popup

Report - MicOSOFTSearchProtocolHosb66.exe

Generic Malware UPX Malicious Library PE32 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.04.25 10:17 Machine s1_win7_x6401
Filename MicOSOFTSearchProtocolHosb66.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
10
 Behavior Score
6.6
ZERO API file : malware
VT API (file) 61 detected (AIDetect, malware1, Farfli, malicious, high confidence, Zegost, FarfliRI, S27090835, Save, confidence, 100%, LBET, Attribute, HighConfidence, Kryptik, HCAH, score, jmvgmk, BackdoorX, XPACK, Siggen11, R002C0DDH23, GenericRXLP, Static AI, Suspicious PE, FK@7jqjxo, Detected, R299466, ai score=84, unsafe, CLASSIC, GenAsa, gBhknYBDYco, susgen, ZexaF, xmW@auqvm9i)
md5 4cbe3baf25933bc9d0cb632422e70903
sha256 1fbc2796e18c8c5ea32840f3eb64057379eb8198666b46160097491004de83e9
ssdeep 3072:RvK/yLrQbWaR5Qax8c/YtImroxSnOPMfZSa3aVz9TWF5UZ:ROyLEbWaR5CcPioxSOUH3abWF5UZ
imphash 032ac126bef9dc99c70a99a6b91b16f2
impfuzzy 24:mDo2auMiOovuH+fcd37JHd3iv8ERRvNuCeRVXWyM1y3:duM1hH+fclr3WJeRHmy3
  Network IP location

Signature (14cnts)

Level Description
danger File has been identified by 61 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
watch Expresses interest in specific running processes
watch Installs itself for autorun at Windows startup
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates a service
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Repeatedly searches for a not-found process
notice Searches running processes potentially to identify processes for sandbox evasion
info Checks amount of memory in system
info The executable uses a known packer

Rules (10cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://156.236.72.163:8080/dan.exe
whois
US HK Kwaifong Group Limited 156.236.72.163 clean
156.236.72.163
whois
US HK Kwaifong Group Limited 156.236.72.163 malware

Suricata ids

ET INFO Executable Download from dotted-quad Host
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET EXPLOIT_KIT DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET INFO EXE - Served Attached HTTP

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x40f000 GetProcAddress
 0x40f004 LoadLibraryA
 0x40f008 VirtualAlloc
 0x40f00c VirtualFree
 0x40f010 FreeLibrary
 0x40f014 RtlUnwind
 0x40f018 RaiseException
 0x40f01c GetModuleHandleA
 0x40f020 GetStartupInfoA
 0x40f024 GetCommandLineA
 0x40f028 GetVersion
 0x40f02c ExitProcess
 0x40f030 InitializeCriticalSection
 0x40f034 DeleteCriticalSection
 0x40f038 EnterCriticalSection
 0x40f03c LeaveCriticalSection
 0x40f040 HeapFree
 0x40f044 GetCurrentThreadId
 0x40f048 TlsSetValue
 0x40f04c TlsAlloc
 0x40f050 SetLastError
 0x40f054 TlsGetValue
 0x40f058 GetLastError
 0x40f05c SetUnhandledExceptionFilter
 0x40f060 TerminateProcess
 0x40f064 GetCurrentProcess
 0x40f068 UnhandledExceptionFilter
 0x40f06c GetModuleFileNameA
 0x40f070 FreeEnvironmentStringsA
 0x40f074 FreeEnvironmentStringsW
 0x40f078 WideCharToMultiByte
 0x40f07c GetEnvironmentStrings
 0x40f080 GetEnvironmentStringsW
 0x40f084 SetHandleCount
 0x40f088 GetStdHandle
 0x40f08c GetFileType
 0x40f090 GetEnvironmentVariableA
 0x40f094 GetVersionExA
 0x40f098 HeapDestroy
 0x40f09c HeapCreate
 0x40f0a0 WriteFile
 0x40f0a4 IsBadWritePtr
 0x40f0a8 IsBadReadPtr
 0x40f0ac HeapValidate
 0x40f0b0 HeapAlloc
 0x40f0b4 HeapReAlloc
 0x40f0b8 DebugBreak
 0x40f0bc InterlockedDecrement
 0x40f0c0 OutputDebugStringA
 0x40f0c4 InterlockedIncrement
 0x40f0c8 IsBadCodePtr
 0x40f0cc GetCPInfo
 0x40f0d0 GetACP
 0x40f0d4 GetOEMCP
 0x40f0d8 MultiByteToWideChar
 0x40f0dc LCMapStringA
 0x40f0e0 LCMapStringW
 0x40f0e4 GetStringTypeA
 0x40f0e8 GetStringTypeW
 0x40f0ec SetFilePointer
 0x40f0f0 SetStdHandle
 0x40f0f4 FlushFileBuffers
 0x40f0f8 CloseHandle

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure