Report - alltud.exe

Malicious Library PE File PE32
ScreenShot
Created 2021.11.12 10:42 Machine s1_win7_x6401
Filename alltud.exe
Type MS-DOS executable, MZ for MS-DOS
AI Score
6
Behavior Score
2.2
ZERO API file : clean
VT API (file) 22 detected (malicious, high confidence, Unsafe, Attribute, HighConfidence, GenKryptik, FNJC, FileRepMalware, score, Artemis, kcloud, Sabsik, Static AI, Malicious PE, InvalidSig, confidence, susgen)
md5 b380ac326f09bcbd2f78db3d4850d0de
sha256 7a22abe44125262891da6100624d331c845966016cdcb4394b225236537c28f0
ssdeep 12288:8s2pz1td9YYgxUnNm2AVHSr9sWB3EtUeinhnNF:T2n9YYpNmTxg9s/UZ
imphash 3ba619e6082d480a3d780a5746cabb8b
impfuzzy 192:AgcH7kT88zzOzPMQws8oiNshmd4y/U4b3NLunfbPT:zXHOrMQwswUmtgTT
  Network IP location

Signature (5cnts)

Level Description
warning File has been identified by 22 AntiVirus engines on VirusTotal as malicious
watch Manipulates memory of a non-child process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (3cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

advapi32.dll
 0x4474e7 RegQueryValueExA
 0x4474eb RegOpenKeyExA
 0x4474ef RegOpenKeyA
 0x4474f3 RegCloseKey
comctl32.dll
 0x4474fb ImageList_ReplaceIcon
 0x4474ff ImageList_DragMove
 0x447503 ImageList_Create
 0x447507 ImageList_GetIcon
 0x44750b ImageList_SetDragCursorImage
 0x44750f ImageList_GetDragImage
 0x447513 ImageList_Replace
 0x447517 ImageList_SetIconSize
 0x44751b ImageList_Remove
 0x44751f ImageList_BeginDrag
 0x447523 ImageList_EndDrag
 0x447527 ImageList_GetBkColor
 0x44752b ImageList_DragEnter
 0x44752f ImageList_DragLeave
 0x447533 ImageList_GetIconSize
 0x447537 ImageList_GetImageCount
 0x44753b ImageList_DrawEx
 0x44753f ImageList_Read
 0x447543 ImageList_DragShowNolock
 0x447547 ImageList_Destroy
 0x44754b ImageList_Draw
 0x44754f ImageList_SetBkColor
 0x447553 ImageList_Write
 0x447557 ImageList_Add
gdi32.dll
 0x44755f GetStockObject
 0x447563 GetWindowOrgEx
 0x447567 DeleteObject
 0x44756b PtInRegion
 0x44756f GetTextExtentPoint32A
 0x447573 GetCurrentPositionEx
 0x447577 CreatePalette
 0x44757b GetTextExtentPointA
 0x44757f CreateDIBSection
 0x447583 GetDCOrgEx
 0x447587 LineTo
 0x44758b CreateSolidBrush
 0x44758f BitBlt
 0x447593 GetSystemPaletteEntries
 0x447597 DeleteEnhMetaFile
 0x44759b SaveDC
 0x44759f DeleteDC
 0x4475a3 PatBlt
 0x4475a7 Pie
 0x4475ab SetViewportOrgEx
 0x4475af GetWinMetaFileBits
 0x4475b3 SetWinMetaFileBits
 0x4475b7 CreatePenIndirect
 0x4475bb CreateDIBitmap
 0x4475bf ExcludeClipRect
 0x4475c3 GetEnhMetaFileBits
 0x4475c7 RoundRect
 0x4475cb UnrealizeObject
 0x4475cf CreateRectRgn
 0x4475d3 GetBitmapBits
 0x4475d7 CreateCompatibleBitmap
 0x4475db SetViewportExtEx
 0x4475df PlayEnhMetaFile
 0x4475e3 GetPixel
 0x4475e7 IntersectClipRect
 0x4475eb SetBrushOrgEx
 0x4475ef SetDIBColorTable
