Report - Ghpwvaau.exe

UPX Malicious Library PE32 PE File
ScreenShot
Created 2022.05.24 09:38 Machine s1_win7_x6403
Filename Ghpwvaau.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
2.6
ZERO API file : malware
VT API (file) 43 detected (AIDetect, malware2, GenericKD, Unsafe, Save, Fareit, malicious, BestaFera, Eldorado, MalPbs, gen1, high confidence, Delf, InjectorX, R002C0PEN22, FDBI, Outbreak, ai score=86, SGeneric, kcloud, DelfInject, score, Phonzy, BScope, Hesv, Generic@AI, RDML, EXHzYOrc48UVsB5Oz+bvOQ, Static AI, Suspicious PE, susgen, EQPQ, confidence, 100%)
md5 f90932c0feeed304b65bf0cb9ee79424
sha256 50f8e65f0b4356d376130eaa14d12a563f8c4cb80a9d6a06cfd14e66785352ab
ssdeep 12288:zWijNHVkFTo0x5H1ZWJZPcyhiX5qPdRJgb4RmIggE6gPgBuLq:zWixYT35H1485XITJgcRSv4ML
imphash e60f4d15a4540844534c6000143a9e27
impfuzzy 192:f3Vnf1sTV/JbuuaxSUvK9y3oaqERo7CPbOQw5:f3t1s/aq9/cPbOQk
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 43 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x48c154 DeleteCriticalSection
 0x48c158 LeaveCriticalSection
 0x48c15c EnterCriticalSection
 0x48c160 InitializeCriticalSection
 0x48c164 VirtualFree
 0x48c168 VirtualAlloc
 0x48c16c LocalFree
 0x48c170 LocalAlloc
 0x48c174 GetVersion
 0x48c178 GetCurrentThreadId
 0x48c17c InterlockedDecrement
 0x48c180 InterlockedIncrement
 0x48c184 VirtualQuery
 0x48c188 WideCharToMultiByte
 0x48c18c MultiByteToWideChar
 0x48c190 lstrlenA
 0x48c194 lstrcpynA
 0x48c198 LoadLibraryExA
 0x48c19c GetThreadLocale
 0x48c1a0 GetStartupInfoA
 0x48c1a4 GetProcAddress
 0x48c1a8 GetModuleHandleA
 0x48c1ac GetModuleFileNameA
 0x48c1b0 GetLocaleInfoA
 0x48c1b4 GetCommandLineA
 0x48c1b8 FreeLibrary
 0x48c1bc FindFirstFileA
 0x48c1c0 FindClose
 0x48c1c4 ExitProcess
 0x48c1c8 WriteFile
 0x48c1cc UnhandledExceptionFilter
 0x48c1d0 RtlUnwind
 0x48c1d4 RaiseException
 0x48c1d8 GetStdHandle
user32.dll
 0x48c1e0 GetKeyboardType
 0x48c1e4 LoadStringA
 0x48c1e8 MessageBoxA
 0x48c1ec CharNextA
advapi32.dll
 0x48c1f4 RegQueryValueExA
 0x48c1f8 RegOpenKeyExA
 0x48c1fc RegCloseKey
oleaut32.dll
 0x48c204 SysFreeString
 0x48c208 SysReAllocStringLen
 0x48c20c SysAllocStringLen
kernel32.dll
 0x48c214 TlsSetValue
 0x48c218 TlsGetValue
 0x48c21c LocalAlloc
 0x48c220 GetModuleHandleA
advapi32.dll
 0x48c228 RegQueryValueExA
 0x48c22c RegOpenKeyExA
 0x48c230 RegCloseKey
kernel32.dll
 0x48c238 lstrcpyA
 0x48c23c WriteFile
 0x48c240 WideCharToMultiByte
 0x48c244 WaitForSingleObject
 0x48c248 VirtualQuery
 0x48c24c VirtualProtect
 0x48c250 VirtualAlloc
 0x48c254 Sleep
 0x48c258 SizeofResource
 0x48c25c SetThreadLocale
 0x48c260 SetFilePointer
 0x48c264 SetEvent
 0x48c268 SetErrorMode
 0x48c26c SetEndOfFile
 0x48c270 ResetEvent
 0x48c274 ReadFile
 0x48c278 MultiByteToWideChar
 0x48c27c MulDiv
 0x48c280 LockResource
 0x48c284 LoadResource
 0x48c288 LoadLibraryA
 0x48c28c LeaveCriticalSection
 0x48c290 InitializeCriticalSection
 0x48c294 GlobalUnlock
 0x48c298 GlobalSize
 0x48c29c GlobalReAlloc
 0x48c2a0 GlobalHandle
 0x48c2a4 GlobalLock
 0x48c2a8 GlobalFree
 0x48c2ac GlobalFindAtomA
 0x48c2b0 GlobalDeleteAtom
 0x48c2b4 GlobalAlloc
 0x48c2b8 GlobalAddAtomA
 0x48c2bc GetVersionExA
 0x48c2c0 GetVersion
 0x48c2c4 GetUserDefaultLCID
 0x48c2c8 GetTickCount
 0x48c2cc GetThreadLocale
 0x48c2d0 GetSystemInfo
 0x48c2d4 GetStringTypeExA
 0x48c2d8 GetStdHandle
 0x48c2dc GetProcAddress
 0x48c2e0 GetModuleHandleA
 0x48c2e4 GetModuleFileNameA
 0x48c2e8 GetLocaleInfoA
 0x48c2ec GetLocalTime
 0x48c2f0 GetLastError
 0x48c2f4 GetFullPathNameA
 0x48c2f8 GetDiskFreeSpaceA
 0x48c2fc GetDateFormatA
 0x48c300 GetCurrentThreadId
 0x48c304 GetCurrentProcessId
 0x48c308 GetComputerNameA
 0x48c30c GetCPInfo
 0x48c310 GetACP
 0x48c314 FreeResource
 0x48c318 InterlockedExchange
 0x48c31c FreeLibrary
 0x48c320 FormatMessageA
 0x48c324 FindResourceA
 0x48c328 FindFirstFileA
 0x48c32c FindClose
 0x48c330 FileTimeToLocalFileTime
 0x48c334 FileTimeToDosDateTime
 0x48c338 EnumCalendarInfoA
 0x48c33c EnterCriticalSection
 0x48c340 DeleteFileA
 0x48c344 DeleteCriticalSection
 0x48c348 CreateThread
 0x48c34c CreateFileA
 0x48c350 CreateEventA
 0x48c354 CompareStringA
 0x48c358 CloseHandle
version.dll
 0x48c360 VerQueryValueA
 0x48c364 GetFileVersionInfoSizeA
 0x48c368 GetFileVersionInfoA
gdi32.dll
 0x48c370 UnrealizeObject
 0x48c374 StretchBlt
 0x48c378 SetWindowOrgEx
 0x48c37c SetWinMetaFileBits
 0x48c380 SetViewportOrgEx
 0x48c384 SetTextColor
 0x48c388 SetStretchBltMode
 0x48c38c SetROP2
 0x48c390 SetPixel
 0x48c394 SetEnhMetaFileBits
 0x48c398 SetDIBColorTable
 0x48c39c SetBrushOrgEx
 0x48c3a0 SetBkMode
 0x48c3a4 SetBkColor
 0x48c3a8 SelectPalette
 0x48c3ac SelectObject
 0x48c3b0 SelectClipRgn
 0x48c3b4 SaveDC
 0x48c3b8 RestoreDC
 0x48c3bc Rectangle
 0x48c3c0 RectVisible
 0x48c3c4 RealizePalette
 0x48c3c8 Polyline
 0x48c3cc Polygon
 0x48c3d0 PlayEnhMetaFile
 0x48c3d4 PatBlt
 0x48c3d8 MoveToEx
 0x48c3dc MaskBlt
 0x48c3e0 LineTo
 0x48c3e4 IntersectClipRect
 0x48c3e8 GetWindowOrgEx
 0x48c3ec GetWinMetaFileBits
 0x48c3f0 GetTextMetricsA
 0x48c3f4 GetTextExtentPointA
 0x48c3f8 GetTextExtentPoint32A
 0x48c3fc GetSystemPaletteEntries
 0x48c400 GetStockObject
 0x48c404 GetPixel
 0x48c408 GetPaletteEntries
 0x48c40c GetObjectA
 0x48c410 GetEnhMetaFilePaletteEntries
 0x48c414 GetEnhMetaFileHeader
 0x48c418 GetEnhMetaFileDescriptionA
 0x48c41c GetEnhMetaFileBits
 0x48c420 GetDeviceCaps
 0x48c424 GetDIBits
 0x48c428 GetDIBColorTable
 0x48c42c GetDCOrgEx
 0x48c430 GetCurrentPositionEx
 0x48c434 GetClipBox
 0x48c438 GetBrushOrgEx
 0x48c43c GetBkMode
 0x48c440 GetBitmapBits
 0x48c444 GdiFlush
 0x48c448 ExcludeClipRect
 0x48c44c DeleteObject
 0x48c450 DeleteEnhMetaFile
 0x48c454 DeleteDC
 0x48c458 CreateSolidBrush
 0x48c45c CreatePenIndirect
 0x48c460 CreatePalette
 0x48c464 CreateHalftonePalette
 0x48c468 CreateFontIndirectA
 0x48c46c CreateEnhMetaFileA
 0x48c470 CreateDIBitmap
 0x48c474 CreateDIBSection
 0x48c478 CreateCompatibleDC
 0x48c47c CreateCompatibleBitmap
 0x48c480 CreateBrushIndirect
 0x48c484 CreateBitmap
 0x48c488 CopyEnhMetaFileA
 0x48c48c CloseEnhMetaFile
 0x48c490 BitBlt
user32.dll
 0x48c498 CreateWindowExA
 0x48c49c WindowFromPoint
 0x48c4a0 WinHelpA
 0x48c4a4 WaitMessage
 0x48c4a8 UpdateWindow
 0x48c4ac UnregisterClassA
 0x48c4b0 UnhookWindowsHookEx
 0x48c4b4 TranslateMessage
 0x48c4b8 TranslateMDISysAccel
 0x48c4bc TrackPopupMenu
 0x48c4c0 SystemParametersInfoA
 0x48c4c4 ShowWindow
 0x48c4c8 ShowScrollBar
 0x48c4cc ShowOwnedPopups
 0x48c4d0 ShowCursor
 0x48c4d4 ShowCaret
 0x48c4d8 SetWindowsHookExA
 0x48c4dc SetWindowTextA
 0x48c4e0 SetWindowPos
 0x48c4e4 SetWindowPlacement
 0x48c4e8 SetWindowLongA
 0x48c4ec SetTimer
 0x48c4f0 SetScrollRange
 0x48c4f4 SetScrollPos
 0x48c4f8 SetScrollInfo
 0x48c4fc SetRect
 0x48c500 SetPropA
 0x48c504 SetParent
 0x48c508 SetMenuItemInfoA
 0x48c50c SetMenu
 0x48c510 SetForegroundWindow
 0x48c514 SetFocus
 0x48c518 SetCursor
 0x48c51c SetClipboardData
 0x48c520 SetClassLongA
 0x48c524 SetCapture
 0x48c528 SetActiveWindow
 0x48c52c SendMessageA
 0x48c530 ScrollWindow
 0x48c534 ScreenToClient
 0x48c538 RemovePropA
 0x48c53c RemoveMenu
 0x48c540 ReleaseDC
 0x48c544 ReleaseCapture
 0x48c548 RegisterWindowMessageA
 0x48c54c RegisterClipboardFormatA
 0x48c550 RegisterClassA
 0x48c554 RedrawWindow
 0x48c558 PtInRect
 0x48c55c PostQuitMessage
 0x48c560 PostMessageA
 0x48c564 PeekMessageA
 0x48c568 OpenClipboard
 0x48c56c OffsetRect
 0x48c570 OemToCharA
 0x48c574 MessageBoxA
 0x48c578 MessageBeep
 0x48c57c MapWindowPoints
 0x48c580 MapVirtualKeyA
 0x48c584 LoadStringA
 0x48c588 LoadKeyboardLayoutA
 0x48c58c LoadIconA
 0x48c590 LoadCursorA
 0x48c594 LoadBitmapA
 0x48c598 KillTimer
 0x48c59c IsZoomed
 0x48c5a0 IsWindowVisible
 0x48c5a4 IsWindowEnabled
 0x48c5a8 IsWindow
 0x48c5ac IsRectEmpty
 0x48c5b0 IsIconic
 0x48c5b4 IsDialogMessageA
 0x48c5b8 IsChild
 0x48c5bc InvalidateRect
 0x48c5c0 IntersectRect
 0x48c5c4 InsertMenuItemA
 0x48c5c8 InsertMenuA
 0x48c5cc InflateRect
 0x48c5d0 HideCaret
 0x48c5d4 GetWindowThreadProcessId
 0x48c5d8 GetWindowTextA
 0x48c5dc GetWindowRect
 0x48c5e0 GetWindowPlacement
 0x48c5e4 GetWindowLongA
 0x48c5e8 GetWindowDC
 0x48c5ec GetTopWindow
 0x48c5f0 GetSystemMetrics
 0x48c5f4 GetSystemMenu
 0x48c5f8 GetSysColorBrush
 0x48c5fc GetSysColor
 0x48c600 GetSubMenu
 0x48c604 GetScrollRange
 0x48c608 GetScrollPos
 0x48c60c GetScrollInfo
 0x48c610 GetPropA
 0x48c614 GetParent
 0x48c618 GetWindow
 0x48c61c GetMessageTime
 0x48c620 GetMenuStringA
 0x48c624 GetMenuState
 0x48c628 GetMenuItemInfoA
 0x48c62c GetMenuItemID
 0x48c630 GetMenuItemCount
 0x48c634 GetMenu
 0x48c638 GetLastActivePopup
 0x48c63c GetKeyboardState
 0x48c640 GetKeyboardLayoutList
 0x48c644 GetKeyboardLayout
 0x48c648 GetKeyState
 0x48c64c GetKeyNameTextA
 0x48c650 GetIconInfo
 0x48c654 GetForegroundWindow
 0x48c658 GetFocus
 0x48c65c GetDesktopWindow
 0x48c660 GetDCEx
 0x48c664 GetDC
 0x48c668 GetCursorPos
 0x48c66c GetCursor
 0x48c670 GetClipboardData
 0x48c674 GetClientRect
 0x48c678 GetClassNameA
 0x48c67c GetClassInfoA
 0x48c680 GetCapture
 0x48c684 GetActiveWindow
 0x48c688 FrameRect
 0x48c68c FindWindowA
 0x48c690 FillRect
 0x48c694 EqualRect
 0x48c698 EnumWindows
 0x48c69c EnumThreadWindows
 0x48c6a0 EndPaint
 0x48c6a4 EnableWindow
 0x48c6a8 EnableScrollBar
 0x48c6ac EnableMenuItem
 0x48c6b0 EmptyClipboard
 0x48c6b4 DrawTextA
 0x48c6b8 DrawStateA
 0x48c6bc DrawMenuBar
 0x48c6c0 DrawIconEx
 0x48c6c4 DrawIcon
 0x48c6c8 DrawFrameControl
 0x48c6cc DrawEdge
 0x48c6d0 DispatchMessageA
 0x48c6d4 DestroyWindow
 0x48c6d8 DestroyMenu
 0x48c6dc DestroyIcon
 0x48c6e0 DestroyCursor
 0x48c6e4 DeleteMenu
 0x48c6e8 DefWindowProcA
 0x48c6ec DefMDIChildProcA
 0x48c6f0 DefFrameProcA
 0x48c6f4 CreatePopupMenu
 0x48c6f8 CreateMenu
 0x48c6fc CreateIcon
 0x48c700 CloseClipboard
 0x48c704 ClientToScreen
 0x48c708 CheckMenuItem
 0x48c70c CallWindowProcA
 0x48c710 CallNextHookEx
 0x48c714 BeginPaint
 0x48c718 CharNextA
 0x48c71c CharLowerBuffA
 0x48c720 CharLowerA
 0x48c724 CharUpperBuffA
 0x48c728 CharToOemA
 0x48c72c AdjustWindowRectEx
 0x48c730 ActivateKeyboardLayout
kernel32.dll
 0x48c738 Sleep
oleaut32.dll
 0x48c740 SafeArrayPtrOfIndex
 0x48c744 SafeArrayPutElement
 0x48c748 SafeArrayGetElement
 0x48c74c SafeArrayUnaccessData
 0x48c750 SafeArrayAccessData
 0x48c754 SafeArrayGetUBound
 0x48c758 SafeArrayGetLBound
 0x48c75c SafeArrayCreate
 0x48c760 VariantChangeType
 0x48c764 VariantCopyInd
 0x48c768 VariantCopy
 0x48c76c VariantClear
 0x48c770 VariantInit
ole32.dll
 0x48c778 CreateStreamOnHGlobal
 0x48c77c IsAccelerator
 0x48c780 OleDraw
 0x48c784 OleSetMenuDescriptor
 0x48c788 CoTaskMemFree
 0x48c78c ProgIDFromCLSID
 0x48c790 StringFromCLSID
 0x48c794 CoCreateInstance
 0x48c798 CoGetClassObject
 0x48c79c CoUninitialize
 0x48c7a0 CoInitialize
 0x48c7a4 IsEqualGUID
oleaut32.dll
 0x48c7ac GetErrorInfo
 0x48c7b0 GetActiveObject
 0x48c7b4 SysFreeString
comctl32.dll
 0x48c7bc ImageList_SetIconSize
 0x48c7c0 ImageList_GetIconSize
 0x48c7c4 ImageList_Write
 0x48c7c8 ImageList_Read
 0x48c7cc ImageList_GetDragImage
 0x48c7d0 ImageList_DragShowNolock
 0x48c7d4 ImageList_SetDragCursorImage
 0x48c7d8 ImageList_DragMove
 0x48c7dc ImageList_DragLeave
 0x48c7e0 ImageList_DragEnter
 0x48c7e4 ImageList_EndDrag
 0x48c7e8 ImageList_BeginDrag
 0x48c7ec ImageList_Remove
 0x48c7f0 ImageList_DrawEx
 0x48c7f4 ImageList_Replace
 0x48c7f8 ImageList_Draw
 0x48c7fc ImageList_GetBkColor
 0x48c800 ImageList_SetBkColor
 0x48c804 ImageList_ReplaceIcon
 0x48c808 ImageList_Add
 0x48c80c ImageList_SetImageCount
 0x48c810 ImageList_GetImageCount
 0x48c814 ImageList_Destroy
 0x48c818 ImageList_Create
winmm.dll
 0x48c820 sndPlaySoundA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure