Windows startup |
| watch | Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | The process wscript.exe wrote an executable file to disk |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| watch | Wscript.exe initiated network communications indicative of a script based payload download |
| watch | wscript.exe-based dropper (JScript |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Connects to a Dynamic DNS Domain |
| notice | Creates (office) documents on the filesystem |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | Looks up the external IP address |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (24cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | NPKI_Zero | File included NPKI | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (download) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
Network (7cnts) ?
Suricata ids
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
ET DROP Spamhaus DROP Listed Traffic Inbound group 16
ET POLICY External IP Lookup ip-api.com
ET MALWARE WSHRAT CnC Checkin
ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
ET INFO HTTP POST Request to DuckDNS Domain
ET DROP Spamhaus DROP Listed Traffic Inbound group 16
ET POLICY External IP Lookup ip-api.com
ET MALWARE WSHRAT CnC Checkin
ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
ET INFO HTTP POST Request to DuckDNS Domain
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x432000 GetLastError
0x432004 SetLastError
0x432008 FormatMessageW
0x43200c GetCurrentProcess
0x432010 DeviceIoControl
0x432014 SetFileTime
0x432018 CloseHandle
0x43201c CreateDirectoryW
0x432020 RemoveDirectoryW
0x432024 CreateFileW
0x432028 DeleteFileW
0x43202c CreateHardLinkW
0x432030 GetShortPathNameW
0x432034 GetLongPathNameW
0x432038 MoveFileW
0x43203c GetFileType
0x432040 GetStdHandle
0x432044 WriteFile
0x432048 ReadFile
0x43204c FlushFileBuffers
0x432050 SetEndOfFile
0x432054 SetFilePointer
0x432058 SetFileAttributesW
0x43205c GetFileAttributesW
0x432060 FindClose
0x432064 FindFirstFileW
0x432068 FindNextFileW
0x43206c GetVersionExW
0x432070 GetCurrentDirectoryW
0x432074 GetFullPathNameW
0x432078 FoldStringW
0x43207c GetModuleFileNameW
0x432080 GetModuleHandleW
0x432084 FindResourceW
0x432088 FreeLibrary
0x43208c GetProcAddress
0x432090 GetCurrentProcessId
0x432094 ExitProcess
0x432098 SetThreadExecutionState
0x43209c Sleep
0x4320a0 LoadLibraryW
0x4320a4 GetSystemDirectoryW
0x4320a8 CompareStringW
0x4320ac AllocConsole
0x4320b0 FreeConsole
0x4320b4 AttachConsole
0x4320b8 WriteConsoleW
0x4320bc GetProcessAffinityMask
0x4320c0 CreateThread
0x4320c4 SetThreadPriority
0x4320c8 InitializeCriticalSection
0x4320cc EnterCriticalSection
0x4320d0 LeaveCriticalSection
0x4320d4 DeleteCriticalSection
0x4320d8 SetEvent
0x4320dc ResetEvent
0x4320e0 ReleaseSemaphore
0x4320e4 WaitForSingleObject
0x4320e8 CreateEventW
0x4320ec CreateSemaphoreW
0x4320f0 GetSystemTime
0x4320f4 SystemTimeToTzSpecificLocalTime
0x4320f8 TzSpecificLocalTimeToSystemTime
0x4320fc SystemTimeToFileTime
0x432100 FileTimeToLocalFileTime
0x432104 LocalFileTimeToFileTime
0x432108 FileTimeToSystemTime
0x43210c GetCPInfo
0x432110 IsDBCSLeadByte
0x432114 MultiByteToWideChar
0x432118 WideCharToMultiByte
0x43211c GlobalAlloc
0x432120 LockResource
0x432124 GlobalLock
0x432128 GlobalUnlock
0x43212c GlobalFree
0x432130 LoadResource
0x432134 SizeofResource
0x432138 SetCurrentDirectoryW
0x43213c GetExitCodeProcess
0x432140 GetLocalTime
0x432144 GetTickCount
0x432148 MapViewOfFile
0x43214c UnmapViewOfFile
0x432150 CreateFileMappingW
0x432154 OpenFileMappingW
0x432158 GetCommandLineW
0x43215c SetEnvironmentVariableW
0x432160 ExpandEnvironmentStringsW
0x432164 GetTempPathW
0x432168 MoveFileExW
0x43216c GetLocaleInfoW
0x432170 GetTimeFormatW
0x432174 GetDateFormatW
0x432178 GetNumberFormatW
0x43217c SetFilePointerEx
0x432180 GetConsoleMode
0x432184 GetConsoleCP
0x432188 HeapSize
0x43218c SetStdHandle
0x432190 GetProcessHeap
0x432194 RaiseException
0x432198 GetSystemInfo
0x43219c VirtualProtect
0x4321a0 VirtualQuery
0x4321a4 LoadLibraryExA
0x4321a8 IsProcessorFeaturePresent
0x4321ac IsDebuggerPresent
0x4321b0 UnhandledExceptionFilter
0x4321b4 SetUnhandledExceptionFilter
0x4321b8 GetStartupInfoW
0x4321bc QueryPerformanceCounter
0x4321c0 GetCurrentThreadId
0x4321c4 GetSystemTimeAsFileTime
0x4321c8 InitializeSListHead
0x4321cc TerminateProcess
0x4321d0 RtlUnwind
0x4321d4 EncodePointer
0x4321d8 InitializeCriticalSectionAndSpinCount
0x4321dc TlsAlloc
0x4321e0 TlsGetValue
0x4321e4 TlsSetValue
0x4321e8 TlsFree
0x4321ec LoadLibraryExW
0x4321f0 QueryPerformanceFrequency
0x4321f4 GetModuleHandleExW
0x4321f8 GetModuleFileNameA
0x4321fc GetACP
0x432200 HeapFree
0x432204 HeapAlloc
0x432208 HeapReAlloc
0x43220c GetStringTypeW
0x432210 LCMapStringW
0x432214 FindFirstFileExA
0x432218 FindNextFileA
0x43221c IsValidCodePage
0x432220 GetOEMCP
0x432224 GetCommandLineA
0x432228 GetEnvironmentStringsW
0x43222c FreeEnvironmentStringsW
0x432230 DecodePointer
gdiplus.dll
0x432238 GdiplusShutdown
0x43223c GdiplusStartup
0x432240 GdipCreateHBITMAPFromBitmap
0x432244 GdipCreateBitmapFromStreamICM
0x432248 GdipCreateBitmapFromStream
0x43224c GdipDisposeImage
0x432250 GdipCloneImage
0x432254 GdipFree
0x432258 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x432000 GetLastError
0x432004 SetLastError
0x432008 FormatMessageW
0x43200c GetCurrentProcess
0x432010 DeviceIoControl
0x432014 SetFileTime
0x432018 CloseHandle
0x43201c CreateDirectoryW
0x432020 RemoveDirectoryW
0x432024 CreateFileW
0x432028 DeleteFileW
0x43202c CreateHardLinkW
0x432030 GetShortPathNameW
0x432034 GetLongPathNameW
0x432038 MoveFileW
0x43203c GetFileType
0x432040 GetStdHandle
0x432044 WriteFile
0x432048 ReadFile
0x43204c FlushFileBuffers
0x432050 SetEndOfFile
0x432054 SetFilePointer
0x432058 SetFileAttributesW
0x43205c GetFileAttributesW
0x432060 FindClose
0x432064 FindFirstFileW
0x432068 FindNextFileW
0x43206c GetVersionExW
0x432070 GetCurrentDirectoryW
0x432074 GetFullPathNameW
0x432078 FoldStringW
0x43207c GetModuleFileNameW
0x432080 GetModuleHandleW
0x432084 FindResourceW
0x432088 FreeLibrary
0x43208c GetProcAddress
0x432090 GetCurrentProcessId
0x432094 ExitProcess
0x432098 SetThreadExecutionState
0x43209c Sleep
0x4320a0 LoadLibraryW
0x4320a4 GetSystemDirectoryW
0x4320a8 CompareStringW
0x4320ac AllocConsole
0x4320b0 FreeConsole
0x4320b4 AttachConsole
0x4320b8 WriteConsoleW
0x4320bc GetProcessAffinityMask
0x4320c0 CreateThread
0x4320c4 SetThreadPriority
0x4320c8 InitializeCriticalSection
0x4320cc EnterCriticalSection
0x4320d0 LeaveCriticalSection
0x4320d4 DeleteCriticalSection
0x4320d8 SetEvent
0x4320dc ResetEvent
0x4320e0 ReleaseSemaphore
0x4320e4 WaitForSingleObject
0x4320e8 CreateEventW
0x4320ec CreateSemaphoreW
0x4320f0 GetSystemTime
0x4320f4 SystemTimeToTzSpecificLocalTime
0x4320f8 TzSpecificLocalTimeToSystemTime
0x4320fc SystemTimeToFileTime
0x432100 FileTimeToLocalFileTime
0x432104 LocalFileTimeToFileTime
0x432108 FileTimeToSystemTime
0x43210c GetCPInfo
0x432110 IsDBCSLeadByte
0x432114 MultiByteToWideChar
0x432118 WideCharToMultiByte
0x43211c GlobalAlloc
0x432120 LockResource
0x432124 GlobalLock
0x432128 GlobalUnlock
0x43212c GlobalFree
0x432130 LoadResource
0x432134 SizeofResource
0x432138 SetCurrentDirectoryW
0x43213c GetExitCodeProcess
0x432140 GetLocalTime
0x432144 GetTickCount
0x432148 MapViewOfFile
0x43214c UnmapViewOfFile
0x432150 CreateFileMappingW
0x432154 OpenFileMappingW
0x432158 GetCommandLineW
0x43215c SetEnvironmentVariableW
0x432160 ExpandEnvironmentStringsW
0x432164 GetTempPathW
0x432168 MoveFileExW
0x43216c GetLocaleInfoW
0x432170 GetTimeFormatW
0x432174 GetDateFormatW
0x432178 GetNumberFormatW
0x43217c SetFilePointerEx
0x432180 GetConsoleMode
0x432184 GetConsoleCP
0x432188 HeapSize
0x43218c SetStdHandle
0x432190 GetProcessHeap
0x432194 RaiseException
0x432198 GetSystemInfo
0x43219c VirtualProtect
0x4321a0 VirtualQuery
0x4321a4 LoadLibraryExA
0x4321a8 IsProcessorFeaturePresent
0x4321ac IsDebuggerPresent
0x4321b0 UnhandledExceptionFilter
0x4321b4 SetUnhandledExceptionFilter
0x4321b8 GetStartupInfoW
0x4321bc QueryPerformanceCounter
0x4321c0 GetCurrentThreadId
0x4321c4 GetSystemTimeAsFileTime
0x4321c8 InitializeSListHead
0x4321cc TerminateProcess
0x4321d0 RtlUnwind
0x4321d4 EncodePointer
0x4321d8 InitializeCriticalSectionAndSpinCount
0x4321dc TlsAlloc
0x4321e0 TlsGetValue
0x4321e4 TlsSetValue
0x4321e8 TlsFree
0x4321ec LoadLibraryExW
0x4321f0 QueryPerformanceFrequency
0x4321f4 GetModuleHandleExW
0x4321f8 GetModuleFileNameA
0x4321fc GetACP
0x432200 HeapFree
0x432204 HeapAlloc
0x432208 HeapReAlloc
0x43220c GetStringTypeW
0x432210 LCMapStringW
0x432214 FindFirstFileExA
0x432218 FindNextFileA
0x43221c IsValidCodePage
0x432220 GetOEMCP
0x432224 GetCommandLineA
0x432228 GetEnvironmentStringsW
0x43222c FreeEnvironmentStringsW
0x432230 DecodePointer
gdiplus.dll
0x432238 GdiplusShutdown
0x43223c GdiplusStartup
0x432240 GdipCreateHBITMAPFromBitmap
0x432244 GdipCreateBitmapFromStreamICM
0x432248 GdipCreateBitmapFromStream
0x43224c GdipDisposeImage
0x432250 GdipCloneImage
0x432254 GdipFree
0x432258 GdipAlloc
EAT(Export Address Table) Library