Report - 7576_1635862012_3623.dll

PE64 PE File DLL
ScreenShot
Created 2021.11.04 14:53 Machine s1_win7_x6403
Filename 7576_1635862012_3623.dll
Type PE32+ executable (DLL) (native) x86-64, for MS Windows
AI Score
5
Behavior Score
3.4
ZERO API file : clean
VT API (file) 15 detected (malicious, high confidence, GenericKD, IcedID, 739U9R, confidence, Artemis, Outbreak, score, ai score=83)
md5 628b068ebb6c34efd8b4d21d4f4c7723
sha256 04d14e3e9c577b0fd56c1c63a6c9bdc5220db0b6af8d373831da2a3a79c45881
ssdeep 12288:FJJl5XrG1wZ0OWt1J9JYPlEldxAaCActqm9bAfqb0PvrlwRF2UDLL2:bvaQc
imphash
impfuzzy 3::
  Network IP location

Signature (10cnts)

Level Description
watch File has been identified by 15 AntiVirus engines on VirusTotal as malicious
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (3cnts)

Level Name Description Collection
info IsDLL (no description) binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (6cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://actuallyobligat.info/ CA Linode, LLC 172.105.27.36 clean
https://aws.amazon.com/ US AMAZON-02 99.86.203.74 clean
actuallyobligat.info CA Linode, LLC 172.105.27.36 clean
aws.amazon.com Unknown 54.230.166.71 clean
99.86.203.74 US AMAZON-02 99.86.203.74 clean
172.105.27.36 CA Linode, LLC 172.105.27.36 clean

Suricata ids

PE API

IAT(Import Address Table) is none

EAT(Export Address Table) Library

0x180001360 DllGetClassObject
0x180001000 DllRegisterServer
0x180001690 PluginInit


Similarity measure (PE file only) - Checking for service failure