Report - dd12.exe

UPX PE File PE32
ScreenShot
Created 2023.06.13 23:06 Machine s1_win7_x6403
Filename dd12.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
9
Behavior Score
1.0
ZERO API file : malware
VT API (file)
md5 2ed9f5fd57f0bd14d8b6a367bcc2e6c7
sha256 c9e9f4d1945fc9cb9daf5b4a72032a00ba7040154e3fe44be5371fbb7da695ea
ssdeep 12288:DAijvnPy/8Y83Lt6xqpbxbUVJhlPq36NY7Qjua3j:DAq91LwANxbUV1q36SQiW
imphash 752f4f5e2214a73fbb6bae0fe7215eef
impfuzzy 48:nq/lxQwzZQUwgowUkRxk+xRM3Yrjrc1SxgXAmSNt2FNjWc4zpjg50sw+4xmHkSI5:nq/lxQGZQUfobkRxk+xRMorjrcwxgX3M
  Network IP location

Signature (3cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
info One or more processes crashed

Rules (3cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 _CIcos
 0x401004 _adj_fptan
 0x401008 __vbaVarMove
 0x40100c __vbaStrI4
 0x401010 __vbaAryMove
 0x401014 __vbaFreeVar
 0x401018 __vbaLenBstr
 0x40101c __vbaStrVarMove
 0x401020 __vbaEnd
 0x401024 __vbaFreeVarList
 0x401028 _adj_fdiv_m64
 0x40102c None
 0x401030 __vbaFreeObjList
 0x401034 None
 0x401038 _adj_fprem1
 0x40103c __vbaSetSystemError
 0x401040 __vbaHresultCheckObj
 0x401044 _adj_fdiv_m32
 0x401048 __vbaAryVar
 0x40104c __vbaVarTstLe
 0x401050 __vbaAryDestruct
 0x401054 __vbaOnError
 0x401058 __vbaObjSet
 0x40105c _adj_fdiv_m16i
 0x401060 _adj_fdivr_m16i
 0x401064 _CIsin
 0x401068 None
 0x40106c __vbaChkstk
 0x401070 __vbaFileClose
 0x401074 EVENT_SINK_AddRef
 0x401078 __vbaGenerateBoundsError
 0x40107c __vbaGet3
 0x401080 __vbaStrCmp
 0x401084 __vbaAryConstruct2
 0x401088 __vbaI2I4
 0x40108c DllFunctionCall
 0x401090 _adj_fpatan
 0x401094 EVENT_SINK_Release
 0x401098 __vbaUI1I2
 0x40109c _CIsqrt
 0x4010a0 __vbaVarAnd
 0x4010a4 EVENT_SINK_QueryInterface
 0x4010a8 __vbaExceptHandler
 0x4010ac None
 0x4010b0 __vbaStrToUnicode
 0x4010b4 _adj_fprem
 0x4010b8 _adj_fdivr_m64
 0x4010bc None
 0x4010c0 None
 0x4010c4 __vbaFPException
 0x4010c8 None
 0x4010cc __vbaStrVarVal
 0x4010d0 __vbaUbound
 0x4010d4 __vbaVarCat
 0x4010d8 None
 0x4010dc _CIlog
 0x4010e0 __vbaErrorOverflow
 0x4010e4 __vbaFileOpen
 0x4010e8 __vbaNew2
 0x4010ec __vbaVar2Vec
 0x4010f0 __vbaInStr
 0x4010f4 __vbaCyMulI2
 0x4010f8 _adj_fdiv_m32i
 0x4010fc _adj_fdivr_m32i
 0x401100 __vbaStrCopy
 0x401104 None
 0x401108 __vbaFreeStrList
 0x40110c _adj_fdivr_m32
 0x401110 _adj_fdiv_r
 0x401114 None
 0x401118 __vbaVarCmpEq
 0x40111c __vbaAryLock
 0x401120 __vbaVarAdd
 0x401124 __vbaVarDup
 0x401128 __vbaStrToAnsi
 0x40112c __vbaVarCopy
 0x401130 None
 0x401134 _CIatan
 0x401138 __vbaAryCopy
 0x40113c None
 0x401140 __vbaStrMove
 0x401144 __vbaI4Cy
 0x401148 __vbaStrVarCopy
 0x40114c _allmul
 0x401150 _CItan
 0x401154 __vbaAryUnlock
 0x401158 _CIexp
 0x40115c __vbaFreeStr
 0x401160 __vbaFreeObj

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure