popup

Report - nevermiss.exe

Gen1 Generic Malware ASPack Malicious Library UPX Anti_VM PE64 PE File OS Processor Check DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.11.15 14:43 Machine s1_win7_x6403
Filename nevermiss.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score
1
 Behavior Score
2.4
ZERO API file : clean
VT API (file) 14 detected (Malicious, score, Artemis, UnclassifiedMalware@0, Shelma, ASMalwS, Sabsik, Disco, B+fnOLVqvK8, FileRepMalware)
md5 0ac34cf9b5240f5891b1858be02adc14
sha256 c96669b662ee39a964547bd29dc74ab5a8f19d41f4e19ee2b2f53d05afd4cca9
ssdeep 98304:s+0xoEgGh5vBHAq+xapjlZVDYucrK7W/Qeqn3nvkOPWCqGOBx+aGiF5D29:s+AJlh5vBH+apjlIBd/Hq3MOuCqNBxXa
imphash 1861bc6d7cdbc03b4f60bf54c0a672fe
impfuzzy 48:CkCP9rteS1hEc+pFCRcgT+ONai5bmbU1M:lCPFteS1hEc+pF8t+Cr+yM
  Network IP location

Signature (7cnts)

Level Description
watch File has been identified by 14 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Command line console output was observed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (15cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
watch ASPack_Zero ASPack packed file binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
info IsDLL (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x140025028 GetCommandLineW
 0x140025030 GetEnvironmentVariableW
 0x140025038 SetEnvironmentVariableW
 0x140025040 ExpandEnvironmentStringsW
 0x140025048 CreateDirectoryW
 0x140025050 GetTempPathW
 0x140025058 WaitForSingleObject
 0x140025060 Sleep
 0x140025068 GetExitCodeProcess
 0x140025070 GetStartupInfoW
 0x140025078 FreeLibrary
 0x140025080 LoadLibraryExW
 0x140025088 CloseHandle
 0x140025090 GetCurrentProcess
 0x140025098 LocalFree
 0x1400250a0 FormatMessageW
 0x1400250a8 MultiByteToWideChar
 0x1400250b0 WideCharToMultiByte
 0x1400250b8 SetEndOfFile
 0x1400250c0 GetProcAddress
 0x1400250c8 GetModuleFileNameW
 0x1400250d0 SetDllDirectoryW
 0x1400250d8 CreateProcessW
 0x1400250e0 GetLastError
 0x1400250e8 RtlCaptureContext
 0x1400250f0 RtlLookupFunctionEntry
 0x1400250f8 RtlVirtualUnwind
 0x140025100 UnhandledExceptionFilter
 0x140025108 SetUnhandledExceptionFilter
 0x140025110 TerminateProcess
 0x140025118 IsProcessorFeaturePresent
 0x140025120 QueryPerformanceCounter
 0x140025128 GetCurrentProcessId
 0x140025130 GetCurrentThreadId
 0x140025138 GetSystemTimeAsFileTime
 0x140025140 InitializeSListHead
 0x140025148 IsDebuggerPresent
 0x140025150 GetModuleHandleW
 0x140025158 RtlUnwindEx
 0x140025160 SetLastError
 0x140025168 EnterCriticalSection
 0x140025170 LeaveCriticalSection
 0x140025178 DeleteCriticalSection
 0x140025180 InitializeCriticalSectionAndSpinCount
 0x140025188 TlsAlloc
 0x140025190 TlsGetValue
 0x140025198 TlsSetValue
 0x1400251a0 TlsFree
 0x1400251a8 RaiseException
 0x1400251b0 GetCommandLineA
 0x1400251b8 ReadFile
 0x1400251c0 CreateFileW
 0x1400251c8 GetDriveTypeW
 0x1400251d0 GetFileInformationByHandle
 0x1400251d8 GetFileType
 0x1400251e0 PeekNamedPipe
 0x1400251e8 SystemTimeToTzSpecificLocalTime
 0x1400251f0 FileTimeToSystemTime
 0x1400251f8 GetFullPathNameW
 0x140025200 RemoveDirectoryW
 0x140025208 FindClose
 0x140025210 FindFirstFileExW
 0x140025218 FindNextFileW
 0x140025220 SetStdHandle
 0x140025228 SetConsoleCtrlHandler
 0x140025230 DeleteFileW
 0x140025238 GetStdHandle
 0x140025240 WriteFile
 0x140025248 ExitProcess
 0x140025250 GetModuleHandleExW
 0x140025258 HeapFree
 0x140025260 GetConsoleMode
 0x140025268 ReadConsoleW
 0x140025270 SetFilePointerEx
 0x140025278 GetConsoleOutputCP
 0x140025280 GetFileSizeEx
 0x140025288 HeapAlloc
 0x140025290 CompareStringW
 0x140025298 LCMapStringW
 0x1400252a0 GetCurrentDirectoryW
 0x1400252a8 FlushFileBuffers
 0x1400252b0 GetFileAttributesExW
 0x1400252b8 IsValidCodePage
 0x1400252c0 GetACP
 0x1400252c8 GetOEMCP
 0x1400252d0 GetCPInfo
 0x1400252d8 GetEnvironmentStringsW
 0x1400252e0 FreeEnvironmentStringsW
 0x1400252e8 GetStringTypeW
 0x1400252f0 GetProcessHeap
 0x1400252f8 GetTimeZoneInformation
 0x140025300 HeapSize
 0x140025308 HeapReAlloc
 0x140025310 WriteConsoleW
ADVAPI32.dll
 0x140025000 ConvertSidToStringSidW
 0x140025008 GetTokenInformation
 0x140025010 OpenProcessToken
 0x140025018 ConvertStringSecurityDescriptorToSecurityDescriptorW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure