popup

Report - 95.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.03.22 10:14 Machine s1_win7_x6403
Filename 95.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
1.8
ZERO API file : malware
VT API (file) 23 detected (malicious, high confidence, MachineLearning, Anomalous, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, score, RansomX, Lockbit, high, UrSnif, Sabsik, Detected, BScope, unsafe, Generic@AI, RDML, 9n1yJn6qxIGg03BxtBD2kA, Static AI, Suspicious PE, susgen)
md5 86226298f5f7c878323137119929a4c1
sha256 41ae7c8a95a5367900997394091ab6fb70b83157906df1c95f7dddf124a07532
ssdeep 24576:TNmsC6pxpjI6YZ6dDyFqQCtqckiY7Y5u:T5RpU9ZSWFqrjkiK5
imphash abf9812c144b37aad537ff6f220c83df
impfuzzy 48:xQ9FTzyYzU+fcjtdM+00WuucFZubZv74GO2aBr:iffyYo+fcjtdM+00Ccfu5c9
  Network IP location

Signature (4cnts)

Level Description
warning File has been identified by 23 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info This executable has a PDB path

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401008 FindVolumeClose
 0x40100c lstrcpynA
 0x401010 WaitNamedPipeA
 0x401014 GetLogicalDriveStringsW
 0x401018 GlobalSize
 0x40101c CreateHardLinkA
 0x401020 WaitForSingleObjectEx
 0x401024 GetConsoleAliasesA
 0x401028 GetCompressedFileSizeW
 0x40102c LoadLibraryW
 0x401030 GetConsoleMode
 0x401034 InterlockedPopEntrySList
 0x401038 GetWriteWatch
 0x40103c GetFileAttributesW
 0x401040 WritePrivateProfileStringW
 0x401044 GetConsoleAliasesW
 0x401048 GetLastError
 0x40104c GetProcAddress
 0x401050 EnumSystemCodePagesW
 0x401054 CreateMemoryResourceNotification
 0x401058 GetNumaHighestNodeNumber
 0x40105c WriteConsoleA
 0x401060 LocalAlloc
 0x401064 BeginUpdateResourceA
 0x401068 FoldStringA
 0x40106c FreeEnvironmentStringsW
 0x401070 DeleteTimerQueueTimer
 0x401074 GlobalAddAtomW
 0x401078 FlushFileBuffers
 0x40107c CloseHandle
 0x401080 CreateFileA
 0x401084 WriteConsoleW
 0x401088 GetConsoleOutputCP
 0x40108c SetStdHandle
 0x401090 GetModuleHandleA
 0x401094 VirtualAlloc
 0x401098 SetDefaultCommConfigA
 0x40109c InterlockedIncrement
 0x4010a0 InterlockedDecrement
 0x4010a4 Sleep
 0x4010a8 InitializeCriticalSection
 0x4010ac DeleteCriticalSection
 0x4010b0 EnterCriticalSection
 0x4010b4 LeaveCriticalSection
 0x4010b8 UnhandledExceptionFilter
 0x4010bc SetUnhandledExceptionFilter
 0x4010c0 HeapFree
 0x4010c4 MultiByteToWideChar
 0x4010c8 TerminateProcess
 0x4010cc GetCurrentProcess
 0x4010d0 IsDebuggerPresent
 0x4010d4 GetStartupInfoW
 0x4010d8 RtlUnwind
 0x4010dc RaiseException
 0x4010e0 LCMapStringA
 0x4010e4 WideCharToMultiByte
 0x4010e8 LCMapStringW
 0x4010ec GetCPInfo
 0x4010f0 GetModuleHandleW
 0x4010f4 ExitProcess
 0x4010f8 WriteFile
 0x4010fc GetStdHandle
 0x401100 GetModuleFileNameA
 0x401104 HeapAlloc
 0x401108 HeapCreate
 0x40110c VirtualFree
 0x401110 HeapReAlloc
 0x401114 GetACP
 0x401118 GetOEMCP
 0x40111c IsValidCodePage
 0x401120 TlsGetValue
 0x401124 TlsAlloc
 0x401128 TlsSetValue
 0x40112c TlsFree
 0x401130 SetLastError
 0x401134 GetCurrentThreadId
 0x401138 GetModuleFileNameW
 0x40113c GetEnvironmentStringsW
 0x401140 GetCommandLineW
 0x401144 SetHandleCount
 0x401148 GetFileType
 0x40114c GetStartupInfoA
 0x401150 QueryPerformanceCounter
 0x401154 GetTickCount
 0x401158 GetCurrentProcessId
 0x40115c GetSystemTimeAsFileTime
 0x401160 HeapSize
 0x401164 GetUserDefaultLCID
 0x401168 GetLocaleInfoA
 0x40116c EnumSystemLocalesA
 0x401170 IsValidLocale
 0x401174 GetStringTypeA
 0x401178 GetStringTypeW
 0x40117c LoadLibraryA
 0x401180 InitializeCriticalSectionAndSpinCount
 0x401184 SetFilePointer
 0x401188 GetConsoleCP
 0x40118c GetLocaleInfoW
USER32.dll
 0x401194 ClientToScreen
 0x401198 LoadMenuA
 0x40119c MessageBoxIndirectA
 0x4011a0 GetKBCodePage
 0x4011a4 GetListBoxInfo
 0x4011a8 GetCaretPos
 0x4011ac SetScrollInfo
 0x4011b0 GetShellWindow
GDI32.dll
 0x401000 GetCharWidthI

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure