Report - vp2023.exe

UPX Malicious Library MZP Format PE File PE32
ScreenShot
Created 2023.06.21 05:50 Machine s1_win7_x6403
Filename vp2023.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
Behavior Score
1.8
ZERO API file : clean
VT API (file) 12 detected (AIDetectMalware, malicious, moderate confidence, Attribute, HighConfidence, score, ChePro, CrypterX, Generic@AI, RDML, 1bSP1ZUl3lciUMX, HoFtrQ, susgen, confidence)
md5 cfdb201a4cd2100b3761eb4dfe98545f
sha256 cb7f27875e34fb7e8903b0e172c788aece874ee02fed6ec2a08bdff69fd8c71b
ssdeep 24576:FVcjvuoanTXHSs3zPxp47llK3XGvhOM8JSMe7R:3cahHPuO0Ole7
imphash dad99e5c387f4e73aae419ddd17db155
impfuzzy 192:330Y8k1Q+h4buuA7SUvK9RqooqEfP72POQRqD9hE:3351aAw9LLPOQcHE
  Network IP location

Signature (5cnts)

Level Description
watch File has been identified by 12 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
drownways.com US COGENT-174 149.100.151.190 malware
149.100.151.190 US COGENT-174 149.100.151.190 malware

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x486154 DeleteCriticalSection
 0x486158 LeaveCriticalSection
 0x48615c EnterCriticalSection
 0x486160 InitializeCriticalSection
 0x486164 VirtualFree
 0x486168 VirtualAlloc
 0x48616c LocalFree
 0x486170 LocalAlloc
 0x486174 GetTickCount
 0x486178 QueryPerformanceCounter
 0x48617c GetVersion
 0x486180 GetCurrentThreadId
 0x486184 InterlockedDecrement
 0x486188 InterlockedIncrement
 0x48618c VirtualQuery
 0x486190 WideCharToMultiByte
 0x486194 MultiByteToWideChar
 0x486198 lstrlenA
 0x48619c lstrcpynA
 0x4861a0 LoadLibraryExA
 0x4861a4 GetThreadLocale
 0x4861a8 GetStartupInfoA
 0x4861ac GetProcAddress
 0x4861b0 GetModuleHandleA
 0x4861b4 GetModuleFileNameA
 0x4861b8 GetLocaleInfoA
 0x4861bc GetCommandLineA
 0x4861c0 FreeLibrary
 0x4861c4 FindFirstFileA
 0x4861c8 FindClose
 0x4861cc ExitProcess
 0x4861d0 WriteFile
 0x4861d4 UnhandledExceptionFilter
 0x4861d8 RtlUnwind
 0x4861dc RaiseException
 0x4861e0 GetStdHandle
user32.dll
 0x4861e8 GetKeyboardType
 0x4861ec LoadStringA
 0x4861f0 MessageBoxA
 0x4861f4 CharNextA
advapi32.dll
 0x4861fc RegQueryValueExA
 0x486200 RegOpenKeyExA
 0x486204 RegCloseKey
oleaut32.dll
 0x48620c SysFreeString
 0x486210 SysReAllocStringLen
 0x486214 SysAllocStringLen
kernel32.dll
 0x48621c TlsSetValue
 0x486220 TlsGetValue
 0x486224 LocalAlloc
 0x486228 GetModuleHandleA
advapi32.dll
 0x486230 RegQueryValueExA
 0x486234 RegOpenKeyExA
 0x486238 RegCloseKey
kernel32.dll
 0x486240 lstrcpyA
 0x486244 WriteFile
 0x486248 WaitForSingleObject
 0x48624c VirtualQuery
 0x486250 VirtualAlloc
 0x486254 Sleep
 0x486258 SizeofResource
 0x48625c SetThreadLocale
 0x486260 SetFilePointer
 0x486264 SetEvent
 0x486268 SetErrorMode
 0x48626c SetEndOfFile
 0x486270 ResetEvent
 0x486274 ReadFile
 0x486278 MulDiv
 0x48627c LockResource
 0x486280 LoadResource
 0x486284 LoadLibraryA
 0x486288 LeaveCriticalSection
 0x48628c InitializeCriticalSection
 0x486290 GlobalUnlock
 0x486294 GlobalReAlloc
 0x486298 GlobalHandle
 0x48629c GlobalLock
 0x4862a0 GlobalFree
 0x4862a4 GlobalFindAtomA
 0x4862a8 GlobalDeleteAtom
 0x4862ac GlobalAlloc
 0x4862b0 GlobalAddAtomA
 0x4862b4 GetVersionExA
 0x4862b8 GetVersion
 0x4862bc GetTickCount
 0x4862c0 GetThreadLocale
 0x4862c4 GetSystemInfo
 0x4862c8 GetStringTypeExA
 0x4862cc GetStdHandle
 0x4862d0 GetProfileStringA
 0x4862d4 GetProcAddress
 0x4862d8 GetModuleHandleA
 0x4862dc GetModuleFileNameA
 0x4862e0 GetLocaleInfoA
 0x4862e4 GetLocalTime
 0x4862e8 GetLastError
 0x4862ec GetFullPathNameA
 0x4862f0 GetDiskFreeSpaceA
 0x4862f4 GetDateFormatA
 0x4862f8 GetCurrentThreadId
 0x4862fc GetCurrentProcessId
 0x486300 GetCPInfo
 0x486304 GetACP
 0x486308 FreeResource
 0x48630c InterlockedExchange
 0x486310 FreeLibrary
 0x486314 FormatMessageA
 0x486318 FindResourceA
 0x48631c EnumCalendarInfoA
 0x486320 EnterCriticalSection
 0x486324 DeleteCriticalSection
 0x486328 CreateThread
 0x48632c CreateFileA
 0x486330 CreateEventA
 0x486334 CompareStringA
 0x486338 CloseHandle
version.dll
 0x486340 VerQueryValueA
 0x486344 GetFileVersionInfoSizeA
 0x486348 GetFileVersionInfoA
gdi32.dll
 0x486350 UnrealizeObject
 0x486354 TextOutA
 0x486358 StretchBlt
 0x48635c SetWindowOrgEx
 0x486360 SetWinMetaFileBits
 0x486364 SetViewportOrgEx
 0x486368 SetTextColor
 0x48636c SetTextAlign
 0x486370 SetStretchBltMode
 0x486374 SetROP2
 0x486378 SetPixel
 0x48637c SetEnhMetaFileBits
 0x486380 SetDIBColorTable
 0x486384 SetBrushOrgEx
 0x486388 SetBkMode
 0x48638c SetBkColor
 0x486390 SelectPalette
 0x486394 SelectObject
 0x486398 SelectClipRgn
 0x48639c SaveDC
 0x4863a0 RoundRect
 0x4863a4 RestoreDC
 0x4863a8 Rectangle
 0x4863ac RectVisible
 0x4863b0 RealizePalette
 0x4863b4 Polyline
 0x4863b8 Polygon
 0x4863bc PlayEnhMetaFile
 0x4863c0 Pie
 0x4863c4 PathToRegion
 0x4863c8 PatBlt
 0x4863cc MoveToEx
 0x4863d0 MaskBlt
 0x4863d4 LineTo
 0x4863d8 LPtoDP
 0x4863dc IntersectClipRect
 0x4863e0 GetWindowOrgEx
 0x4863e4 GetWinMetaFileBits
 0x4863e8 GetTextMetricsA
 0x4863ec GetTextExtentPoint32A
 0x4863f0 GetTextAlign
 0x4863f4 GetSystemPaletteEntries
 0x4863f8 GetStockObject
 0x4863fc GetPixel
 0x486400 GetPaletteEntries
 0x486404 GetObjectA
 0x486408 GetEnhMetaFilePaletteEntries
 0x48640c GetEnhMetaFileHeader
 0x486410 GetEnhMetaFileBits
 0x486414 GetDeviceCaps
 0x486418 GetDIBits
 0x48641c GetDIBColorTable
 0x486420 GetDCOrgEx
 0x486424 GetCurrentPositionEx
 0x486428 GetClipBox
 0x48642c GetBrushOrgEx
 0x486430 GetBkMode
 0x486434 GetBkColor
 0x486438 GetBitmapBits
 0x48643c ExtTextOutA
 0x486440 ExtSelectClipRgn
 0x486444 ExtCreatePen
 0x486448 ExcludeClipRect
 0x48644c EndPage
 0x486450 EndDoc
 0x486454 Ellipse
 0x486458 DeleteObject
 0x48645c DeleteEnhMetaFile
 0x486460 DeleteDC
 0x486464 CreateSolidBrush
 0x486468 CreateRectRgn
 0x48646c CreatePolygonRgn
 0x486470 CreatePenIndirect
 0x486474 CreatePalette
 0x486478 CreateICA
 0x48647c CreateHalftonePalette
 0x486480 CreateFontIndirectA
 0x486484 CreateDIBitmap
 0x486488 CreateDIBSection
 0x48648c CreateDCA
 0x486490 CreateCompatibleDC
 0x486494 CreateCompatibleBitmap
 0x486498 CreateBrushIndirect
 0x48649c CreateBitmap
 0x4864a0 CopyEnhMetaFileA
 0x4864a4 BitBlt
 0x4864a8 Arc
user32.dll
 0x4864b0 CreateWindowExA
 0x4864b4 WindowFromPoint
 0x4864b8 WinHelpA
 0x4864bc WaitMessage
 0x4864c0 UpdateWindow
 0x4864c4 UnregisterClassA
 0x4864c8 UnhookWindowsHookEx
 0x4864cc TranslateMessage
 0x4864d0 TranslateMDISysAccel
 0x4864d4 TrackPopupMenu
 0x4864d8 SystemParametersInfoA
 0x4864dc ShowWindow
 0x4864e0 ShowScrollBar
 0x4864e4 ShowOwnedPopups
 0x4864e8 ShowCursor
 0x4864ec SetWindowsHookExA
 0x4864f0 SetWindowTextA
 0x4864f4 SetWindowPos
 0x4864f8 SetWindowPlacement
 0x4864fc SetWindowLongA
 0x486500 SetTimer
 0x486504 SetScrollRange
 0x486508 SetScrollPos
 0x48650c SetScrollInfo
 0x486510 SetRect
 0x486514 SetPropA
 0x486518 SetParent
 0x48651c SetMenuItemInfoA
 0x486520 SetMenu
 0x486524 SetForegroundWindow
 0x486528 SetFocus
 0x48652c SetCursor
 0x486530 SetClassLongA
 0x486534 SetCapture
 0x486538 SetActiveWindow
 0x48653c SendMessageA
 0x486540 SendDlgItemMessageA
 0x486544 ScrollWindow
 0x486548 ScreenToClient
 0x48654c RemovePropA
 0x486550 RemoveMenu
 0x486554 ReleaseDC
 0x486558 ReleaseCapture
 0x48655c RegisterWindowMessageA
 0x486560 RegisterClipboardFormatA
 0x486564 RegisterClassA
 0x486568 RedrawWindow
 0x48656c PtInRect
 0x486570 PostQuitMessage
 0x486574 PostMessageA
 0x486578 PeekMessageA
 0x48657c OffsetRect
 0x486580 OemToCharA
 0x486584 MessageBoxA
 0x486588 MapWindowPoints
 0x48658c MapVirtualKeyA
 0x486590 LoadStringA
 0x486594 LoadKeyboardLayoutA
 0x486598 LoadIconA
 0x48659c LoadCursorA
 0x4865a0 LoadBitmapA
 0x4865a4 KillTimer
 0x4865a8 IsZoomed
 0x4865ac IsWindowVisible
 0x4865b0 IsWindowEnabled
 0x4865b4 IsWindow
 0x4865b8 IsRectEmpty
 0x4865bc IsIconic
 0x4865c0 IsDialogMessageA
 0x4865c4 IsChild
 0x4865c8 InvalidateRect
 0x4865cc IntersectRect
 0x4865d0 InsertMenuItemA
 0x4865d4 InsertMenuA
 0x4865d8 InflateRect
 0x4865dc GetWindowThreadProcessId
 0x4865e0 GetWindowTextA
 0x4865e4 GetWindowRect
 0x4865e8 GetWindowPlacement
 0x4865ec GetWindowLongA
 0x4865f0 GetWindowDC
 0x4865f4 GetTopWindow
 0x4865f8 GetSystemMetrics
 0x4865fc GetSystemMenu
 0x486600 GetSysColorBrush
 0x486604 GetSysColor
 0x486608 GetSubMenu
 0x48660c GetScrollRange
 0x486610 GetScrollPos
 0x486614 GetScrollInfo
 0x486618 GetPropA
 0x48661c GetParent
 0x486620 GetWindow
 0x486624 GetMenuStringA
 0x486628 GetMenuState
 0x48662c GetMenuItemInfoA
 0x486630 GetMenuItemID
 0x486634 GetMenuItemCount
 0x486638 GetMenu
 0x48663c GetLastActivePopup
 0x486640 GetKeyboardState
 0x486644 GetKeyboardLayoutList
 0x486648 GetKeyboardLayout
 0x48664c GetKeyState
 0x486650 GetKeyNameTextA
 0x486654 GetIconInfo
 0x486658 GetForegroundWindow
 0x48665c GetFocus
 0x486660 GetDesktopWindow
 0x486664 GetDCEx
 0x486668 GetDC
 0x48666c GetCursorPos
 0x486670 GetCursor
 0x486674 GetClipboardData
 0x486678 GetClientRect
 0x48667c GetClassNameA
 0x486680 GetClassInfoA
 0x486684 GetCapture
 0x486688 GetActiveWindow
 0x48668c FrameRect
 0x486690 FindWindowA
 0x486694 FillRect
 0x486698 EqualRect
 0x48669c EnumWindows
 0x4866a0 EnumThreadWindows
 0x4866a4 EndPaint
 0x4866a8 EndDeferWindowPos
 0x4866ac EnableWindow
 0x4866b0 EnableScrollBar
 0x4866b4 EnableMenuItem
 0x4866b8 DrawTextA
 0x4866bc DrawMenuBar
 0x4866c0 DrawIconEx
 0x4866c4 DrawIcon
 0x4866c8 DrawFrameControl
 0x4866cc DrawFocusRect
 0x4866d0 DrawEdge
 0x4866d4 DispatchMessageA
 0x4866d8 DestroyWindow
 0x4866dc DestroyMenu
 0x4866e0 DestroyIcon
 0x4866e4 DestroyCursor
 0x4866e8 DeleteMenu
 0x4866ec DeferWindowPos
 0x4866f0 DefWindowProcA
 0x4866f4 DefMDIChildProcA
 0x4866f8 DefFrameProcA
 0x4866fc CreatePopupMenu
 0x486700 CreateMenu
 0x486704 CreateIcon
 0x486708 ClientToScreen
 0x48670c CheckMenuItem
 0x486710 CallWindowProcA
 0x486714 CallNextHookEx
 0x486718 BeginPaint
 0x48671c BeginDeferWindowPos
 0x486720 CharNextA
 0x486724 CharLowerBuffA
 0x486728 CharLowerA
 0x48672c CharUpperBuffA
 0x486730 CharToOemA
 0x486734 AdjustWindowRectEx
 0x486738 ActivateKeyboardLayout
kernel32.dll
 0x486740 Sleep
oleaut32.dll
 0x486748 SafeArrayPtrOfIndex
 0x48674c SafeArrayGetUBound
 0x486750 SafeArrayGetLBound
 0x486754 SafeArrayCreate
 0x486758 VariantChangeType
 0x48675c VariantCopy
 0x486760 VariantClear
 0x486764 VariantInit
comctl32.dll
 0x48676c ImageList_SetIconSize
 0x486770 ImageList_GetIconSize
 0x486774 ImageList_Write
 0x486778 ImageList_Read
 0x48677c ImageList_GetDragImage
 0x486780 ImageList_DragShowNolock
 0x486784 ImageList_SetDragCursorImage
 0x486788 ImageList_DragMove
 0x48678c ImageList_DragLeave
 0x486790 ImageList_DragEnter
 0x486794 ImageList_EndDrag
 0x486798 ImageList_BeginDrag
 0x48679c ImageList_Remove
 0x4867a0 ImageList_DrawEx
 0x4867a4 ImageList_Draw
 0x4867a8 ImageList_GetBkColor
 0x4867ac ImageList_SetBkColor
 0x4867b0 ImageList_ReplaceIcon
 0x4867b4 ImageList_Add
 0x4867b8 ImageList_GetImageCount
 0x4867bc ImageList_Destroy
 0x4867c0 ImageList_Create
 0x4867c4 InitCommonControls
winspool.drv
 0x4867cc OpenPrinterA
 0x4867d0 EnumPrintersA
 0x4867d4 DocumentPropertiesA
 0x4867d8 ClosePrinter
shell32.dll
 0x4867e0 ShellExecuteExW
comdlg32.dll
 0x4867e8 ChooseFontA
 0x4867ec ChooseColorA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure