popup

Report - notepadp.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.03.27 17:18 Machine s1_win7_x6403
Filename notepadp.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
2.0
ZERO API file : malware
VT API (file) 39 detected (AIDetectNet, Zenpak, malicious, high confidence, score, Stop, Artemis, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, HTDU, Zusy, TrojanX, Eflw, high, Stealc, ooibi, RedLine, Detected, BotX, R566099, ai score=85, Azorult, unsafe, Poison, m56C8ybnppI, Static AI, Malicious PE, susgen, HTDS)
md5 4057acbd036de09b67259254135aa554
sha256 a2c431113c533e61cc8ca4460a5852d0794ec21c98d0325e95fe62f6e50068ee
ssdeep 3072:73/BN6O4fvufPNUwCYuk4EbZnRnK41gPFvB8RGxuU59dF/0KpNN4TJY:i3aPuwCupxK8REb7/fNN4T
imphash c5c75c5b6a7ab4fe20f346e6d5121c45
impfuzzy 48:nEPpygPd9lkiyO7ftScX0K9JcfGEKdLZ9j:Ex/3lPyotScX0QJcfGEG9d
  Network IP location

Signature (4cnts)

Level Description
danger File has been identified by 39 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401000 GetPrivateProfileSectionNamesW
 0x401004 SetDefaultCommConfigA
 0x401008 CreateMutexW
 0x40100c SearchPathW
 0x401010 lstrcmpA
 0x401014 EnumCalendarInfoA
 0x401018 EnumDateFormatsExW
 0x40101c CopyFileExW
 0x401020 _llseek
 0x401024 BuildCommDCBAndTimeoutsA
 0x401028 VerSetConditionMask
 0x40102c GetModuleHandleExW
 0x401030 WaitForSingleObject
 0x401034 WriteConsoleInputA
 0x401038 SetEvent
 0x40103c GetProcessPriorityBoost
 0x401040 GetModuleHandleW
 0x401044 EnumTimeFormatsW
 0x401048 EnumResourceTypesA
 0x40104c GlobalAlloc
 0x401050 LoadLibraryW
 0x401054 GetFileAttributesA
 0x401058 GetConsoleAliasW
 0x40105c TerminateProcess
 0x401060 GlobalUnlock
 0x401064 IsDBCSLeadByteEx
 0x401068 SetLastError
 0x40106c GetProcAddress
 0x401070 GetComputerNameExW
 0x401074 GetFirmwareEnvironmentVariableW
 0x401078 OpenMutexA
 0x40107c OpenWaitableTimerW
 0x401080 LocalAlloc
 0x401084 FindFirstVolumeMountPointW
 0x401088 AddAtomW
 0x40108c SetCurrentDirectoryW
 0x401090 AddAtomA
 0x401094 FreeEnvironmentStringsW
 0x401098 FindNextFileW
 0x40109c GetStringTypeW
 0x4010a0 PeekConsoleInputA
 0x4010a4 GetCurrentThreadId
 0x4010a8 GetCPInfoExA
 0x4010ac SetCalendarInfoA
 0x4010b0 GetWindowsDirectoryW
 0x4010b4 EnumCalendarInfoExA
 0x4010b8 GetConsoleSelectionInfo
 0x4010bc DeleteFileA
 0x4010c0 EnumSystemLocalesA
 0x4010c4 GetLocaleInfoA
 0x4010c8 GetLastError
 0x4010cc WideCharToMultiByte
 0x4010d0 MoveFileA
 0x4010d4 HeapReAlloc
 0x4010d8 GetCommandLineA
 0x4010dc HeapSetInformation
 0x4010e0 GetStartupInfoW
 0x4010e4 GetCPInfo
 0x4010e8 InterlockedIncrement
 0x4010ec InterlockedDecrement
 0x4010f0 GetACP
 0x4010f4 GetOEMCP
 0x4010f8 IsValidCodePage
 0x4010fc EncodePointer
 0x401100 TlsAlloc
 0x401104 TlsGetValue
 0x401108 TlsSetValue
 0x40110c DecodePointer
 0x401110 TlsFree
 0x401114 GetCurrentThread
 0x401118 UnhandledExceptionFilter
 0x40111c SetUnhandledExceptionFilter
 0x401120 IsDebuggerPresent
 0x401124 GetCurrentProcess
 0x401128 IsProcessorFeaturePresent
 0x40112c EnterCriticalSection
 0x401130 LeaveCriticalSection
 0x401134 HeapCreate
 0x401138 HeapDestroy
 0x40113c HeapFree
 0x401140 HeapAlloc
 0x401144 ExitProcess
 0x401148 WriteFile
 0x40114c GetStdHandle
 0x401150 GetModuleFileNameW
 0x401154 GetModuleFileNameA
 0x401158 GetEnvironmentStringsW
 0x40115c SetHandleCount
 0x401160 InitializeCriticalSectionAndSpinCount
 0x401164 GetFileType
 0x401168 DeleteCriticalSection
 0x40116c QueryPerformanceCounter
 0x401170 GetTickCount
 0x401174 GetCurrentProcessId
 0x401178 GetSystemTimeAsFileTime
 0x40117c LCMapStringW
 0x401180 MultiByteToWideChar
 0x401184 FatalAppExitA
 0x401188 Sleep
 0x40118c GetLocaleInfoW
 0x401190 RaiseException
 0x401194 RtlUnwind
 0x401198 SetConsoleCtrlHandler
 0x40119c FreeLibrary
 0x4011a0 InterlockedExchange
 0x4011a4 GetConsoleCP
 0x4011a8 GetConsoleMode
 0x4011ac FlushFileBuffers
 0x4011b0 SetFilePointer
 0x4011b4 HeapSize
 0x4011b8 CloseHandle
 0x4011bc WriteConsoleW
 0x4011c0 SetStdHandle
 0x4011c4 CreateFileW
 0x4011c8 GetUserDefaultLCID
 0x4011cc IsValidLocale
USER32.dll
 0x4011d4 LoadMenuA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure