Report - FastPC.exe

Malicious Library UPX PE File PE32
ScreenShot
Created 2021.11.01 11:41 Machine s1_win7_x6401
Filename FastPC.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
Behavior Score
4.2
ZERO API file : clean
VT API (file) 41 detected (AIDetect, malware2, malicious, high confidence, GenericKD, Artemis, Unsafe, Save, confidence, ZelphiF, HHW@ayH5UUfi, Attribute, HighConfidence, GenKryptik, FMVR, Chapak, GenSteal, whlgd, Static AI, Malicious PE, Sabsik, score, BScope, Generic@ML, RDML, PtiMUaV9Eh8cT9hyJTScyQ, EQGY, GdSda, susgen)
md5 4e79889f1ed630cc252814f471454f0d
sha256 fe9c234f50ce222b6c197cc6b9950ac57f0c1f016bf689bbbae12e095da36b09
ssdeep 24576:5EQ8J0nvh49ggaax8nWGbwKQ6imFUG6MMtW3pYJMXRI3D8r/Ce:5dvgu0mFUG67gMMuD8Oe
imphash 5310cfb88a05f7b27edf69bdc717fef1
impfuzzy 192:f3cNk1Q+ekbuuSrSUvK9RqooqEse7CPbOQDd:f3j1lSA9LvPbOQp
  Network IP location

Signature (9cnts)

Level Description
danger File has been identified by 41 AntiVirus engines on VirusTotal as malicious
warning Generates some ICMP traffic
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Performs some HTTP requests
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://iplogger.org/1rE4g7 DE Hetzner Online GmbH 88.99.66.31 clean
iplogger.org DE Hetzner Online GmbH 88.99.66.31 mailcious
88.99.66.31 DE Hetzner Online GmbH 88.99.66.31 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x47717c DeleteCriticalSection
 0x477180 LeaveCriticalSection
 0x477184 EnterCriticalSection
 0x477188 InitializeCriticalSection
 0x47718c VirtualFree
 0x477190 VirtualAlloc
 0x477194 LocalFree
 0x477198 LocalAlloc
 0x47719c GetVersion
 0x4771a0 GetCurrentThreadId
 0x4771a4 InterlockedDecrement
 0x4771a8 InterlockedIncrement
 0x4771ac VirtualQuery
 0x4771b0 WideCharToMultiByte
 0x4771b4 MultiByteToWideChar
 0x4771b8 lstrlenA
 0x4771bc lstrcpynA
 0x4771c0 LoadLibraryExA
 0x4771c4 GetThreadLocale
 0x4771c8 GetStartupInfoA
 0x4771cc GetProcAddress
 0x4771d0 GetModuleHandleA
 0x4771d4 GetModuleFileNameA
 0x4771d8 GetLocaleInfoA
 0x4771dc GetCommandLineA
 0x4771e0 FreeLibrary
 0x4771e4 FindFirstFileA
 0x4771e8 FindClose
 0x4771ec ExitProcess
 0x4771f0 WriteFile
 0x4771f4 UnhandledExceptionFilter
 0x4771f8 RtlUnwind
 0x4771fc RaiseException
 0x477200 GetStdHandle
user32.dll
 0x477208 GetKeyboardType
 0x47720c LoadStringA
 0x477210 MessageBoxA
 0x477214 CharNextA
advapi32.dll
 0x47721c RegQueryValueExA
 0x477220 RegOpenKeyExA
 0x477224 RegCloseKey
oleaut32.dll
 0x47722c SysFreeString
 0x477230 SysReAllocStringLen
 0x477234 SysAllocStringLen
kernel32.dll
 0x47723c TlsSetValue
 0x477240 TlsGetValue
 0x477244 LocalAlloc
 0x477248 GetModuleHandleA
advapi32.dll
 0x477250 RegSetValueExA
 0x477254 RegQueryValueExA
 0x477258 RegOpenKeyExA
 0x47725c RegFlushKey
 0x477260 RegCreateKeyExA
 0x477264 RegCloseKey
kernel32.dll
 0x47726c lstrcpyA
 0x477270 WriteFile
 0x477274 WinExec
 0x477278 WaitForSingleObject
 0x47727c VirtualQuery
 0x477280 VirtualAlloc
 0x477284 Sleep
 0x477288 SizeofResource
 0x47728c SetThreadLocale
 0x477290 SetFilePointer
 0x477294 SetEvent
 0x477298 SetErrorMode
 0x47729c SetEndOfFile
 0x4772a0 ResetEvent
 0x4772a4 ReadFile
 0x4772a8 MultiByteToWideChar
 0x4772ac MulDiv
 0x4772b0 LockResource
 0x4772b4 LoadResource
 0x4772b8 LoadLibraryA
 0x4772bc LeaveCriticalSection
 0x4772c0 InitializeCriticalSection
 0x4772c4 GlobalUnlock
 0x4772c8 GlobalReAlloc
 0x4772cc GlobalHandle
 0x4772d0 GlobalLock
 0x4772d4 GlobalFree
 0x4772d8 GlobalFindAtomA
 0x4772dc GlobalDeleteAtom
 0x4772e0 GlobalAlloc
 0x4772e4 GlobalAddAtomA
 0x4772e8 GetVersionExA
 0x4772ec GetVersion
 0x4772f0 GetTickCount
 0x4772f4 GetThreadLocale
 0x4772f8 GetSystemInfo
 0x4772fc GetStringTypeExA
 0x477300 GetStdHandle
 0x477304 GetProcAddress
 0x477308 GetModuleHandleA
 0x47730c GetModuleFileNameA
 0x477310 GetLocaleInfoA
 0x477314 GetLocalTime
 0x477318 GetLastError
 0x47731c GetFullPathNameA
 0x477320 GetDiskFreeSpaceA
 0x477324 GetDateFormatA
 0x477328 GetCurrentThreadId
 0x47732c GetCurrentProcessId
 0x477330 GetCPInfo
 0x477334 GetACP
 0x477338 FreeResource
 0x47733c InterlockedExchange
 0x477340 FreeLibrary
 0x477344 FormatMessageA
 0x477348 FindResourceA
 0x47734c EnumCalendarInfoA
 0x477350 EnterCriticalSection
 0x477354 DeleteCriticalSection
 0x477358 CreateThread
 0x47735c CreateFileA
 0x477360 CreateEventA
 0x477364 CompareStringA
 0x477368 CloseHandle
version.dll
 0x477370 VerQueryValueA
 0x477374 GetFileVersionInfoSizeA
 0x477378 GetFileVersionInfoA
gdi32.dll
 0x477380 UnrealizeObject
 0x477384 TextOutA
 0x477388 StretchBlt
 0x47738c SetWindowOrgEx
 0x477390 SetWinMetaFileBits
 0x477394 SetViewportOrgEx
 0x477398 SetTextColor
 0x47739c SetTextAlign
 0x4773a0 SetStretchBltMode
 0x4773a4 SetROP2
 0x4773a8 SetPixel
 0x4773ac SetEnhMetaFileBits
 0x4773b0 SetDIBColorTable
 0x4773b4 SetBrushOrgEx
 0x4773b8 SetBkMode
 0x4773bc SetBkColor
 0x4773c0 SelectPalette
 0x4773c4 SelectObject
 0x4773c8 SelectClipRgn
 0x4773cc SaveDC
 0x4773d0 RoundRect
 0x4773d4 RestoreDC
 0x4773d8 Rectangle
 0x4773dc RectVisible
 0x4773e0 RealizePalette
 0x4773e4 Polyline
 0x4773e8 Polygon
 0x4773ec PlayEnhMetaFile
 0x4773f0 Pie
 0x4773f4 PatBlt
 0x4773f8 MoveToEx
 0x4773fc MaskBlt
 0x477400 LineTo
 0x477404 LPtoDP
 0x477408 IntersectClipRect
 0x47740c GetWindowOrgEx
 0x477410 GetWinMetaFileBits
 0x477414 GetTextMetricsA
 0x477418 GetTextExtentPoint32A
 0x47741c GetTextAlign
 0x477420 GetSystemPaletteEntries
 0x477424 GetStockObject
 0x477428 GetPixelFormat
 0x47742c GetPixel
 0x477430 GetPaletteEntries
 0x477434 GetObjectA
 0x477438 GetEnhMetaFilePaletteEntries
 0x47743c GetEnhMetaFileHeader
 0x477440 GetEnhMetaFileBits
 0x477444 GetDeviceCaps
 0x477448 GetDIBits
 0x47744c GetDIBColorTable
 0x477450 GetDCOrgEx
 0x477454 GetCurrentPositionEx
 0x477458 GetClipBox
 0x47745c GetBrushOrgEx
 0x477460 GetBkMode
 0x477464 GetBkColor
 0x477468 GetBitmapBits
 0x47746c ExtSelectClipRgn
 0x477470 ExtCreatePen
 0x477474 ExcludeClipRect
 0x477478 Ellipse
 0x47747c DeleteObject
 0x477480 DeleteEnhMetaFile
 0x477484 DeleteDC
 0x477488 CreateSolidBrush
 0x47748c CreateRectRgn
 0x477490 CreatePolygonRgn
 0x477494 CreatePenIndirect
 0x477498 CreatePalette
 0x47749c CreateHalftonePalette
 0x4774a0 CreateFontIndirectA
 0x4774a4 CreateDIBitmap
 0x4774a8 CreateDIBSection
 0x4774ac CreateCompatibleDC
 0x4774b0 CreateCompatibleBitmap
 0x4774b4 CreateBrushIndirect
 0x4774b8 CreateBitmap
 0x4774bc CopyEnhMetaFileA
 0x4774c0 BitBlt
 0x4774c4 Arc
user32.dll
 0x4774cc CreateWindowExA
 0x4774d0 WindowFromPoint
 0x4774d4 WinHelpA
 0x4774d8 WaitMessage
 0x4774dc UpdateWindow
 0x4774e0 UnregisterClassA
 0x4774e4 UnhookWindowsHookEx
 0x4774e8 TranslateMessage
 0x4774ec TranslateMDISysAccel
 0x4774f0 TrackPopupMenu
 0x4774f4 SystemParametersInfoA
 0x4774f8 ShowWindow
 0x4774fc ShowScrollBar
 0x477500 ShowOwnedPopups
 0x477504 ShowCursor
 0x477508 SetWindowsHookExA
 0x47750c SetWindowPos
 0x477510 SetWindowPlacement
 0x477514 SetWindowLongA
 0x477518 SetTimer
 0x47751c SetScrollRange
 0x477520 SetScrollPos
 0x477524 SetScrollInfo
 0x477528 SetRect
 0x47752c SetPropA
 0x477530 SetParent
 0x477534 SetMenuItemInfoA
 0x477538 SetMenu
 0x47753c SetForegroundWindow
 0x477540 SetFocus
 0x477544 SetCursor
 0x477548 SetClassLongA
 0x47754c SetCapture
 0x477550 SetActiveWindow
 0x477554 SendMessageA
 0x477558 ScrollWindow
 0x47755c ScreenToClient
 0x477560 RemovePropA
 0x477564 RemoveMenu
 0x477568 ReleaseDC
 0x47756c ReleaseCapture
 0x477570 RegisterWindowMessageA
 0x477574 RegisterClipboardFormatA
 0x477578 RegisterClassA
 0x47757c RedrawWindow
 0x477580 PtInRect
 0x477584 PostQuitMessage
 0x477588 PostMessageA
 0x47758c PeekMessageA
 0x477590 OffsetRect
 0x477594 OemToCharA
 0x477598 MessageBoxA
 0x47759c MapWindowPoints
 0x4775a0 MapVirtualKeyA
 0x4775a4 LoadStringA
 0x4775a8 LoadKeyboardLayoutA
 0x4775ac LoadIconA
 0x4775b0 LoadCursorA
 0x4775b4 LoadBitmapA
 0x4775b8 KillTimer
 0x4775bc IsZoomed
 0x4775c0 IsWindowVisible
 0x4775c4 IsWindowEnabled
 0x4775c8 IsWindow
 0x4775cc IsRectEmpty
 0x4775d0 IsIconic
 0x4775d4 IsDialogMessageA
 0x4775d8 IsChild
 0x4775dc InvalidateRect
 0x4775e0 IntersectRect
 0x4775e4 InsertMenuItemA
 0x4775e8 InsertMenuA
 0x4775ec InflateRect
 0x4775f0 GetWindowThreadProcessId
 0x4775f4 GetWindowTextA
 0x4775f8 GetWindowRect
 0x4775fc GetWindowPlacement
 0x477600 GetWindowLongA
 0x477604 GetWindowDC
 0x477608 GetTopWindow
 0x47760c GetSystemMetrics
 0x477610 GetSystemMenu
 0x477614 GetSysColorBrush
 0x477618 GetSysColor
 0x47761c GetSubMenu
 0x477620 GetScrollRange
 0x477624 GetScrollPos
 0x477628 GetScrollInfo
 0x47762c GetPropA
 0x477630 GetParent
 0x477634 GetWindow
 0x477638 GetMenuStringA
 0x47763c GetMenuState
 0x477640 GetMenuItemInfoA
 0x477644 GetMenuItemID
 0x477648 GetMenuItemCount
 0x47764c GetMenu
 0x477650 GetLastActivePopup
 0x477654 GetKeyboardState
 0x477658 GetKeyboardLayoutList
 0x47765c GetKeyboardLayout
 0x477660 GetKeyState
 0x477664 GetKeyNameTextA
 0x477668 GetIconInfo
 0x47766c GetForegroundWindow
 0x477670 GetFocus
 0x477674 GetDesktopWindow
 0x477678 GetDCEx
 0x47767c GetDC
 0x477680 GetCursorPos
 0x477684 GetCursor
 0x477688 GetClipboardData
 0x47768c GetClientRect
 0x477690 GetClassNameA
 0x477694 GetClassInfoA
 0x477698 GetCapture
 0x47769c GetActiveWindow
 0x4776a0 FrameRect
 0x4776a4 FindWindowA
 0x4776a8 FillRect
 0x4776ac EqualRect
 0x4776b0 EnumWindows
 0x4776b4 EnumThreadWindows
 0x4776b8 EndPaint
 0x4776bc EnableWindow
 0x4776c0 EnableScrollBar
 0x4776c4 EnableMenuItem
 0x4776c8 DrawTextA
 0x4776cc DrawMenuBar
 0x4776d0 DrawIconEx
 0x4776d4 DrawIcon
 0x4776d8 DrawFrameControl
 0x4776dc DrawEdge
 0x4776e0 DispatchMessageA
 0x4776e4 DestroyWindow
 0x4776e8 DestroyMenu
 0x4776ec DestroyIcon
 0x4776f0 DestroyCursor
 0x4776f4 DeleteMenu
 0x4776f8 DefWindowProcA
 0x4776fc DefMDIChildProcA
 0x477700 DefFrameProcA
 0x477704 CreatePopupMenu
 0x477708 CreateMenu
 0x47770c CreateIcon
 0x477710 ClientToScreen
 0x477714 CheckMenuItem
 0x477718 CallWindowProcA
 0x47771c CallNextHookEx
 0x477720 BeginPaint
 0x477724 CharNextA
 0x477728 CharLowerBuffA
 0x47772c CharLowerA
 0x477730 CharUpperBuffA
 0x477734 CharToOemA
 0x477738 AdjustWindowRectEx
 0x47773c ActivateKeyboardLayout
kernel32.dll
 0x477744 Sleep
oleaut32.dll
 0x47774c SafeArrayPtrOfIndex
 0x477750 SafeArrayPutElement
 0x477754 SafeArrayGetElement
 0x477758 SafeArrayUnaccessData
 0x47775c SafeArrayAccessData
 0x477760 SafeArrayGetUBound
 0x477764 SafeArrayGetLBound
 0x477768 SafeArrayCreate
 0x47776c VariantChangeType
 0x477770 VariantCopyInd
 0x477774 VariantCopy
 0x477778 VariantClear
 0x47777c VariantInit
ole32.dll
 0x477784 OleUninitialize
 0x477788 OleInitialize
 0x47778c CoUninitialize
 0x477790 CoInitialize
oleaut32.dll
 0x477798 GetErrorInfo
 0x47779c SysFreeString
comctl32.dll
 0x4777a4 ImageList_SetIconSize
 0x4777a8 ImageList_GetIconSize
 0x4777ac ImageList_Write
 0x4777b0 ImageList_Read
 0x4777b4 ImageList_GetDragImage
 0x4777b8 ImageList_DragShowNolock
 0x4777bc ImageList_SetDragCursorImage
 0x4777c0 ImageList_DragMove
 0x4777c4 ImageList_DragLeave
 0x4777c8 ImageList_DragEnter
 0x4777cc ImageList_EndDrag
 0x4777d0 ImageList_BeginDrag
 0x4777d4 ImageList_Remove
 0x4777d8 ImageList_DrawEx
 0x4777dc ImageList_Draw
 0x4777e0 ImageList_GetBkColor
 0x4777e4 ImageList_SetBkColor
 0x4777e8 ImageList_ReplaceIcon
 0x4777ec ImageList_Add
 0x4777f0 ImageList_GetImageCount
 0x4777f4 ImageList_Destroy
 0x4777f8 ImageList_Create
shell32.dll
 0x477800 ShellExecuteExW
wininet.dll
 0x477808 InternetReadFile
 0x47780c InternetOpenUrlA
 0x477810 InternetOpenA
 0x477814 InternetCloseHandle
user32.dll
 0x47781c DdeCmpStringHandles
 0x477820 DdeFreeStringHandle
 0x477824 DdeQueryStringA
 0x477828 DdeCreateStringHandleA
 0x47782c DdeGetLastError
 0x477830 DdeFreeDataHandle
 0x477834 DdeUnaccessData
 0x477838 DdeAccessData
 0x47783c DdeCreateDataHandle
 0x477840 DdeClientTransaction
 0x477844 DdeNameService
 0x477848 DdePostAdvise
 0x47784c DdeSetUserHandle
 0x477850 DdeQueryConvInfo
 0x477854 DdeDisconnect
 0x477858 DdeConnect
 0x47785c DdeUninitialize
 0x477860 DdeInitializeA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure