Report - Clip1.exe

UPX PE64 PE File
ScreenShot
Created 2023.03.22 17:29 Machine s1_win7_x6403
Filename Clip1.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
2
Behavior Score
1.4
ZERO API file : malware
VT API (file) 12 detected (Malicious, score, Artemis, confidence, Attribute, HighConfidence, moderate confidence, FileRepMalware, Misc, Static AI, Suspicious PE, Casdet, susgen)
md5 fa0e319484845c1333e5c1e621659027
sha256 d3d00022e02c57c638d7738e661be715aa74866d8b7495e74b72e0c0f75695dd
ssdeep 196608:zLBJsvAF7+ftEtuzyeXprQ9z2y6EZaAF5XfpXXIBQQ:zLB+vA9ytEtIJXpGzJzQMfpnIB
imphash edc7ff2be90bee2a9c10e50db94e3c46
impfuzzy 3:swBJAEPw1MO/OywS9KTXzhAXwEQaxRegxrWq+:dBJAEoZ/OEGDzyRzZv+
  Network IP location

Signature (3cnts)

Level Description
watch File has been identified by 12 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
notice The executable is compressed using UPX

Rules (3cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.DLL
 0x140a5903c LoadLibraryA
 0x140a59044 ExitProcess
 0x140a5904c GetProcAddress
 0x140a59054 VirtualProtect
USER32.dll
 0x140a59064 EmptyClipboard

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure