popup

Report - JcDnYBSKpyfU

Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2022.01.18 10:26 Machine s1_win7_x6403
Filename JcDnYBSKpyfU
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score
9
 Behavior Score
6.4
ZERO API file : clean
VT API (file) 10 detected (AIDetect, malware2, malicious, high confidence, Emotet, Eldorado, Attribute, HighConfidence, Kryptik, HOAD, Static AI, Suspicious PE, score)
md5 10f5439bf6c4a72a845ba8945620bdc3
sha256 57a3e0219ded358bbe3e8722d4c8806fd0b0ad844b6b3f3c1898e3abb616fa9a
ssdeep 6144:FjjHl52ek2r4vRnFAbN7ZmNWXpdJlc+kq5Ulcb8/cKzLiag1/kO9IHSCgzUzA:1k2M+BZmNWZdHc+FNb8DzLiag1/knyC
imphash 6d1d8c8ae132591dccaaeee10258dcba
impfuzzy 192:p/+huR0UKCrgsRk5Kz9RUcnc4covhPNPtmZQ:pQOqCN96aTnNPtmZQ
  Network IP location

Signature (12cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
warning Generates some ICMP traffic
watch Communicates with host for which no DNS query was performed
watch File has been identified by 10 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Expresses interest in specific running processes
notice Foreign language identified in PE resource
notice Searches running processes potentially to identify processes for sandbox evasion
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger
info Queries for the computername

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (13cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
54.38.242.185
whois
FR OVH SAS 54.38.242.185 mailcious
191.252.103.16
whois
BR Locaweb Servicos de Internet S/A 191.252.103.16 mailcious
51.210.242.234
whois
FR OVH SAS 51.210.242.234 mailcious
66.42.57.149
whois
SG AS-CHOOPA 66.42.57.149 mailcious
185.148.168.220
whois
DE Everscale GmbH 185.148.168.220 mailcious
62.171.178.147
whois
DE Contabo GmbH 62.171.178.147 mailcious
69.16.218.101
whois
US LIQUIDWEB 69.16.218.101 mailcious
104.131.62.48
whois
US DIGITALOCEAN-ASN 104.131.62.48 mailcious
168.197.250.14
whois
AR Omar Anselmo Ripoll (TDC NET) 168.197.250.14 mailcious
217.182.143.207
whois
FR OVH SAS 217.182.143.207 mailcious
37.44.244.177
whois
DE Hostinger International Limited 37.44.244.177 mailcious
142.4.219.173
whois
CA OVH SAS 142.4.219.173 mailcious
45.138.98.34
whois
DE M247 Ltd 45.138.98.34 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x100380b4 GetFileAttributesA
 0x100380b8 GetFileSizeEx
 0x100380bc GetFileTime
 0x100380c0 GetTickCount
 0x100380c4 GetCommandLineA
 0x100380c8 RtlUnwind
 0x100380cc Sleep
 0x100380d0 ExitProcess
 0x100380d4 HeapReAlloc
 0x100380d8 RaiseException
 0x100380dc GetSystemInfo
 0x100380e0 HeapSize
 0x100380e4 TerminateProcess
 0x100380e8 UnhandledExceptionFilter
 0x100380ec SetUnhandledExceptionFilter
 0x100380f0 IsDebuggerPresent
 0x100380f4 HeapCreate
 0x100380f8 HeapDestroy
 0x100380fc GetStdHandle
 0x10038100 SetHandleCount
 0x10038104 GetFileType
 0x10038108 GetStartupInfoA
 0x1003810c FreeEnvironmentStringsA
 0x10038110 FreeEnvironmentStringsW
 0x10038114 GetEnvironmentStringsW
 0x10038118 QueryPerformanceCounter
 0x1003811c GetSystemTimeAsFileTime
 0x10038120 InitializeCriticalSectionAndSpinCount
 0x10038124 GetACP
 0x10038128 IsValidCodePage
 0x1003812c GetStringTypeA
 0x10038130 GetStringTypeW
 0x10038134 GetTimeZoneInformation
 0x10038138 GetConsoleCP
 0x1003813c GetConsoleMode
 0x10038140 LCMapStringA
 0x10038144 LCMapStringW
 0x10038148 SetStdHandle
 0x1003814c WriteConsoleA
 0x10038150 GetConsoleOutputCP
 0x10038154 WriteConsoleW
 0x10038158 CompareStringW
 0x1003815c SetEnvironmentVariableA
 0x10038160 FileTimeToLocalFileTime
 0x10038164 GetOEMCP
 0x10038168 GetCPInfo
 0x1003816c GetModuleHandleW
 0x10038170 FileTimeToSystemTime
 0x10038174 CreateFileA
 0x10038178 GetFullPathNameA
 0x1003817c GetVolumeInformationA
 0x10038180 FindFirstFileA
 0x10038184 FindClose
 0x10038188 GetCurrentProcess
 0x1003818c DuplicateHandle
 0x10038190 GetFileSize
 0x10038194 SetEndOfFile
 0x10038198 UnlockFile
 0x1003819c LockFile
 0x100381a0 FlushFileBuffers
 0x100381a4 SetFilePointer
 0x100381a8 WriteFile
 0x100381ac ReadFile
 0x100381b0 GetThreadLocale
 0x100381b4 InterlockedIncrement
 0x100381b8 TlsFree
 0x100381bc LocalReAlloc
 0x100381c0 TlsSetValue
 0x100381c4 TlsAlloc
 0x100381c8 GlobalHandle
 0x100381cc GlobalReAlloc
 0x100381d0 TlsGetValue
 0x100381d4 LocalAlloc
 0x100381d8 WritePrivateProfileStringA
 0x100381dc GlobalFlags
 0x100381e0 EnterCriticalSection
 0x100381e4 LeaveCriticalSection
 0x100381e8 DeleteCriticalSection
 0x100381ec InitializeCriticalSection
 0x100381f0 GlobalGetAtomNameA
 0x100381f4 GlobalFindAtomA
 0x100381f8 lstrcmpW
 0x100381fc GetVersionExA
 0x10038200 FormatMessageA
 0x10038204 LocalFree
 0x10038208 MulDiv
 0x1003820c MultiByteToWideChar
 0x10038210 lstrlenA
 0x10038214 GlobalUnlock
 0x10038218 CloseHandle
 0x1003821c FreeResource
 0x10038220 GlobalFree
 0x10038224 GlobalAddAtomA
 0x10038228 GetCurrentProcessId
 0x1003822c GetLastError
 0x10038230 GlobalDeleteAtom
 0x10038234 GetCurrentThread
 0x10038238 GetCurrentThreadId
 0x1003823c ConvertDefaultLocale
 0x10038240 EnumResourceLanguagesA
 0x10038244 GetModuleFileNameA
 0x10038248 GetLocaleInfoA
 0x1003824c CompareStringA
 0x10038250 InterlockedExchange
 0x10038254 GlobalLock
 0x10038258 lstrcmpA
 0x1003825c GlobalAlloc
 0x10038260 GetModuleHandleA
 0x10038264 VirtualProtect
 0x10038268 LockResource
 0x1003826c LoadLibraryA
 0x10038270 VirtualAlloc
 0x10038274 GetProcAddress
 0x10038278 SetLastError
 0x1003827c SizeofResource
 0x10038280 WideCharToMultiByte
 0x10038284 IsBadReadPtr
 0x10038288 GetProcessHeap
 0x1003828c VirtualFree
 0x10038290 HeapFree
 0x10038294 InterlockedDecrement
 0x10038298 HeapAlloc
 0x1003829c LoadResource
 0x100382a0 FreeLibrary
 0x100382a4 VirtualQuery
 0x100382a8 GetNativeSystemInfo
 0x100382ac GetEnvironmentStrings
 0x100382b0 FindResourceA
USER32.dll
 0x1003830c RegisterClipboardFormatA
 0x10038310 PostThreadMessageA
 0x10038314 InvalidateRect
 0x10038318 SetRect
 0x1003831c IsRectEmpty
 0x10038320 CopyAcceleratorTableA
 0x10038324 CharNextA
 0x10038328 CharUpperA
 0x1003832c ReleaseCapture
 0x10038330 SetCapture
 0x10038334 LoadCursorA
 0x10038338 GetSysColorBrush
 0x1003833c ShowWindow
 0x10038340 MoveWindow
 0x10038344 SetWindowTextA
 0x10038348 IsDialogMessageA
 0x1003834c RegisterWindowMessageA
 0x10038350 SendDlgItemMessageA
 0x10038354 WinHelpA
 0x10038358 IsChild
 0x1003835c GetCapture
 0x10038360 GetClassLongA
 0x10038364 GetClassNameA
 0x10038368 SetPropA
 0x1003836c GetPropA
 0x10038370 RemovePropA
 0x10038374 SetFocus
 0x10038378 GetWindowTextA
 0x1003837c GetForegroundWindow
 0x10038380 GetTopWindow
 0x10038384 GetMessageTime
 0x10038388 GetMessagePos
 0x1003838c MapWindowPoints
 0x10038390 SetMenu
 0x10038394 SetForegroundWindow
 0x10038398 UpdateWindow
 0x1003839c CreateWindowExA
 0x100383a0 GetClassInfoExA
 0x100383a4 GetClassInfoA
 0x100383a8 RegisterClassA
 0x100383ac AdjustWindowRectEx
 0x100383b0 EqualRect
 0x100383b4 PtInRect
 0x100383b8 GetDlgCtrlID
 0x100383bc DefWindowProcA
 0x100383c0 CallWindowProcA
 0x100383c4 GetMenu
 0x100383c8 SetWindowLongA
 0x100383cc OffsetRect
 0x100383d0 IntersectRect
 0x100383d4 GetWindowPlacement
 0x100383d8 GetWindowRect
 0x100383dc SystemParametersInfoA
 0x100383e0 DestroyMenu
 0x100383e4 CopyRect
 0x100383e8 GetMenuItemID
 0x100383ec GetMenuItemCount
 0x100383f0 GetSubMenu
 0x100383f4 UnhookWindowsHookEx
 0x100383f8 GetSysColor
 0x100383fc EndPaint
 0x10038400 BeginPaint
 0x10038404 GetWindowDC
 0x10038408 ReleaseDC
 0x1003840c EnableWindow
 0x10038410 GetSystemMetrics
 0x10038414 AppendMenuA
 0x10038418 SendMessageA
 0x1003841c GetDC
 0x10038420 ClientToScreen
 0x10038424 GrayStringA
 0x10038428 DrawTextExA
 0x1003842c DrawTextA
 0x10038430 TabbedTextOutA
 0x10038434 GetDesktopWindow
 0x10038438 SetActiveWindow
 0x1003843c CreateDialogIndirectParamA
 0x10038440 DestroyWindow
 0x10038444 IsWindow
 0x10038448 MessageBeep
 0x1003844c GetNextDlgGroupItem
 0x10038450 InvalidateRgn
 0x10038454 GetClientRect
 0x10038458 DrawIcon
 0x1003845c LoadIconA
 0x10038460 IsIconic
 0x10038464 GetSystemMenu
 0x10038468 CheckMenuItem
 0x1003846c EnableMenuItem
 0x10038470 GetMenuState
 0x10038474 ModifyMenuA
 0x10038478 GetParent
 0x1003847c GetFocus
 0x10038480 LoadBitmapA
 0x10038484 GetMenuCheckMarkDimensions
 0x10038488 SetMenuItemBitmaps
 0x1003848c PostQuitMessage
 0x10038490 PostMessageA
 0x10038494 SetCursor
 0x10038498 MessageBoxA
 0x1003849c IsWindowEnabled
 0x100384a0 GetLastActivePopup
 0x100384a4 GetWindowLongA
 0x100384a8 GetWindowThreadProcessId
 0x100384ac SetWindowPos
 0x100384b0 MapDialogRect
 0x100384b4 SetWindowContextHelpId
 0x100384b8 GetWindow
 0x100384bc ValidateRect
 0x100384c0 GetCursorPos
 0x100384c4 PeekMessageA
 0x100384c8 GetKeyState
 0x100384cc IsWindowVisible
 0x100384d0 GetActiveWindow
 0x100384d4 DispatchMessageA
 0x100384d8 TranslateMessage
 0x100384dc GetMessageA
 0x100384e0 CallNextHookEx
 0x100384e4 SetWindowsHookExA
 0x100384e8 EndDialog
 0x100384ec GetDlgItem
 0x100384f0 GetNextDlgTabItem
GDI32.dll
 0x10038030 GetDeviceCaps
 0x10038034 GetStockObject
 0x10038038 GetBkColor
 0x1003803c GetTextColor
 0x10038040 CreateRectRgnIndirect
 0x10038044 GetRgnBox
 0x10038048 GetMapMode
 0x1003804c DeleteDC
 0x10038050 ExtSelectClipRgn
 0x10038054 ScaleWindowExtEx
 0x10038058 SetWindowExtEx
 0x1003805c CreateBitmap
 0x10038060 ScaleViewportExtEx
 0x10038064 SetViewportExtEx
 0x10038068 OffsetViewportOrgEx
 0x1003806c SetViewportOrgEx
 0x10038070 SelectObject
 0x10038074 Escape
 0x10038078 ExtTextOutA
 0x1003807c TextOutA
 0x10038080 RectVisible
 0x10038084 PtVisible
 0x10038088 GetWindowExtEx
 0x1003808c GetViewportExtEx
 0x10038090 GetObjectA
 0x10038094 DeleteObject
 0x10038098 GetClipBox
 0x1003809c SetMapMode
 0x100380a0 SetTextColor
 0x100380a4 SetBkColor
 0x100380a8 RestoreDC
 0x100380ac SaveDC
COMDLG32.dll
 0x10038028 GetFileTitleA
WINSPOOL.DRV
 0x100384f8 DocumentPropertiesA
 0x100384fc ClosePrinter
 0x10038500 OpenPrinterA
ADVAPI32.dll
 0x10038000 RegSetValueExA
 0x10038004 RegCreateKeyExA
 0x10038008 RegQueryValueA
 0x1003800c RegOpenKeyA
 0x10038010 RegEnumKeyA
 0x10038014 RegDeleteKeyA
 0x10038018 RegOpenKeyExA
 0x1003801c RegQueryValueExA
 0x10038020 RegCloseKey
SHLWAPI.dll
 0x100382f8 PathFindFileNameA
 0x100382fc PathStripToRootA
 0x10038300 PathIsUNCA
 0x10038304 PathFindExtensionA
oledlg.dll
 0x10038550 None
ole32.dll
 0x10038508 CoRevokeClassObject
 0x1003850c OleInitialize
 0x10038510 CoFreeUnusedLibraries
 0x10038514 OleUninitialize
 0x10038518 CreateILockBytesOnHGlobal
 0x1003851c StgCreateDocfileOnILockBytes
 0x10038520 StgOpenStorageOnILockBytes
 0x10038524 CoGetClassObject
 0x10038528 OleIsCurrentClipboard
 0x1003852c CoTaskMemAlloc
 0x10038530 CoTaskMemFree
 0x10038534 CLSIDFromString
 0x10038538 CLSIDFromProgID
 0x1003853c CoInitialize
 0x10038540 CoUninitialize
 0x10038544 OleFlushClipboard
 0x10038548 CoRegisterMessageFilter
OLEAUT32.dll
 0x100382b8 SysAllocStringByteLen
 0x100382bc SysStringByteLen
 0x100382c0 SysFreeString
 0x100382c4 SysAllocStringLen
 0x100382c8 SysStringLen
 0x100382cc VariantChangeType
 0x100382d0 VariantInit
 0x100382d4 OleCreateFontIndirect
 0x100382d8 VariantTimeToSystemTime
 0x100382dc SystemTimeToVariantTime
 0x100382e0 SafeArrayDestroy
 0x100382e4 SysAllocString
 0x100382e8 VariantCopy
 0x100382ec GetErrorInfo
 0x100382f0 VariantClear

EAT(Export Address Table) Library

0x10034690 DllRegisterServer

Similarity measure (PE file only) - Checking for service failure