 0x4475f3 GetTextMetricsA
 0x4475f7 Polygon
 0x4475fb SetPixel
 0x4475ff SetStretchBltMode
 0x447603 GetDIBits
 0x447607 GetDIBColorTable
 0x44760b SetMapMode
 0x44760f PolyPolyline
 0x447613 SetWindowOrgEx
 0x447617 CopyEnhMetaFileA
 0x44761b RestoreDC
 0x44761f CreateFontIndirectA
 0x447623 CreateHalftonePalette
 0x447627 SetEnhMetaFileBits
 0x44762b RealizePalette
 0x44762f GetEnhMetaFileHeader
 0x447633 CreateBrushIndirect
 0x447637 SetBkColor
 0x44763b ExtCreatePen
 0x44763f SetTextColor
 0x447643 MaskBlt
 0x447647 SetROP2
 0x44764b Rectangle
 0x44764f Polyline
 0x447653 SetWindowExtEx
 0x447657 SetRectRgn
 0x44765b GetClipBox
 0x44765f ExtCreateRegion
 0x447663 Ellipse
 0x447667 MoveToEx
 0x44766b StretchBlt
 0x44766f RectVisible
 0x447673 GdiFlush
 0x447677 CreateCompatibleDC
 0x44767b GetEnhMetaFilePaletteEntries
 0x44767f GetPaletteEntries
 0x447683 GetBrushOrgEx
 0x447687 SelectObject
 0x44768b CombineRgn
 0x44768f SelectPalette
 0x447693 SetBkMode
 0x447697 ExtTextOutA
 0x44769b GetObjectA
 0x44769f GetDeviceCaps
 0x4476a3 CreateBitmap
kernel32.dll
 0x4476ab FindFirstFileA
 0x4476af GetModuleHandleA
 0x4476b3 LocalFree
 0x4476b7 GlobalHandle
 0x4476bb InitializeCriticalSection
 0x4476bf GetStdHandle
 0x4476c3 FileTimeToLocalFileTime
 0x4476c7 GlobalUnlock
 0x4476cb GetOEMCP
 0x4476cf TlsAlloc
 0x4476d3 FindResourceA
 0x4476d7 lstrlenA
 0x4476db GetCurrentProcessId
 0x4476df WriteFile
 0x4476e3 DeleteCriticalSection
 0x4476e7 CreateThread
 0x4476eb MulDiv
 0x4476ef GetProcAddress
 0x4476f3 lstrcpyA
 0x4476f7 GetModuleHandleW
 0x4476fb GetFullPathNameA
 0x4476ff LCMapStringA
 0x447703 GetACP
 0x447707 SetEvent
 0x44770b MultiByteToWideChar
 0x44770f GetDiskFreeSpaceA
 0x447713 SetThreadLocale
 0x447717 GlobalLock
 0x44771b FindClose
 0x44771f VirtualAlloc
 0x447723 LockResource
 0x447727 InterlockedExchange
 0x44772b GetEnvironmentVariableA
 0x44772f GetLocaleInfoA
 0x447733 GetCommandLineA
 0x447737 GetEnvironmentStrings
 0x44773b DeleteFileA
 0x44773f VirtualFree
 0x447743 SetLastError
 0x447747 UnhandledExceptionFilter
 0x44774b CloseHandle
 0x44774f InterlockedIncrement
 0x447753 GetTickCount
 0x447757 GlobalAddAtomA
 0x44775b OutputDebugStringA
 0x44775f EnterCriticalSection
 0x447763 GetDriveTypeA
 0x447767 GetModuleFileNameA
 0x44776b FreeResource
 0x44776f lstrcpynA
 0x447773 HeapFree
 0x447777 LoadResource
 0x44777b GlobalFree
 0x44777f GetProcessHeap
 0x447783 GetSystemInfo
 0x447787 ReadFile
 0x44778b VirtualQuery
 0x44778f RaiseException
 0x447793 FileTimeToDosDateTime
 0x447797 GetLocalTime
 0x44779b SetConsoleCtrlHandler
 0x44779f TlsFree
 0x4477a3 LeaveCriticalSection
 0x4477a7 GetCurrentDirectoryA
 0x4477ab SetHandleCount
 0x4477af CreateMutexA
 0x4477b3 FindNextFileA
 0x4477b7 GetStartupInfoA
 0x4477bb FreeLibrary
 0x4477bf GetVersion
 0x4477c3 GlobalDeleteAtom
 0x4477c7 GetCurrentProcess
 0x4477cb LocalAlloc
 0x4477cf CompareStringA
 0x4477d3 GetCurrentThreadId
 0x4477d7 VirtualProtectEx
 0x4477db SetFilePointer
 0x4477df HeapAlloc
 0x4477e3 InterlockedDecrement
 0x4477e7 FormatMessageA
 0x4477eb CreateEventA
 0x4477ef GlobalAlloc
 0x4477f3 LoadLibraryA
 0x4477f7 GetFileType
 0x4477fb SetCurrentDirectoryA
 0x4477ff TlsGetValue
 0x447803 SizeofResource
 0x447807 LoadLibraryExA
 0x44780b DeviceIoControl
 0x44780f CreateFileA
 0x447813 GetLastError
 0x447817 GetVersionExA
 0x44781b WideCharToMultiByte
 0x44781f GetFileSize
 0x447823 SetErrorMode
 0x447827 WaitForSingleObject
 0x44782b EnumCalendarInfoA
 0x44782f GetStringTypeW
 0x447833 GlobalReAlloc
 0x447837 GetFileAttributesA
 0x44783b Sleep
 0x44783f GetThreadLocale
 0x447843 ExitProcess
 0x447847 GetCPInfo
 0x44784b SetEndOfFile
 0x44784f TlsSetValue
 0x447853 RtlUnwind
 0x447857 SetEnvironmentVariableA
 0x44785b GetDateFormatA
ole32.dll
 0x447863 CoUninitialize
 0x447867 CoInitializeSecurity
 0x44786b CoSetProxyBlanket
 0x44786f CoInitializeEx
 0x447873 CoCreateInstance
 0x447877 IsEqualGUID
oleaut32.dll
 0x44787f SysStringLen
 0x447883 VariantCopyInd
 0x447887 SysFreeString
 0x44788b VariantClear
 0x44788f SysReAllocStringLen
 0x447893 VariantChangeTypeEx
 0x447897 SysAllocStringLen
samlib.dll
 0x44789f SamEnumerateDomainsInSamServer
secur32.dll
 0x4478a7 SaslEnumerateProfilesW
shell32.dll
 0x4478af Shell_NotifyIconA
user32.dll
 0x4478b7 GetWindowThreadProcessId
 0x4478bb SetWindowPlacement
 0x4478bf SetWindowTextA
 0x4478c3 CharUpperBuffA
 0x4478c7 SetWindowsHookExA
 0x4478cb GetLastActivePopup
 0x4478cf MapVirtualKeyA
 0x4478d3 ReleaseCapture
 0x4478d7 LoadIconA
 0x4478db GetIconInfo
 0x4478df PostMessageA
 0x4478e3 EnumThreadWindows
 0x4478e7 DrawMenuBar
 0x4478eb GetMenuState
 0x4478ef IsDialogMessageA
 0x4478f3 EnableMenuItem
 0x4478f7 WinHelpA
 0x4478fb GetKeyboardLayoutList
 0x4478ff GetDCEx
 0x447903 SetClassLongA
 0x447907 GetCursor
 0x44790b wsprintfA
 0x44790f GetSubMenu
 0x447913 GetKeyState
 0x447917 UnionRect
 0x44791b DrawTextA
 0x44791f SetScrollPos
 0x447923 OffsetRect
 0x447927 CharLowerBuffA
 0x44792b SetWindowLongA
 0x44792f GetClientRect
 0x447933 SetScrollInfo
 0x447937 GetDC
 0x44793b InvalidateRect
 0x44793f GetKeyboardType
 0x447943 GetScrollPos
 0x447947 GetForegroundWindow
 0x44794b GetDoubleClickTime
 0x44794f GetActiveWindow
 0x447953 PtInRect
 0x447957 CharLowerA
 0x44795b IntersectRect
 0x44795f IsWindowEnabled
 0x447963 SetWindowPos
 0x447967 GetScrollInfo
 0x44796b IsRectEmpty
 0x44796f IsIconic
 0x447973 SetMenu
 0x447977 EndPaint
 0x44797b IsWindow
 0x44797f GetKeyboardState
 0x447983 GetKeyboardLayout
 0x447987 GetWindowLongA
 0x44798b IsZoomed
 0x44798f SetForegroundWindow
 0x447993 RegisterClassA
 0x447997 MessageBoxA
 0x44799b DeleteMenu
 0x44799f DestroyIcon
 0x4479a3 CreateWindowExA
 0x4479a7 EqualRect
 0x4479ab FindWindowA
 0x4479af DeferWindowPos
 0x4479b3 UpdateWindow
 0x4479b7 GetWindowRect
 0x4479bb ShowCursor
 0x4479bf DestroyWindow
 0x4479c3 ScrollWindowEx
 0x4479c7 UnregisterClassA
 0x4479cb SetActiveWindow
 0x4479cf CharNextA
 0x4479d3 BeginPaint
 0x4479d7 ValidateRect
 0x4479db SetClipboardData
 0x4479df ScrollWindow
 0x4479e3 MapWindowPoints
 0x4479e7 SetPropA
 0x4479eb RemoveMenu
 0x4479ef GetSysColor
 0x4479f3 OemToCharA
 0x4479f7 CreateIcon
 0x4479fb SystemParametersInfoA
 0x4479ff EnableScrollBar
 0x447a03 SendMessageA
 0x447a07 RegisterClipboardFormatA
 0x447a0b GetClipboardData
 0x447a0f EmptyClipboard
 0x447a13 EnumClipboardFormats
 0x447a17 DefWindowProcA
 0x447a1b ReleaseDC
 0x447a1f CallNextHookEx
 0x447a23 SetScrollRange
 0x447a27 AdjustWindowRectEx
 0x447a2b GetWindow
 0x447a2f DrawIconEx
 0x447a33 ShowScrollBar
 0x447a37 GetMenuItemCount
 0x447a3b DrawIcon
 0x447a3f EnableWindow
 0x447a43 LoadKeyboardLayoutA
 0x447a47 DrawFrameControl
 0x447a4b GetParent
 0x447a4f GetMessageTime
 0x447a53 SetCapture
 0x447a57 TrackMouseEvent
 0x447a5b IsWindowVisible
 0x447a5f GetMenuItemInfoA
 0x447a63 DestroyMenu
 0x447a67 LoadBitmapA
 0x447a6b GetCapture
 0x447a6f LoadCursorA
 0x447a73 ActivateKeyboardLayout
 0x447a77 MessageBeep
 0x447a7b CheckMenuItem
 0x447a7f SetTimer
 0x447a83 FillRect
 0x447a87 WindowFromPoint
 0x447a8b RemovePropA
 0x447a8f LoadStringA
 0x447a93 GetFocus
 0x447a97 IsCharAlphaNumericA
 0x447a9b GetWindowTextA
 0x447a9f RegisterWindowMessageA
 0x447aa3 IsChild
 0x447aa7 GetCursorPos
 0x447aab ShowOwnedPopups
 0x447aaf UnhookWindowsHookEx
 0x447ab3 GetPropA
 0x447ab7 CloseClipboard
 0x447abb TranslateMDISysAccel
 0x447abf GetDesktopWindow
 0x447ac3 BeginDeferWindowPos
 0x447ac7 SetFocus
 0x447acb SetRect
 0x447acf GetTopWindow
 0x447ad3 DrawEdge
 0x447ad7 TrackPopupMenu
 0x447adb SetKeyboardState
 0x447adf GetScrollRange
 0x447ae3 ShowWindow
 0x447ae7 EnumWindows
 0x447aeb InflateRect
 0x447aef TranslateMessage
 0x447af3 GetSystemMenu
 0x447af7 GetWindowPlacement
 0x447afb GetMenuItemID
 0x447aff CreateMenu
 0x447b03 KillTimer
 0x447b07 EndDeferWindowPos
 0x447b0b OpenClipboard
 0x447b0f IsCharAlphaA
 0x447b13 GetWindowDC
 0x447b17 DispatchMessageA
 0x447b1b DefMDIChildProcA
 0x447b1f SetCursor
 0x447b23 GetSystemMetrics
 0x447b27 DestroyCursor
 0x447b2b ScreenToClient
 0x447b2f GetKeyNameTextA
 0x447b33 SetMenuItemInfoA
 0x447b37 PostQuitMessage
 0x447b3b GetMenuStringA
 0x447b3f DrawFocusRect
 0x447b43 CreatePopupMenu
 0x447b47 FrameRect
 0x447b4b ClientToScreen
 0x447b4f SetWindowRgn
ws2_32.dll
 0x447b57 socket
 0x447b5b getsockname

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure