Report - 9690ffbcc2702b682b8b7c44a877583e.exe

Emotet UPX Malicious Packer Malicious Library PE32 OS Processor Check PE File
ScreenShot
Created 2022.05.12 09:54 Machine s1_win7_x6403
Filename 9690ffbcc2702b682b8b7c44a877583e.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
Behavior Score
2.4
ZERO API file : malware
VT API (file) 30 detected (Mokes, Artemis, Fragtor, Kryptik, Eldorado, Attribute, HighConfidence, malicious, high confidence, a variant of Generik, GHCAMZC, Manuscrypt, CLOUD, ai score=88, Sabsik, Unsafe, R002H09EB22, PossibleThreat, ZexaF, tq0@aeOxcfhj, DropperX, confidence)
md5 43cdba67516e86a53370b057d0b0de68
sha256 d083094f008a2e68de555a67105f3d6d82605f4af5d52700e171c833f6da10a1
ssdeep 6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYuEPf:NqN4ACGWCQmGMApM9THEPf
imphash 4660d4f55970ca074db150bc25297558
impfuzzy 192:gdmgnZLUKcQgR4J09EL3BQc1cUcV8LPMNOAxP:ggEBca3+qvzMNOAxP
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Foreign language identified in PE resource
notice Performs some HTTP requests
info Checks amount of memory in system

Rules (7cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_1_Zero Win32 Trojan Emotet binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://apps.identrust.com/roots/dstrootcax3.p7c US Akamai International B.V. 23.53.228.10 clean
apps.identrust.com US Akamai International B.V. 23.53.228.9 clean
v.xyzgamev.com US CLOUDFLARENET 104.21.40.196 mailcious
23.53.228.9 US Akamai International B.V. 23.53.228.9 clean
172.67.188.70 US CLOUDFLARENET 172.67.188.70 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x4330b4 GetFileAttributesA
 0x4330b8 GetFileTime
 0x4330bc HeapFree
 0x4330c0 HeapAlloc
 0x4330c4 VirtualProtect
 0x4330c8 VirtualAlloc
 0x4330cc GetSystemInfo
 0x4330d0 VirtualQuery
 0x4330d4 HeapReAlloc
 0x4330d8 ExitProcess
 0x4330dc GetCommandLineA
 0x4330e0 GetProcessHeap
 0x4330e4 GetStartupInfoA
 0x4330e8 RtlUnwind
 0x4330ec RaiseException
 0x4330f0 HeapSize
 0x4330f4 TerminateProcess
 0x4330f8 UnhandledExceptionFilter
 0x4330fc SetUnhandledExceptionFilter
 0x433100 IsDebuggerPresent
 0x433104 Sleep
 0x433108 HeapDestroy
 0x43310c HeapCreate
 0x433110 VirtualFree
 0x433114 GetStdHandle
 0x433118 FreeEnvironmentStringsA
 0x43311c GetEnvironmentStrings
 0x433120 FreeEnvironmentStringsW
 0x433124 GetEnvironmentStringsW
 0x433128 SetHandleCount
 0x43312c GetFileType
 0x433130 QueryPerformanceCounter
 0x433134 GetSystemTimeAsFileTime
 0x433138 GetACP
 0x43313c GetStringTypeA
 0x433140 GetStringTypeW
 0x433144 GetTimeZoneInformation
 0x433148 GetConsoleCP
 0x43314c GetConsoleMode
 0x433150 LCMapStringA
 0x433154 LCMapStringW
 0x433158 SetStdHandle
 0x43315c WriteConsoleA
 0x433160 GetConsoleOutputCP
 0x433164 WriteConsoleW
 0x433168 SetEnvironmentVariableA
 0x43316c FileTimeToLocalFileTime
 0x433170 GetTickCount
 0x433174 FileTimeToSystemTime
 0x433178 SetErrorMode
 0x43317c GetOEMCP
 0x433180 GetCPInfo
 0x433184 CreateFileA
 0x433188 GetFullPathNameA
 0x43318c GetVolumeInformationA
 0x433190 FindFirstFileA
 0x433194 FindClose
 0x433198 GetCurrentProcess
 0x43319c DuplicateHandle
 0x4331a0 GetFileSize
 0x4331a4 SetEndOfFile
 0x4331a8 UnlockFile
 0x4331ac LockFile
 0x4331b0 FlushFileBuffers
 0x4331b4 SetFilePointer
 0x4331b8 WriteFile
 0x4331bc ReadFile
 0x4331c0 GetThreadLocale
 0x4331c4 InterlockedIncrement
 0x4331c8 TlsFree
 0x4331cc DeleteCriticalSection
 0x4331d0 LocalReAlloc
 0x4331d4 TlsSetValue
 0x4331d8 TlsAlloc
 0x4331dc InitializeCriticalSection
 0x4331e0 GlobalHandle
 0x4331e4 GlobalReAlloc
 0x4331e8 EnterCriticalSection
 0x4331ec TlsGetValue
 0x4331f0 LeaveCriticalSection
 0x4331f4 LocalAlloc
 0x4331f8 GlobalFlags
 0x4331fc FormatMessageA
 0x433200 LocalFree
 0x433204 GlobalGetAtomNameA
 0x433208 GlobalFindAtomA
 0x43320c lstrcmpW
 0x433210 GetVersionExA
 0x433214 MulDiv
 0x433218 InterlockedDecrement
 0x43321c GetModuleFileNameW
 0x433220 GetCurrentProcessId
 0x433224 SetLastError
 0x433228 GlobalAddAtomA
 0x43322c CloseHandle
 0x433230 GlobalUnlock
 0x433234 WritePrivateProfileStringA
 0x433238 FreeResource
 0x43323c GlobalFree
 0x433240 GetCurrentThread
 0x433244 GetCurrentThreadId
 0x433248 ConvertDefaultLocale
 0x43324c GetModuleFileNameA
 0x433250 EnumResourceLanguagesA
 0x433254 GetLocaleInfoA
 0x433258 LoadLibraryA
 0x43325c FindResourceA
 0x433260 LoadResource
 0x433264 LockResource
 0x433268 SizeofResource
 0x43326c GlobalLock
 0x433270 lstrcmpA
 0x433274 GlobalAlloc
 0x433278 FreeLibrary
 0x43327c GlobalDeleteAtom
 0x433280 GetModuleHandleA
 0x433284 GetModuleHandleW
 0x433288 GetProcAddress
 0x43328c GetVersion
 0x433290 CompareStringA
 0x433294 GetLastError
 0x433298 InterlockedExchange
 0x43329c MultiByteToWideChar
 0x4332a0 CompareStringW
 0x4332a4 WideCharToMultiByte
 0x4332a8 lstrlenA
USER32.dll
 0x433318 RegisterClipboardFormatA
 0x43331c PostThreadMessageA
 0x433320 InvalidateRgn
 0x433324 InvalidateRect
 0x433328 SetRect
 0x43332c IsRectEmpty
 0x433330 CopyAcceleratorTableA
 0x433334 CharNextA
 0x433338 ReleaseCapture
 0x43333c LoadCursorA
 0x433340 SetCapture
 0x433344 ShowWindow
 0x433348 MoveWindow
 0x43334c SetWindowTextA
 0x433350 IsDialogMessageA
 0x433354 RegisterWindowMessageA
 0x433358 SendDlgItemMessageA
 0x43335c WinHelpA
 0x433360 IsChild
 0x433364 GetCapture
 0x433368 GetClassLongA
 0x43336c GetClassNameA
 0x433370 SetPropA
 0x433374 GetPropA
 0x433378 RemovePropA
 0x43337c SetFocus
 0x433380 GetWindowTextA
 0x433384 GetForegroundWindow
 0x433388 GetTopWindow
 0x43338c GetMessageTime
 0x433390 MapWindowPoints
 0x433394 SetForegroundWindow
 0x433398 UpdateWindow
 0x43339c GetMenu
 0x4333a0 GetSubMenu
 0x4333a4 GetMenuItemID
 0x4333a8 GetMenuItemCount
 0x4333ac CreateWindowExA
 0x4333b0 GetClassInfoExA
 0x4333b4 GetClassInfoA
 0x4333b8 RegisterClassA
 0x4333bc AdjustWindowRectEx
 0x4333c0 EqualRect
 0x4333c4 CopyRect
 0x4333c8 PtInRect
 0x4333cc GetDlgCtrlID
 0x4333d0 DefWindowProcA
 0x4333d4 CallWindowProcA
 0x4333d8 SetWindowLongA
 0x4333dc OffsetRect
 0x4333e0 IntersectRect
 0x4333e4 SystemParametersInfoA
 0x4333e8 GetWindowPlacement
 0x4333ec GetWindowRect
 0x4333f0 GetSysColor
 0x4333f4 EndPaint
 0x4333f8 BeginPaint
 0x4333fc GetWindowDC
 0x433400 ReleaseDC
 0x433404 GetDC
 0x433408 ClientToScreen
 0x43340c GrayStringA
 0x433410 LoadIconA
 0x433414 IsIconic
 0x433418 SendMessageA
 0x43341c GetSystemMetrics
 0x433420 GetClientRect
 0x433424 DrawIcon
 0x433428 DrawTextExA
 0x43342c DrawTextA
 0x433430 TabbedTextOutA
 0x433434 UnhookWindowsHookEx
 0x433438 GetWindowThreadProcessId
 0x43343c GetLastActivePopup
 0x433440 MessageBoxA
 0x433444 SetCursor
 0x433448 SetWindowsHookExA
 0x43344c CallNextHookEx
 0x433450 GetMessageA
 0x433454 DestroyMenu
 0x433458 UnregisterClassA
 0x43345c TranslateMessage
 0x433460 DispatchMessageA
 0x433464 GetSysColorBrush
 0x433468 MessageBeep
 0x43346c GetMessagePos
 0x433470 GetNextDlgGroupItem
 0x433474 EnableWindow
 0x433478 CharUpperA
 0x43347c wsprintfW
 0x433480 PostMessageA
 0x433484 PostQuitMessage
 0x433488 SetWindowPos
 0x43348c MapDialogRect
 0x433490 GetParent
 0x433494 SetWindowContextHelpId
 0x433498 GetWindow
 0x43349c EndDialog
 0x4334a0 GetNextDlgTabItem
 0x4334a4 IsWindowEnabled
 0x4334a8 GetDlgItem
 0x4334ac GetWindowLongA
 0x4334b0 IsWindow
 0x4334b4 DestroyWindow
 0x4334b8 CreateDialogIndirectParamA
 0x4334bc SetActiveWindow
 0x4334c0 GetActiveWindow
 0x4334c4 GetDesktopWindow
 0x4334c8 CheckMenuItem
 0x4334cc EnableMenuItem
 0x4334d0 GetMenuState
 0x4334d4 ModifyMenuA
 0x4334d8 GetFocus
 0x4334dc LoadBitmapA
 0x4334e0 GetMenuCheckMarkDimensions
 0x4334e4 SetMenuItemBitmaps
 0x4334e8 ValidateRect
 0x4334ec GetCursorPos
 0x4334f0 PeekMessageA
 0x4334f4 GetKeyState
 0x4334f8 IsWindowVisible
GDI32.dll
 0x433030 GetStockObject
 0x433034 GetDeviceCaps
 0x433038 GetTextColor
 0x43303c CreateRectRgnIndirect
 0x433040 GetRgnBox
 0x433044 GetMapMode
 0x433048 DeleteDC
 0x43304c ExtSelectClipRgn
 0x433050 ScaleWindowExtEx
 0x433054 SetWindowExtEx
 0x433058 ScaleViewportExtEx
 0x43305c GetBkColor
 0x433060 CreateBitmap
 0x433064 OffsetViewportOrgEx
 0x433068 SetViewportOrgEx
 0x43306c SelectObject
 0x433070 Escape
 0x433074 ExtTextOutA
 0x433078 TextOutA
 0x43307c RectVisible
 0x433080 PtVisible
 0x433084 GetWindowExtEx
 0x433088 GetViewportExtEx
 0x43308c GetObjectA
 0x433090 DeleteObject
 0x433094 GetClipBox
 0x433098 SetMapMode
 0x43309c SetTextColor
 0x4330a0 SetBkColor
 0x4330a4 RestoreDC
 0x4330a8 SaveDC
 0x4330ac SetViewportExtEx
comdlg32.dll
 0x433510 GetFileTitleA
WINSPOOL.DRV
 0x433500 DocumentPropertiesA
 0x433504 OpenPrinterA
 0x433508 ClosePrinter
ADVAPI32.dll
 0x433000 RegDeleteKeyA
 0x433004 RegQueryValueA
 0x433008 RegOpenKeyA
 0x43300c RegEnumKeyA
 0x433010 RegCloseKey
 0x433014 RegSetValueExA
 0x433018 RegCreateKeyExA
 0x43301c RegOpenKeyExA
 0x433020 RegQueryValueExA
COMCTL32.dll
 0x433028 InitCommonControlsEx
SHLWAPI.dll
 0x433304 PathFindFileNameA
 0x433308 PathStripToRootA
 0x43330c PathFindExtensionA
 0x433310 PathIsUNCA
oledlg.dll
 0x43355c None
ole32.dll
 0x433518 OleInitialize
 0x43351c CoFreeUnusedLibraries
 0x433520 OleUninitialize
 0x433524 CreateILockBytesOnHGlobal
 0x433528 StgCreateDocfileOnILockBytes
 0x43352c StgOpenStorageOnILockBytes
 0x433530 CoGetClassObject
 0x433534 CoRevokeClassObject
 0x433538 CoTaskMemFree
 0x43353c CLSIDFromString
 0x433540 CLSIDFromProgID
 0x433544 CoInitializeSecurity
 0x433548 OleIsCurrentClipboard
 0x43354c OleFlushClipboard
 0x433550 CoRegisterMessageFilter
 0x433554 CoTaskMemAlloc
OLEAUT32.dll
 0x4332b0 SysAllocStringByteLen
 0x4332b4 SysStringByteLen
 0x4332b8 SysFreeString
 0x4332bc VariantInit
 0x4332c0 VariantCopy
 0x4332c4 VariantClear
 0x4332c8 SysAllocStringLen
 0x4332cc SafeArrayGetDim
 0x4332d0 SafeArrayGetLBound
 0x4332d4 SafeArrayGetUBound
 0x4332d8 SafeArrayAccessData
 0x4332dc SafeArrayUnaccessData
 0x4332e0 VariantChangeType
 0x4332e4 SysStringLen
 0x4332e8 OleCreateFontIndirect
 0x4332ec VariantTimeToSystemTime
 0x4332f0 SystemTimeToVariantTime
 0x4332f4 SafeArrayDestroy
 0x4332f8 GetErrorInfo
 0x4332fc SysAllocString

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure