popup

Report - 2-1_2023-04-14_09-11.exe

UPX Malicious Library OS Processor Check PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.04.17 11:18 Machine s1_win7_x6401
Filename 2-1_2023-04-14_09-11.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
8
 Behavior Score
2.0
ZERO API file : malware
VT API (file) 50 detected (Emotet, Zusy, Artemis, Save, malicious, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, high confidence, HTIG, score, DropperX, Udkl, Krypt, GenSHCode, citco, Inject4, RHADAMANTHYS, YXDDOZ, Lockbit, high, Static AI, Suspicious PE, ai score=85, Convagent, Raccoon, Redline, ZD8D0M, Detected, BScope, Khalesi, unsafe, q6o1kdVs2XI, susgen)
md5 9f2d4ac2e67b3fe84ac5a8b6f7d6e6dd
sha256 8b1f8ccc99f4ce9e05e6471a7df1c9c1e1d4c193d3d4218157f43c11ea7978fa
ssdeep 6144:diTnQl63wAB92+mSftzQab34Lv588toz+lAbb1zt:diUlpK92+mStz5b3ix88lMb1
imphash 2cb59bd9251d49d733d8b63af794a12e
impfuzzy 48:MseqN78wnd4WOSdZ+fco6tGJktK7scFZgX2:MbA4W3Z+fcoSGJktsscfQ2
  Network IP location

Signature (3cnts)

Level Description
danger File has been identified by 50 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401008 EnumCalendarInfoA
 0x40100c GetNumaProcessorNode
 0x401010 GetStringTypeA
 0x401014 SetUnhandledExceptionFilter
 0x401018 EnumCalendarInfoW
 0x40101c GetCurrentProcess
 0x401020 GetEnvironmentStringsW
 0x401024 WriteConsoleInputA
 0x401028 SetComputerNameW
 0x40102c FreeEnvironmentStringsA
 0x401030 CreateRemoteThread
 0x401034 WaitNamedPipeW
 0x401038 EnumResourceTypesA
 0x40103c GetDriveTypeA
 0x401040 SetHandleCount
 0x401044 GlobalAlloc
 0x401048 WideCharToMultiByte
 0x40104c LoadLibraryW
 0x401050 GetPrivateProfileStructW
 0x401054 GetSystemPowerStatus
 0x401058 GetConsoleAliasExesLengthW
 0x40105c SetConsoleCP
 0x401060 GetFileAttributesA
 0x401064 GetComputerNameExA
 0x401068 SetConsoleMode
 0x40106c GetConsoleAliasW
 0x401070 SetConsoleCursorPosition
 0x401074 GetVolumePathNameA
 0x401078 FindNextVolumeMountPointW
 0x40107c lstrcmpA
 0x401080 GetNamedPipeHandleStateW
 0x401084 EnumSystemLocalesA
 0x401088 OpenMutexW
 0x40108c GetLastError
 0x401090 InterlockedFlushSList
 0x401094 GetProcAddress
 0x401098 BackupWrite
 0x40109c RemoveDirectoryA
 0x4010a0 GlobalGetAtomNameA
 0x4010a4 PrepareTape
 0x4010a8 ResetEvent
 0x4010ac LoadLibraryA
 0x4010b0 OpenMutexA
 0x4010b4 InterlockedExchangeAdd
 0x4010b8 SetCalendarInfoW
 0x4010bc SetCommMask
 0x4010c0 GlobalFindAtomW
 0x4010c4 GetModuleFileNameA
 0x4010c8 FindNextFileA
 0x4010cc GetModuleHandleA
 0x4010d0 CreateMutexA
 0x4010d4 RequestWakeupLatency
 0x4010d8 GetVersionExA
 0x4010dc GetDiskFreeSpaceExW
 0x4010e0 GetFileInformationByHandle
 0x4010e4 DeleteFileA
 0x4010e8 CreateFileW
 0x4010ec WriteConsoleW
 0x4010f0 CreateMailslotW
 0x4010f4 CreateMutexW
 0x4010f8 FlushFileBuffers
 0x4010fc SetStdHandle
 0x401100 InterlockedIncrement
 0x401104 InterlockedDecrement
 0x401108 EncodePointer
 0x40110c DecodePointer
 0x401110 Sleep
 0x401114 InterlockedExchange
 0x401118 InitializeCriticalSection
 0x40111c DeleteCriticalSection
 0x401120 EnterCriticalSection
 0x401124 LeaveCriticalSection
 0x401128 HeapFree
 0x40112c HeapAlloc
 0x401130 HeapReAlloc
 0x401134 GetModuleHandleW
 0x401138 ExitProcess
 0x40113c GetCommandLineA
 0x401140 HeapSetInformation
 0x401144 GetStartupInfoW
 0x401148 RaiseException
 0x40114c RtlUnwind
 0x401150 LCMapStringW
 0x401154 MultiByteToWideChar
 0x401158 GetCPInfo
 0x40115c GetACP
 0x401160 GetOEMCP
 0x401164 IsValidCodePage
 0x401168 TlsAlloc
 0x40116c TlsGetValue
 0x401170 TlsSetValue
 0x401174 TlsFree
 0x401178 SetLastError
 0x40117c GetCurrentThreadId
 0x401180 GetCurrentThread
 0x401184 UnhandledExceptionFilter
 0x401188 IsDebuggerPresent
 0x40118c TerminateProcess
 0x401190 IsProcessorFeaturePresent
 0x401194 HeapCreate
 0x401198 HeapDestroy
 0x40119c WriteFile
 0x4011a0 GetStdHandle
 0x4011a4 GetModuleFileNameW
 0x4011a8 SetFilePointer
 0x4011ac InitializeCriticalSectionAndSpinCount
 0x4011b0 GetFileType
 0x4011b4 FatalAppExitA
 0x4011b8 SetConsoleCtrlHandler
 0x4011bc FreeLibrary
 0x4011c0 GetLocaleInfoW
 0x4011c4 FreeEnvironmentStringsW
 0x4011c8 QueryPerformanceCounter
 0x4011cc GetTickCount
 0x4011d0 GetCurrentProcessId
 0x4011d4 GetSystemTimeAsFileTime
 0x4011d8 HeapSize
 0x4011dc GetUserDefaultLCID
 0x4011e0 GetLocaleInfoA
 0x4011e4 IsValidLocale
 0x4011e8 GetStringTypeW
 0x4011ec GetConsoleCP
 0x4011f0 GetConsoleMode
 0x4011f4 CloseHandle
USER32.dll
 0x4011fc GetMenu
ADVAPI32.dll
 0x401000 ReportEventW
WINHTTP.dll
 0x401204 WinHttpGetIEProxyConfigForCurrentUser

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure