Report - Czutl.dll

AntiDebug AntiVM

ScreenShot

Info
Location map


Created	2023.03.05 04:09	Machine	s1_win7_x6403_us
Filename	Czutl.dll
Type	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT)
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : malware
VT API (file)
md5	7a23b092902a9e01b91b1d606c9ab555
sha256	affe93467f37cb5e2286803f0b3d3ba2b883926981f5e3fc862b85d2bea15011
ssdeep	49152:CNhJx5zoDxw2bE+8Jd9DZiVZqrcv+Sip5sxoj:YoDZg3JLFsDgj
imphash
impfuzzy

Network IP location

Signature (10cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Creates executable files on the filesystem
notice	HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice	Performs some HTTP requests
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
info	One or more processes crashed

Rules (8cnts)

Level	Name	Description	Collection
info	anti_dbg	Checks if being debugged	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory

Network (2cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://77.73.131.249/panel/uploads/Czutl.dll whois		Fibre Optix LLC	77.73.131.249		malware
77.73.131.249 whois		Fibre Optix LLC	77.73.131.249		malware

Suricata ids

Similarity measure (PE file only) - Checking for service failure