Report - vp2023.exe

UPX Malicious Library MZP Format PE File PE32
ScreenShot
Created 2023.06.21 16:06 Machine s1_win7_x6401
Filename vp2023.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
1.8
ZERO API file : clean
VT API (file) 11 detected (AIDetectMalware, malicious, moderate confidence, score, ChePro, CrypterX, RDMK, cmRtazpDPOlsciicSryjHP5fxJDy, susgen, confidence)
md5 38bd8cf9d900fa629d1844b215a3d4d0
sha256 c17ef1f5dbdfd1f80ad5d6049492f83a44ad74eb8c56202af924b8d83a6e1b89
ssdeep 24576:zOEYDQe8H+5c5U64sOkysl86+jv+9v9OM8JSMe7R:zvH0X2d9Ole7
imphash 0448ff2644be2fe933e5093a8772e41d
impfuzzy 192:3309o8j1r+h4buuA7SUvK92oqooqEfP7XCPbOQUqD9hE:3341HAw9hDPbOQBHE
  Network IP location

Signature (5cnts)

Level Description
watch File has been identified by 11 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
drownways.com US COGENT-174 149.100.151.190 malware
149.100.151.190 US COGENT-174 149.100.151.190 malware

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4bc17c DeleteCriticalSection
 0x4bc180 LeaveCriticalSection
 0x4bc184 EnterCriticalSection
 0x4bc188 InitializeCriticalSection
 0x4bc18c VirtualFree
 0x4bc190 VirtualAlloc
 0x4bc194 LocalFree
 0x4bc198 LocalAlloc
 0x4bc19c GetTickCount
 0x4bc1a0 QueryPerformanceCounter
 0x4bc1a4 GetVersion
 0x4bc1a8 GetCurrentThreadId
 0x4bc1ac InterlockedDecrement
 0x4bc1b0 InterlockedIncrement
 0x4bc1b4 VirtualQuery
 0x4bc1b8 WideCharToMultiByte
 0x4bc1bc MultiByteToWideChar
 0x4bc1c0 lstrlenA
 0x4bc1c4 lstrcpynA
 0x4bc1c8 LoadLibraryExA
 0x4bc1cc GetThreadLocale
 0x4bc1d0 GetStartupInfoA
 0x4bc1d4 GetProcAddress
 0x4bc1d8 GetModuleHandleA
 0x4bc1dc GetModuleFileNameA
 0x4bc1e0 GetLocaleInfoA
 0x4bc1e4 GetCommandLineA
 0x4bc1e8 FreeLibrary
 0x4bc1ec FindFirstFileA
 0x4bc1f0 FindClose
 0x4bc1f4 ExitProcess
 0x4bc1f8 WriteFile
 0x4bc1fc UnhandledExceptionFilter
 0x4bc200 RtlUnwind
 0x4bc204 RaiseException
 0x4bc208 GetStdHandle
user32.dll
 0x4bc210 GetKeyboardType
 0x4bc214 LoadStringA
 0x4bc218 MessageBoxA
 0x4bc21c CharNextA
advapi32.dll
 0x4bc224 RegQueryValueExA
 0x4bc228 RegOpenKeyExA
 0x4bc22c RegCloseKey
oleaut32.dll
 0x4bc234 SysFreeString
 0x4bc238 SysReAllocStringLen
 0x4bc23c SysAllocStringLen
kernel32.dll
 0x4bc244 TlsSetValue
 0x4bc248 TlsGetValue
 0x4bc24c LocalAlloc
 0x4bc250 GetModuleHandleA
advapi32.dll
 0x4bc258 RegQueryValueExA
 0x4bc25c RegOpenKeyExA
 0x4bc260 RegCloseKey
kernel32.dll
 0x4bc268 lstrcpyA
 0x4bc26c WriteFile
 0x4bc270 WaitForSingleObject
 0x4bc274 VirtualQuery
 0x4bc278 VirtualAlloc
 0x4bc27c Sleep
 0x4bc280 SizeofResource
 0x4bc284 SetThreadLocale
 0x4bc288 SetFilePointer
 0x4bc28c SetEvent
 0x4bc290 SetErrorMode
 0x4bc294 SetEndOfFile
 0x4bc298 SearchPathA
 0x4bc29c ResetEvent
 0x4bc2a0 ReleaseMutex
 0x4bc2a4 ReadFile
 0x4bc2a8 OpenFileMappingA
 0x4bc2ac MultiByteToWideChar
 0x4bc2b0 MulDiv
 0x4bc2b4 LockResource
 0x4bc2b8 LoadResource
 0x4bc2bc LoadLibraryA
 0x4bc2c0 LeaveCriticalSection
 0x4bc2c4 IsDBCSLeadByte
 0x4bc2c8 InitializeCriticalSection
 0x4bc2cc GlobalUnlock
 0x4bc2d0 GlobalReAlloc
 0x4bc2d4 GlobalHandle
 0x4bc2d8 GlobalLock
 0x4bc2dc GlobalFree
 0x4bc2e0 GlobalFindAtomA
 0x4bc2e4 GlobalDeleteAtom
 0x4bc2e8 GlobalAlloc
 0x4bc2ec GlobalAddAtomA
 0x4bc2f0 GetVersionExA
 0x4bc2f4 GetVersion
 0x4bc2f8 GetTickCount
 0x4bc2fc GetThreadLocale
 0x4bc300 GetSystemInfo
 0x4bc304 GetStringTypeExA
 0x4bc308 GetStdHandle
 0x4bc30c GetProfileStringA
 0x4bc310 GetProcAddress
 0x4bc314 GetModuleHandleA
 0x4bc318 GetModuleFileNameA
 0x4bc31c GetLocaleInfoA
 0x4bc320 GetLocalTime
 0x4bc324 GetLastError
 0x4bc328 GetFullPathNameA
 0x4bc32c GetDiskFreeSpaceA
 0x4bc330 GetDateFormatA
 0x4bc334 GetCurrentThreadId
 0x4bc338 GetCurrentProcessId
 0x4bc33c GetCurrentDirectoryA
 0x4bc340 GetCPInfo
 0x4bc344 GetACP
 0x4bc348 FreeResource
 0x4bc34c InterlockedIncrement
 0x4bc350 InterlockedExchange
 0x4bc354 InterlockedDecrement
 0x4bc358 FreeLibrary
 0x4bc35c FormatMessageA
 0x4bc360 FindResourceA
 0x4bc364 FindFirstFileA
 0x4bc368 FindClose
 0x4bc36c FatalAppExitA
 0x4bc370 EnumCalendarInfoA
 0x4bc374 EnterCriticalSection
 0x4bc378 DeleteCriticalSection
 0x4bc37c CreateThread
 0x4bc380 CreateMutexA
 0x4bc384 CreateFileA
 0x4bc388 CreateEventA
 0x4bc38c CompareStringA
 0x4bc390 CloseHandle
version.dll
 0x4bc398 VerQueryValueA
 0x4bc39c GetFileVersionInfoSizeA
 0x4bc3a0 GetFileVersionInfoA
gdi32.dll
 0x4bc3a8 UnrealizeObject
 0x4bc3ac TextOutA
 0x4bc3b0 StretchBlt
 0x4bc3b4 SetWindowOrgEx
 0x4bc3b8 SetWinMetaFileBits
 0x4bc3bc SetViewportOrgEx
 0x4bc3c0 SetTextColor
 0x4bc3c4 SetTextAlign
 0x4bc3c8 SetStretchBltMode
 0x4bc3cc SetROP2
 0x4bc3d0 SetPixel
 0x4bc3d4 SetEnhMetaFileBits
 0x4bc3d8 SetDIBColorTable
 0x4bc3dc SetBrushOrgEx
 0x4bc3e0 SetBkMode
 0x4bc3e4 SetBkColor
 0x4bc3e8 SelectPalette
 0x4bc3ec SelectObject
 0x4bc3f0 SelectClipRgn
 0x4bc3f4 SaveDC
 0x4bc3f8 RoundRect
 0x4bc3fc RestoreDC
 0x4bc400 Rectangle
 0x4bc404 RectVisible
 0x4bc408 RealizePalette
 0x4bc40c Polyline
 0x4bc410 Polygon
 0x4bc414 PlayEnhMetaFile
 0x4bc418 Pie
 0x4bc41c PathToRegion
 0x4bc420 PatBlt
 0x4bc424 MoveToEx
 0x4bc428 MaskBlt
 0x4bc42c LineTo
 0x4bc430 LPtoDP
 0x4bc434 IntersectClipRect
 0x4bc438 GetWindowOrgEx
 0x4bc43c GetWinMetaFileBits
 0x4bc440 GetTextMetricsA
 0x4bc444 GetTextExtentPoint32A
 0x4bc448 GetTextAlign
 0x4bc44c GetSystemPaletteEntries
 0x4bc450 GetStockObject
 0x4bc454 GetPixel
 0x4bc458 GetPaletteEntries
 0x4bc45c GetObjectA
 0x4bc460 GetEnhMetaFilePaletteEntries
 0x4bc464 GetEnhMetaFileHeader
 0x4bc468 GetEnhMetaFileBits
 0x4bc46c GetDeviceCaps
 0x4bc470 GetDIBits
 0x4bc474 GetDIBColorTable
 0x4bc478 GetDCOrgEx
 0x4bc47c GetCurrentPositionEx
 0x4bc480 GetClipBox
 0x4bc484 GetBrushOrgEx
 0x4bc488 GetBkMode
 0x4bc48c GetBkColor
 0x4bc490 GetBitmapBits
 0x4bc494 ExtTextOutA
 0x4bc498 ExtSelectClipRgn
 0x4bc49c ExtCreatePen
 0x4bc4a0 ExcludeClipRect
 0x4bc4a4 EndPage
 0x4bc4a8 EndDoc
 0x4bc4ac Ellipse
 0x4bc4b0 DeleteObject
 0x4bc4b4 DeleteEnhMetaFile
 0x4bc4b8 DeleteDC
 0x4bc4bc CreateSolidBrush
 0x4bc4c0 CreateRectRgn
 0x4bc4c4 CreatePolygonRgn
 0x4bc4c8 CreatePenIndirect
 0x4bc4cc CreatePalette
 0x4bc4d0 CreateICA
 0x4bc4d4 CreateHalftonePalette
 0x4bc4d8 CreateFontIndirectA
 0x4bc4dc CreateDIBitmap
 0x4bc4e0 CreateDIBSection
 0x4bc4e4 CreateDCA
 0x4bc4e8 CreateCompatibleDC
 0x4bc4ec CreateCompatibleBitmap
 0x4bc4f0 CreateBrushIndirect
 0x4bc4f4 CreateBitmap
 0x4bc4f8 CopyEnhMetaFileA
 0x4bc4fc BitBlt
 0x4bc500 Arc
user32.dll
 0x4bc508 CreateWindowExA
 0x4bc50c WindowFromPoint
 0x4bc510 WinHelpA
 0x4bc514 WaitMessage
 0x4bc518 UpdateWindow
 0x4bc51c UnregisterClassA
 0x4bc520 UnhookWindowsHookEx
 0x4bc524 TranslateMessage
 0x4bc528 TranslateMDISysAccel
 0x4bc52c TrackPopupMenu
 0x4bc530 SystemParametersInfoA
 0x4bc534 ShowWindow
 0x4bc538 ShowScrollBar
 0x4bc53c ShowOwnedPopups
 0x4bc540 ShowCursor
 0x4bc544 SetWindowsHookExA
 0x4bc548 SetWindowTextA
 0x4bc54c SetWindowPos
 0x4bc550 SetWindowPlacement
 0x4bc554 SetWindowLongA
 0x4bc558 SetTimer
 0x4bc55c SetScrollRange
 0x4bc560 SetScrollPos
 0x4bc564 SetScrollInfo
 0x4bc568 SetRect
 0x4bc56c SetPropA
 0x4bc570 SetParent
 0x4bc574 SetMenuItemInfoA
 0x4bc578 SetMenu
 0x4bc57c SetForegroundWindow
 0x4bc580 SetFocus
 0x4bc584 SetCursor
 0x4bc588 SetClassLongA
 0x4bc58c SetCapture
 0x4bc590 SetActiveWindow
 0x4bc594 SendMessageA
 0x4bc598 SendDlgItemMessageA
 0x4bc59c ScrollWindow
 0x4bc5a0 ScreenToClient
 0x4bc5a4 RemovePropA
 0x4bc5a8 RemoveMenu
 0x4bc5ac ReleaseDC
 0x4bc5b0 ReleaseCapture
 0x4bc5b4 RegisterWindowMessageA
 0x4bc5b8 RegisterClipboardFormatA
 0x4bc5bc RegisterClassA
 0x4bc5c0 RedrawWindow
 0x4bc5c4 PtInRect
 0x4bc5c8 PostQuitMessage
 0x4bc5cc PostMessageA
 0x4bc5d0 PeekMessageA
 0x4bc5d4 OffsetRect
 0x4bc5d8 OemToCharBuffA
 0x4bc5dc OemToCharA
 0x4bc5e0 MessageBoxA
 0x4bc5e4 MapWindowPoints
 0x4bc5e8 MapVirtualKeyA
 0x4bc5ec LoadStringA
 0x4bc5f0 LoadKeyboardLayoutA
 0x4bc5f4 LoadIconA
 0x4bc5f8 LoadCursorA
 0x4bc5fc LoadBitmapA
 0x4bc600 KillTimer
 0x4bc604 IsZoomed
 0x4bc608 IsWindowVisible
 0x4bc60c IsWindowEnabled
 0x4bc610 IsWindow
 0x4bc614 IsRectEmpty
 0x4bc618 IsIconic
 0x4bc61c IsDialogMessageA
 0x4bc620 IsChild
 0x4bc624 InvalidateRect
 0x4bc628 IntersectRect
 0x4bc62c InsertMenuItemA
 0x4bc630 InsertMenuA
 0x4bc634 InflateRect
 0x4bc638 GetWindowThreadProcessId
 0x4bc63c GetWindowTextA
 0x4bc640 GetWindowRect
 0x4bc644 GetWindowPlacement
 0x4bc648 GetWindowLongA
 0x4bc64c GetWindowDC
 0x4bc650 GetTopWindow
 0x4bc654 GetSystemMetrics
 0x4bc658 GetSystemMenu
 0x4bc65c GetSysColorBrush
 0x4bc660 GetSysColor
 0x4bc664 GetSubMenu
 0x4bc668 GetScrollRange
 0x4bc66c GetScrollPos
 0x4bc670 GetScrollInfo
 0x4bc674 GetPropA
 0x4bc678 GetParent
 0x4bc67c GetWindow
 0x4bc680 GetMenuStringA
 0x4bc684 GetMenuState
 0x4bc688 GetMenuItemInfoA
 0x4bc68c GetMenuItemID
 0x4bc690 GetMenuItemCount
 0x4bc694 GetMenu
 0x4bc698 GetLastActivePopup
 0x4bc69c GetKeyboardState
 0x4bc6a0 GetKeyboardLayoutList
 0x4bc6a4 GetKeyboardLayout
 0x4bc6a8 GetKeyState
 0x4bc6ac GetKeyNameTextA
 0x4bc6b0 GetIconInfo
 0x4bc6b4 GetForegroundWindow
 0x4bc6b8 GetFocus
 0x4bc6bc GetDesktopWindow
 0x4bc6c0 GetDCEx
 0x4bc6c4 GetDC
 0x4bc6c8 GetCursorPos
 0x4bc6cc GetCursor
 0x4bc6d0 GetClipboardData
 0x4bc6d4 GetClientRect
 0x4bc6d8 GetClassNameA
 0x4bc6dc GetClassInfoA
 0x4bc6e0 GetCapture
 0x4bc6e4 GetActiveWindow
 0x4bc6e8 FrameRect
 0x4bc6ec FindWindowA
 0x4bc6f0 FillRect
 0x4bc6f4 EqualRect
 0x4bc6f8 EnumWindows
 0x4bc6fc EnumThreadWindows
 0x4bc700 EndPaint
 0x4bc704 EndDeferWindowPos
 0x4bc708 EnableWindow
 0x4bc70c EnableScrollBar
 0x4bc710 EnableMenuItem
 0x4bc714 DrawTextA
 0x4bc718 DrawMenuBar
 0x4bc71c DrawIconEx
 0x4bc720 DrawIcon
 0x4bc724 DrawFrameControl
 0x4bc728 DrawFocusRect
 0x4bc72c DrawEdge
 0x4bc730 DispatchMessageA
 0x4bc734 DestroyWindow
 0x4bc738 DestroyMenu
 0x4bc73c DestroyIcon
 0x4bc740 DestroyCursor
 0x4bc744 DeleteMenu
 0x4bc748 DeferWindowPos
 0x4bc74c DefWindowProcA
 0x4bc750 DefMDIChildProcA
 0x4bc754 DefFrameProcA
 0x4bc758 CreatePopupMenu
 0x4bc75c CreateMenu
 0x4bc760 CreateIcon
 0x4bc764 ClientToScreen
 0x4bc768 CheckMenuItem
 0x4bc76c CallWindowProcA
 0x4bc770 CallNextHookEx
 0x4bc774 BeginPaint
 0x4bc778 BeginDeferWindowPos
 0x4bc77c CharNextA
 0x4bc780 CharLowerBuffA
 0x4bc784 CharLowerA
 0x4bc788 CharUpperBuffA
 0x4bc78c CharToOemBuffA
 0x4bc790 CharToOemA
 0x4bc794 AdjustWindowRectEx
 0x4bc798 ActivateKeyboardLayout
kernel32.dll
 0x4bc7a0 Sleep
oleaut32.dll
 0x4bc7a8 SafeArrayPtrOfIndex
 0x4bc7ac SafeArrayPutElement
 0x4bc7b0 SafeArrayGetElement
 0x4bc7b4 SafeArrayUnaccessData
 0x4bc7b8 SafeArrayAccessData
 0x4bc7bc SafeArrayGetUBound
 0x4bc7c0 SafeArrayGetLBound
 0x4bc7c4 SafeArrayCreate
 0x4bc7c8 VariantChangeType
 0x4bc7cc VariantCopyInd
 0x4bc7d0 VariantCopy
 0x4bc7d4 VariantClear
 0x4bc7d8 VariantInit
ole32.dll
 0x4bc7e0 CoCreateInstance
 0x4bc7e4 CoUninitialize
 0x4bc7e8 CoInitialize
oleaut32.dll
 0x4bc7f0 GetErrorInfo
 0x4bc7f4 SysFreeString
comctl32.dll
 0x4bc7fc ImageList_SetIconSize
 0x4bc800 ImageList_GetIconSize
 0x4bc804 ImageList_Write
 0x4bc808 ImageList_Read
 0x4bc80c ImageList_GetDragImage
 0x4bc810 ImageList_DragShowNolock
 0x4bc814 ImageList_SetDragCursorImage
 0x4bc818 ImageList_DragMove
 0x4bc81c ImageList_DragLeave
 0x4bc820 ImageList_DragEnter
 0x4bc824 ImageList_EndDrag
 0x4bc828 ImageList_BeginDrag
 0x4bc82c ImageList_Remove
 0x4bc830 ImageList_DrawEx
 0x4bc834 ImageList_Draw
 0x4bc838 ImageList_GetBkColor
 0x4bc83c ImageList_SetBkColor
 0x4bc840 ImageList_ReplaceIcon
 0x4bc844 ImageList_Add
 0x4bc848 ImageList_GetImageCount
 0x4bc84c ImageList_Destroy
 0x4bc850 ImageList_Create
 0x4bc854 InitCommonControls
winspool.drv
 0x4bc85c OpenPrinterA
 0x4bc860 EnumPrintersA
 0x4bc864 DocumentPropertiesA
 0x4bc868 ClosePrinter
shell32.dll
 0x4bc870 ShellExecuteExW
comdlg32.dll
 0x4bc878 ChooseFontA
 0x4bc87c ChooseColorA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure