Report - 2023_vp.exe

UPX Malicious Library Downloader OS Processor Check MZP Format PE File PE32
ScreenShot
Created 2023.06.20 17:34 Machine s1_win7_x6403
Filename 2023_vp.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
2.2
ZERO API file : malware
VT API (file) 27 detected (AIDetectMalware, ChePro, GenericKD, Artemis, Vkrq, Attribute, HighConfidence, malicious, high confidence, CrypterX, ObfuscatedPoly, moderate, score, Kryptik, ai score=80, Wacatac, Chgt, Generic@AI, RDML, NtGcsV7I2l6ZOEqczDtVdA, susgen, PossibleThreat, confidence)
md5 acd82a80283bd3d7b39141dfcc2d5849
sha256 afadfea05a60c5090213324056b71ac29d7175dee54b35d78ed0854b872778e1
ssdeep 24576:uUiyKZ0BdB81j2s7vF2/nmCX6j1xHyTbfbshp:xIIdi116msrbs
imphash 78c9e2c31285b4ac9148c2d16bffeed7
impfuzzy 192:f309Aj1ubybuuArSUvK92oqooqE6pXEPbOQWi:f3x1u0AA9hyPbOQ9
  Network IP location

Signature (6cnts)

Level Description
warning File has been identified by 27 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
drownways.com US COGENT-174 149.100.151.190 malware
149.100.151.190 US COGENT-174 149.100.151.190 malware

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x500168 DeleteCriticalSection
 0x50016c LeaveCriticalSection
 0x500170 EnterCriticalSection
 0x500174 InitializeCriticalSection
 0x500178 VirtualFree
 0x50017c VirtualAlloc
 0x500180 LocalFree
 0x500184 LocalAlloc
 0x500188 GetVersion
 0x50018c GetCurrentThreadId
 0x500190 InterlockedDecrement
 0x500194 InterlockedIncrement
 0x500198 VirtualQuery
 0x50019c WideCharToMultiByte
 0x5001a0 MultiByteToWideChar
 0x5001a4 lstrlenA
 0x5001a8 lstrcpynA
 0x5001ac LoadLibraryExA
 0x5001b0 GetThreadLocale
 0x5001b4 GetStartupInfoA
 0x5001b8 GetProcAddress
 0x5001bc GetModuleHandleA
 0x5001c0 GetModuleFileNameA
 0x5001c4 GetLocaleInfoA
 0x5001c8 GetCommandLineA
 0x5001cc FreeLibrary
 0x5001d0 FindFirstFileA
 0x5001d4 FindClose
 0x5001d8 ExitProcess
 0x5001dc WriteFile
 0x5001e0 UnhandledExceptionFilter
 0x5001e4 RtlUnwind
 0x5001e8 RaiseException
 0x5001ec GetStdHandle
user32.dll
 0x5001f4 GetKeyboardType
 0x5001f8 LoadStringA
 0x5001fc MessageBoxA
 0x500200 CharNextA
advapi32.dll
 0x500208 RegQueryValueExA
 0x50020c RegOpenKeyExA
 0x500210 RegCloseKey
oleaut32.dll
 0x500218 SysFreeString
 0x50021c SysReAllocStringLen
 0x500220 SysAllocStringLen
kernel32.dll
 0x500228 TlsSetValue
 0x50022c TlsGetValue
 0x500230 LocalAlloc
 0x500234 GetModuleHandleA
advapi32.dll
 0x50023c RegQueryValueExA
 0x500240 RegOpenKeyExA
 0x500244 RegCloseKey
kernel32.dll
 0x50024c lstrcpyA
 0x500250 WriteFile
 0x500254 WaitForSingleObject
 0x500258 VirtualQuery
 0x50025c VirtualAlloc
 0x500260 Sleep
 0x500264 SizeofResource
 0x500268 SetThreadLocale
 0x50026c SetFilePointer
 0x500270 SetEvent
 0x500274 SetErrorMode
 0x500278 SetEndOfFile
 0x50027c SearchPathA
 0x500280 ResetEvent
 0x500284 ReleaseMutex
 0x500288 ReadFile
 0x50028c OpenFileMappingA
 0x500290 MultiByteToWideChar
 0x500294 MulDiv
 0x500298 LockResource
 0x50029c LoadResource
 0x5002a0 LoadLibraryA
 0x5002a4 LeaveCriticalSection
 0x5002a8 IsDBCSLeadByte
 0x5002ac InitializeCriticalSection
 0x5002b0 GlobalUnlock
 0x5002b4 GlobalReAlloc
 0x5002b8 GlobalMemoryStatus
 0x5002bc GlobalHandle
 0x5002c0 GlobalLock
 0x5002c4 GlobalFree
 0x5002c8 GlobalFindAtomA
 0x5002cc GlobalDeleteAtom
 0x5002d0 GlobalAlloc
 0x5002d4 GlobalAddAtomA
 0x5002d8 GetVersionExA
 0x5002dc GetVersion
 0x5002e0 GetTickCount
 0x5002e4 GetThreadLocale
 0x5002e8 GetSystemInfo
 0x5002ec GetStringTypeExA
 0x5002f0 GetStdHandle
 0x5002f4 GetProcAddress
 0x5002f8 GetModuleHandleA
 0x5002fc GetModuleFileNameA
 0x500300 GetLocaleInfoA
 0x500304 GetLocalTime
 0x500308 GetLastError
 0x50030c GetFullPathNameA
 0x500310 GetDiskFreeSpaceA
 0x500314 GetDateFormatA
 0x500318 GetCurrentThreadId
 0x50031c GetCurrentProcessId
 0x500320 GetCurrentDirectoryA
 0x500324 GetCPInfo
 0x500328 GetACP
 0x50032c FreeResource
 0x500330 InterlockedIncrement
 0x500334 InterlockedExchange
 0x500338 InterlockedDecrement
 0x50033c FreeLibrary
 0x500340 FormatMessageA
 0x500344 FindResourceA
 0x500348 FindFirstFileA
 0x50034c FindClose
 0x500350 FileTimeToLocalFileTime
 0x500354 FileTimeToDosDateTime
 0x500358 FatalAppExitA
 0x50035c EnumCalendarInfoA
 0x500360 EnterCriticalSection
 0x500364 DeleteFileA
 0x500368 DeleteCriticalSection
 0x50036c CreateThread
 0x500370 CreateMutexA
 0x500374 CreateFileA
 0x500378 CreateEventA
 0x50037c CompareStringA
 0x500380 CloseHandle
version.dll
 0x500388 VerQueryValueA
 0x50038c GetFileVersionInfoSizeA
 0x500390 GetFileVersionInfoA
gdi32.dll
 0x500398 UnrealizeObject
 0x50039c StretchBlt
 0x5003a0 SetWindowOrgEx
 0x5003a4 SetViewportOrgEx
 0x5003a8 SetTextColor
 0x5003ac SetStretchBltMode
 0x5003b0 SetROP2
 0x5003b4 SetPixel
 0x5003b8 SetDIBColorTable
 0x5003bc SetBrushOrgEx
 0x5003c0 SetBkMode
 0x5003c4 SetBkColor
 0x5003c8 SelectPalette
 0x5003cc SelectObject
 0x5003d0 SaveDC
 0x5003d4 RestoreDC
 0x5003d8 RectVisible
 0x5003dc RealizePalette
 0x5003e0 PatBlt
 0x5003e4 MoveToEx
 0x5003e8 MaskBlt
 0x5003ec LineTo
 0x5003f0 IntersectClipRect
 0x5003f4 GetWindowOrgEx
 0x5003f8 GetTextMetricsA
 0x5003fc GetTextExtentPoint32A
 0x500400 GetSystemPaletteEntries
 0x500404 GetStockObject
 0x500408 GetPixel
 0x50040c GetPaletteEntries
 0x500410 GetObjectA
 0x500414 GetDeviceCaps
 0x500418 GetDIBits
 0x50041c GetDIBColorTable
 0x500420 GetDCOrgEx
 0x500424 GetCurrentPositionEx
 0x500428 GetClipBox
 0x50042c GetBrushOrgEx
 0x500430 GetBitmapBits
 0x500434 FillPath
 0x500438 ExcludeClipRect
 0x50043c DeleteObject
 0x500440 DeleteDC
 0x500444 CreateSolidBrush
 0x500448 CreatePenIndirect
 0x50044c CreatePalette
 0x500450 CreateHalftonePalette
 0x500454 CreateFontIndirectA
 0x500458 CreateDIBitmap
 0x50045c CreateDIBSection
 0x500460 CreateCompatibleDC
 0x500464 CreateCompatibleBitmap
 0x500468 CreateBrushIndirect
 0x50046c CreateBitmap
 0x500470 BitBlt
user32.dll
 0x500478 CreateWindowExA
 0x50047c WindowFromPoint
 0x500480 WinHelpA
 0x500484 WaitMessage
 0x500488 UpdateWindow
 0x50048c UnregisterClassA
 0x500490 UnhookWindowsHookEx
 0x500494 TranslateMessage
 0x500498 TranslateMDISysAccel
 0x50049c TrackPopupMenu
 0x5004a0 SystemParametersInfoA
 0x5004a4 ShowWindow
 0x5004a8 ShowScrollBar
 0x5004ac ShowOwnedPopups
 0x5004b0 ShowCursor
 0x5004b4 SetWindowsHookExA
 0x5004b8 SetWindowTextA
 0x5004bc SetWindowPos
 0x5004c0 SetWindowPlacement
 0x5004c4 SetWindowLongA
 0x5004c8 SetTimer
 0x5004cc SetScrollRange
 0x5004d0 SetScrollPos
 0x5004d4 SetScrollInfo
 0x5004d8 SetRect
 0x5004dc SetPropA
 0x5004e0 SetParent
 0x5004e4 SetMenuItemInfoA
 0x5004e8 SetMenu
 0x5004ec SetForegroundWindow
 0x5004f0 SetFocus
 0x5004f4 SetCursor
 0x5004f8 SetClassLongA
 0x5004fc SetCapture
 0x500500 SetActiveWindow
 0x500504 SendMessageA
 0x500508 ScrollWindow
 0x50050c ScreenToClient
 0x500510 RemovePropA
 0x500514 RemoveMenu
 0x500518 ReleaseDC
 0x50051c ReleaseCapture
 0x500520 RegisterWindowMessageA
 0x500524 RegisterClipboardFormatA
 0x500528 RegisterClassA
 0x50052c RedrawWindow
 0x500530 PtInRect
 0x500534 PostQuitMessage
 0x500538 PostMessageA
 0x50053c PeekMessageA
 0x500540 OffsetRect
 0x500544 OemToCharBuffA
 0x500548 OemToCharA
 0x50054c MessageBoxA
 0x500550 MapWindowPoints
 0x500554 MapVirtualKeyA
 0x500558 LoadStringA
 0x50055c LoadKeyboardLayoutA
 0x500560 LoadIconA
 0x500564 LoadCursorA
 0x500568 LoadBitmapA
 0x50056c KillTimer
 0x500570 IsZoomed
 0x500574 IsWindowVisible
 0x500578 IsWindowEnabled
 0x50057c IsWindow
 0x500580 IsRectEmpty
 0x500584 IsIconic
 0x500588 IsDialogMessageA
 0x50058c IsChild
 0x500590 InvalidateRect
 0x500594 IntersectRect
 0x500598 InsertMenuItemA
 0x50059c InsertMenuA
 0x5005a0 InflateRect
 0x5005a4 GetWindowThreadProcessId
 0x5005a8 GetWindowTextA
 0x5005ac GetWindowRect
 0x5005b0 GetWindowPlacement
 0x5005b4 GetWindowLongA
 0x5005b8 GetWindowDC
 0x5005bc GetTopWindow
 0x5005c0 GetSystemMetrics
 0x5005c4 GetSystemMenu
 0x5005c8 GetSysColorBrush
 0x5005cc GetSysColor
 0x5005d0 GetSubMenu
 0x5005d4 GetScrollRange
 0x5005d8 GetScrollPos
 0x5005dc GetScrollInfo
 0x5005e0 GetPropA
 0x5005e4 GetParent
 0x5005e8 GetWindow
 0x5005ec GetMenuStringA
 0x5005f0 GetMenuState
 0x5005f4 GetMenuItemInfoA
 0x5005f8 GetMenuItemID
 0x5005fc GetMenuItemCount
 0x500600 GetMenu
 0x500604 GetLastActivePopup
 0x500608 GetKeyboardState
 0x50060c GetKeyboardLayoutList
 0x500610 GetKeyboardLayout
 0x500614 GetKeyState
 0x500618 GetKeyNameTextA
 0x50061c GetIconInfo
 0x500620 GetForegroundWindow
 0x500624 GetFocus
 0x500628 GetDesktopWindow
 0x50062c GetDCEx
 0x500630 GetDC
 0x500634 GetCursorPos
 0x500638 GetCursor
 0x50063c GetClientRect
 0x500640 GetClassNameA
 0x500644 GetClassInfoA
 0x500648 GetCapture
 0x50064c GetActiveWindow
 0x500650 FrameRect
 0x500654 FindWindowA
 0x500658 FillRect
 0x50065c EqualRect
 0x500660 EnumWindows
 0x500664 EnumThreadWindows
 0x500668 EndPaint
 0x50066c EnableWindow
 0x500670 EnableScrollBar
 0x500674 EnableMenuItem
 0x500678 DrawTextA
 0x50067c DrawMenuBar
 0x500680 DrawIconEx
 0x500684 DrawIcon
 0x500688 DrawFrameControl
 0x50068c DrawEdge
 0x500690 DispatchMessageA
 0x500694 DestroyWindow
 0x500698 DestroyMenu
 0x50069c DestroyIcon
 0x5006a0 DestroyCursor
 0x5006a4 DeleteMenu
 0x5006a8 DefWindowProcA
 0x5006ac DefMDIChildProcA
 0x5006b0 DefFrameProcA
 0x5006b4 CreatePopupMenu
 0x5006b8 CreateMenu
 0x5006bc CreateIcon
 0x5006c0 ClientToScreen
 0x5006c4 CheckMenuItem
 0x5006c8 CallWindowProcA
 0x5006cc CallNextHookEx
 0x5006d0 BeginPaint
 0x5006d4 CharNextA
 0x5006d8 CharLowerA
 0x5006dc CharUpperBuffA
 0x5006e0 CharToOemBuffA
 0x5006e4 CharToOemA
 0x5006e8 AdjustWindowRectEx
 0x5006ec ActivateKeyboardLayout
ole32.dll
 0x5006f4 IsEqualGUID
 0x5006f8 CoTaskMemFree
 0x5006fc StringFromCLSID
 0x500700 CoCreateGuid
kernel32.dll
 0x500708 Sleep
oleaut32.dll
 0x500710 SafeArrayPtrOfIndex
 0x500714 SafeArrayPutElement
 0x500718 SafeArrayGetElement
 0x50071c SafeArrayUnaccessData
 0x500720 SafeArrayAccessData
 0x500724 SafeArrayGetUBound
 0x500728 SafeArrayGetLBound
 0x50072c SafeArrayCreate
 0x500730 VariantChangeType
 0x500734 VariantCopyInd
 0x500738 VariantCopy
 0x50073c VariantClear
 0x500740 VariantInit
ole32.dll
 0x500748 CoCreateInstance
 0x50074c CoUninitialize
 0x500750 CoInitialize
oleaut32.dll
 0x500758 CreateErrorInfo
 0x50075c GetErrorInfo
 0x500760 SetErrorInfo
 0x500764 SysFreeString
comctl32.dll
 0x50076c ImageList_SetIconSize
 0x500770 ImageList_GetIconSize
 0x500774 ImageList_Write
 0x500778 ImageList_Read
 0x50077c ImageList_GetDragImage
 0x500780 ImageList_DragShowNolock
 0x500784 ImageList_SetDragCursorImage
 0x500788 ImageList_DragMove
 0x50078c ImageList_DragLeave
 0x500790 ImageList_DragEnter
 0x500794 ImageList_EndDrag
 0x500798 ImageList_BeginDrag
 0x50079c ImageList_Remove
 0x5007a0 ImageList_DrawEx
 0x5007a4 ImageList_Draw
 0x5007a8 ImageList_GetBkColor
 0x5007ac ImageList_SetBkColor
 0x5007b0 ImageList_ReplaceIcon
 0x5007b4 ImageList_Add
 0x5007b8 ImageList_GetImageCount
 0x5007bc ImageList_Destroy
 0x5007c0 ImageList_Create
shell32.dll
 0x5007c8 ShellExecuteExW

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure