Report - artifact.exe

Malicious Library PE File PE32
ScreenShot
Created 2021.11.09 10:10 Machine s1_win7_x6401
Filename artifact.exe
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
AI Score
7
Behavior Score
3.6
ZERO API file : clean
VT API (file) 53 detected (Sheljector, trJD, malicious, high confidence, Inject3, GenericKD, GenericPMF, S22096310, Unsafe, Rozena, CobaltStrike, CozyDuke, Diple, Eldorado, Cobalt, horsiq, Hacktool, GenericRXMO, ftawl, XPACK, Gen7, ai score=88, ASMalwS, score, R329694, TScope, CLASSIC, GenAsa, C5jzoNrl5s, Static AI, Malicious PE, confidence, 100%, susgen)
md5 eba3ab1cdf7058b3cb52fe63dd2950df
sha256 048e6ec52783601283af5c10ca2b61d437b8cb30cb7d603da823d33d478e71f0
ssdeep 192:AfH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzAW5rubqUqV/Qjo7AGa:AP+kGKqbOCdWIVBff+xzvYfCXAn
imphash dc25ee78e2ef4d36faa0badf1e7461c9
impfuzzy 24:Q2kfiK1JlDzncLLb9Lezd5XGDZEkqkoDquQZn:gfiK1jcTtezdJGVEkqkoqz
  Network IP location

Signature (4cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 53 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)

Rules (3cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
66.42.44.124 JP AS-CHOOPA 66.42.44.124 clean
198.46.132.206 US AS-COLOCROSSING 198.46.132.206 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x406138 CloseHandle
 0x40613c ConnectNamedPipe
 0x406140 CreateFileA
 0x406144 CreateNamedPipeA
 0x406148 CreateThread
 0x40614c DeleteCriticalSection
 0x406150 EnterCriticalSection
 0x406154 FreeLibrary
 0x406158 GetCurrentProcess
 0x40615c GetCurrentProcessId
 0x406160 GetCurrentThreadId
 0x406164 GetLastError
 0x406168 GetModuleHandleA
 0x40616c GetProcAddress
 0x406170 GetStartupInfoA
 0x406174 GetSystemTimeAsFileTime
 0x406178 GetTickCount
 0x40617c InitializeCriticalSection
 0x406180 LeaveCriticalSection
 0x406184 LoadLibraryA
 0x406188 LoadLibraryW
 0x40618c QueryPerformanceCounter
 0x406190 ReadFile
 0x406194 SetUnhandledExceptionFilter
 0x406198 Sleep
 0x40619c TerminateProcess
 0x4061a0 TlsGetValue
 0x4061a4 UnhandledExceptionFilter
 0x4061a8 VirtualAlloc
 0x4061ac VirtualProtect
 0x4061b0 VirtualQuery
 0x4061b4 WriteFile
msvcrt.dll
 0x4061bc __dllonexit
 0x4061c0 __getmainargs
 0x4061c4 __initenv
 0x4061c8 __lconv_init
 0x4061cc __set_app_type
 0x4061d0 __setusermatherr
 0x4061d4 _acmdln
 0x4061d8 _amsg_exit
 0x4061dc _cexit
 0x4061e0 _fmode
 0x4061e4 _initterm
 0x4061e8 _iob
 0x4061ec _lock
 0x4061f0 _onexit
 0x4061f4 _unlock
 0x4061f8 _winmajor
 0x4061fc abort
 0x406200 calloc
 0x406204 exit
 0x406208 fprintf
 0x40620c free
 0x406210 fwrite
 0x406214 malloc
 0x406218 memcpy
 0x40621c signal
 0x406220 sprintf
 0x406224 strlen
 0x406228 strncmp
 0x40622c vfprintf

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure