Report - NewPurchaseOrderPO838735354643332735536345544.exe

UPX Malicious Library MZP Format PE32 PE File
ScreenShot
Created 2023.06.27 09:42 Machine s1_win7_x6401
Filename NewPurchaseOrderPO838735354643332735536345544.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
2.4
ZERO API file : clean
VT API (file) 25 detected (AIDetectMalware, malicious, high confidence, Artemis, Save, Attribute, HighConfidence, ModiLoader, score, Androm, DropperX, BadFile, Static AI, Suspicious PE, Leonem, Detected, BScope, Formbook, unsafe, CLASSIC, confidence)
md5 08dc73443b35d4dc882d052c10457f4a
sha256 1c24ed06a4d38c863c4016a0489f66934b9167269b958a17dcdbb6ecae3baf18
ssdeep 12288:zWI+n1cF0p4WhPQbXfu/i7Nx29T1CWaXqIov5n0fc8MMvdgV25wqYyEyHcsbOonS:z28tWhPKXf9PvXqgfvcQrEyHFbOwV
imphash b2ffe640086070c19351a52301f6fb90
impfuzzy 192:f3u+G1OILcbuuArSUvK9RqoaqEse7CPbOQX4:f3Y1AAA9LlPbOQI
  Network IP location

Signature (6cnts)

Level Description
warning File has been identified by 25 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4d71a4 DeleteCriticalSection
 0x4d71a8 LeaveCriticalSection
 0x4d71ac EnterCriticalSection
 0x4d71b0 InitializeCriticalSection
 0x4d71b4 VirtualFree
 0x4d71b8 VirtualAlloc
 0x4d71bc LocalFree
 0x4d71c0 LocalAlloc
 0x4d71c4 GetVersion
 0x4d71c8 GetCurrentThreadId
 0x4d71cc InterlockedDecrement
 0x4d71d0 InterlockedIncrement
 0x4d71d4 VirtualQuery
 0x4d71d8 WideCharToMultiByte
 0x4d71dc MultiByteToWideChar
 0x4d71e0 lstrlenA
 0x4d71e4 lstrcpynA
 0x4d71e8 LoadLibraryExA
 0x4d71ec GetThreadLocale
 0x4d71f0 GetStartupInfoA
 0x4d71f4 GetProcAddress
 0x4d71f8 GetModuleHandleA
 0x4d71fc GetModuleFileNameA
 0x4d7200 GetLocaleInfoA
 0x4d7204 GetCommandLineA
 0x4d7208 FreeLibrary
 0x4d720c FindFirstFileA
 0x4d7210 FindClose
 0x4d7214 ExitProcess
 0x4d7218 WriteFile
 0x4d721c UnhandledExceptionFilter
 0x4d7220 RtlUnwind
 0x4d7224 RaiseException
 0x4d7228 GetStdHandle
user32.dll
 0x4d7230 GetKeyboardType
 0x4d7234 LoadStringA
 0x4d7238 MessageBoxA
 0x4d723c CharNextA
advapi32.dll
 0x4d7244 RegQueryValueExA
 0x4d7248 RegOpenKeyExA
 0x4d724c RegCloseKey
oleaut32.dll
 0x4d7254 SysFreeString
 0x4d7258 SysReAllocStringLen
 0x4d725c SysAllocStringLen
kernel32.dll
 0x4d7264 TlsSetValue
 0x4d7268 TlsGetValue
 0x4d726c LocalAlloc
 0x4d7270 GetModuleHandleA
advapi32.dll
 0x4d7278 RegQueryValueExA
 0x4d727c RegOpenKeyExA
 0x4d7280 RegCloseKey
 0x4d7284 IsTextUnicode
kernel32.dll
 0x4d728c lstrcpyA
 0x4d7290 WriteFile
 0x4d7294 WaitForSingleObject
 0x4d7298 VirtualQuery
 0x4d729c VirtualProtect
 0x4d72a0 VirtualAlloc
 0x4d72a4 Sleep
 0x4d72a8 SizeofResource
 0x4d72ac SetThreadLocale
 0x4d72b0 SetFilePointer
 0x4d72b4 SetEvent
 0x4d72b8 SetErrorMode
 0x4d72bc SetEndOfFile
 0x4d72c0 ResetEvent
 0x4d72c4 ReadFile
 0x4d72c8 MultiByteToWideChar
 0x4d72cc MulDiv
 0x4d72d0 LockResource
 0x4d72d4 LoadResource
 0x4d72d8 LoadLibraryExA
 0x4d72dc LoadLibraryA
 0x4d72e0 LeaveCriticalSection
 0x4d72e4 InitializeCriticalSection
 0x4d72e8 GlobalUnlock
 0x4d72ec GlobalSize
 0x4d72f0 GlobalReAlloc
 0x4d72f4 GlobalHandle
 0x4d72f8 GlobalLock
 0x4d72fc GlobalFree
 0x4d7300 GlobalFindAtomA
 0x4d7304 GlobalDeleteAtom
 0x4d7308 GlobalAlloc
 0x4d730c GlobalAddAtomA
 0x4d7310 GetVersionExA
 0x4d7314 GetVersion
 0x4d7318 GetUserDefaultLCID
 0x4d731c GetTickCount
 0x4d7320 GetThreadLocale
 0x4d7324 GetSystemInfo
 0x4d7328 GetStringTypeExA
 0x4d732c GetStdHandle
 0x4d7330 GetProcAddress
 0x4d7334 GetModuleHandleA
 0x4d7338 GetModuleFileNameA
 0x4d733c GetLocaleInfoA
 0x4d7340 GetLocalTime
 0x4d7344 GetLastError
 0x4d7348 GetFullPathNameA
 0x4d734c GetDiskFreeSpaceA
 0x4d7350 GetDateFormatA
 0x4d7354 GetCurrentThreadId
 0x4d7358 GetCurrentProcessId
 0x4d735c GetCurrentProcess
 0x4d7360 GetCPInfo
 0x4d7364 GetACP
 0x4d7368 FreeResource
 0x4d736c InterlockedExchange
 0x4d7370 FreeLibrary
 0x4d7374 FormatMessageA
 0x4d7378 FlushInstructionCache
 0x4d737c FindResourceA
 0x4d7380 EnumCalendarInfoA
 0x4d7384 EnterCriticalSection
 0x4d7388 DeleteCriticalSection
 0x4d738c CreateThread
 0x4d7390 CreateFileA
 0x4d7394 CreateEventA
 0x4d7398 CompareStringA
 0x4d739c CloseHandle
version.dll
 0x4d73a4 VerQueryValueA
 0x4d73a8 GetFileVersionInfoSizeA
 0x4d73ac GetFileVersionInfoA
gdi32.dll
 0x4d73b4 UnrealizeObject
 0x4d73b8 StretchBlt
 0x4d73bc SetWindowOrgEx
 0x4d73c0 SetWinMetaFileBits
 0x4d73c4 SetViewportOrgEx
 0x4d73c8 SetTextColor
 0x4d73cc SetStretchBltMode
 0x4d73d0 SetROP2
 0x4d73d4 SetPixel
 0x4d73d8 SetEnhMetaFileBits
 0x4d73dc SetDIBColorTable
 0x4d73e0 SetBrushOrgEx
 0x4d73e4 SetBkMode
 0x4d73e8 SetBkColor
 0x4d73ec SelectPalette
 0x4d73f0 SelectObject
 0x4d73f4 SelectClipRgn
 0x4d73f8 SaveDC
 0x4d73fc RestoreDC
 0x4d7400 Rectangle
 0x4d7404 RectVisible
 0x4d7408 RealizePalette
 0x4d740c Polyline
 0x4d7410 PlayEnhMetaFile
 0x4d7414 PatBlt
 0x4d7418 MoveToEx
 0x4d741c MaskBlt
 0x4d7420 LineTo
 0x4d7424 IntersectClipRect
 0x4d7428 GetWindowOrgEx
 0x4d742c GetWinMetaFileBits
 0x4d7430 GetTextMetricsA
 0x4d7434 GetTextExtentPoint32A
 0x4d7438 GetSystemPaletteEntries
 0x4d743c GetStockObject
 0x4d7440 GetRgnBox
 0x4d7444 GetPixel
 0x4d7448 GetPaletteEntries
 0x4d744c GetObjectA
 0x4d7450 GetEnhMetaFilePaletteEntries
 0x4d7454 GetEnhMetaFileHeader
 0x4d7458 GetEnhMetaFileDescriptionA
 0x4d745c GetEnhMetaFileBits
 0x4d7460 GetDeviceCaps
 0x4d7464 GetDIBits
 0x4d7468 GetDIBColorTable
 0x4d746c GetDCOrgEx
 0x4d7470 GetCurrentPositionEx
 0x4d7474 GetClipBox
 0x4d7478 GetBrushOrgEx
 0x4d747c GetBitmapBits
 0x4d7480 ExcludeClipRect
 0x4d7484 DeleteObject
 0x4d7488 DeleteEnhMetaFile
 0x4d748c DeleteDC
 0x4d7490 CreateSolidBrush
 0x4d7494 CreateRectRgn
 0x4d7498 CreatePenIndirect
 0x4d749c CreatePalette
 0x4d74a0 CreateHalftonePalette
 0x4d74a4 CreateFontIndirectA
 0x4d74a8 CreateEnhMetaFileA
 0x4d74ac CreateDIBitmap
 0x4d74b0 CreateDIBSection
 0x4d74b4 CreateCompatibleDC
 0x4d74b8 CreateCompatibleBitmap
 0x4d74bc CreateBrushIndirect
 0x4d74c0 CreateBitmap
 0x4d74c4 CopyEnhMetaFileA
 0x4d74c8 CombineRgn
 0x4d74cc CloseEnhMetaFile
 0x4d74d0 BitBlt
user32.dll
 0x4d74d8 CreateWindowExA
 0x4d74dc WindowFromPoint
 0x4d74e0 WinHelpA
 0x4d74e4 WaitMessage
 0x4d74e8 UpdateWindow
 0x4d74ec UnregisterClassA
 0x4d74f0 UnhookWindowsHookEx
 0x4d74f4 TranslateMessage
 0x4d74f8 TranslateMDISysAccel
 0x4d74fc TrackPopupMenu
 0x4d7500 SystemParametersInfoA
 0x4d7504 ShowWindow
 0x4d7508 ShowScrollBar
 0x4d750c ShowOwnedPopups
 0x4d7510 ShowCursor
 0x4d7514 SetWindowsHookExA
 0x4d7518 SetWindowTextA
 0x4d751c SetWindowPos
 0x4d7520 SetWindowPlacement
 0x4d7524 SetWindowLongA
 0x4d7528 SetTimer
 0x4d752c SetScrollRange
 0x4d7530 SetScrollPos
 0x4d7534 SetScrollInfo
 0x4d7538 SetRect
 0x4d753c SetPropA
 0x4d7540 SetParent
 0x4d7544 SetMenuItemInfoA
 0x4d7548 SetMenu
 0x4d754c SetForegroundWindow
 0x4d7550 SetFocus
 0x4d7554 SetCursor
 0x4d7558 SetClassLongA
 0x4d755c SetCapture
 0x4d7560 SetActiveWindow
 0x4d7564 SendMessageA
 0x4d7568 ScrollWindow
 0x4d756c ScreenToClient
 0x4d7570 RemovePropA
 0x4d7574 RemoveMenu
 0x4d7578 ReleaseDC
 0x4d757c ReleaseCapture
 0x4d7580 RegisterWindowMessageA
 0x4d7584 RegisterClipboardFormatA
 0x4d7588 RegisterClassA
 0x4d758c RedrawWindow
 0x4d7590 PtInRect
 0x4d7594 PostQuitMessage
 0x4d7598 PostMessageA
 0x4d759c PeekMessageA
 0x4d75a0 OffsetRect
 0x4d75a4 OemToCharA
 0x4d75a8 MessageBoxA
 0x4d75ac MapWindowPoints
 0x4d75b0 MapVirtualKeyA
 0x4d75b4 LoadStringA
 0x4d75b8 LoadKeyboardLayoutA
 0x4d75bc LoadIconA
 0x4d75c0 LoadCursorA
 0x4d75c4 LoadBitmapA
 0x4d75c8 KillTimer
 0x4d75cc IsZoomed
 0x4d75d0 IsWindowVisible
 0x4d75d4 IsWindowEnabled
 0x4d75d8 IsWindow
 0x4d75dc IsRectEmpty
 0x4d75e0 IsIconic
 0x4d75e4 IsDialogMessageA
 0x4d75e8 IsChild
 0x4d75ec InvalidateRect
 0x4d75f0 IntersectRect
 0x4d75f4 InsertMenuItemA
 0x4d75f8 InsertMenuA
 0x4d75fc InflateRect
 0x4d7600 GetWindowThreadProcessId
 0x4d7604 GetWindowTextA
 0x4d7608 GetWindowRect
 0x4d760c GetWindowPlacement
 0x4d7610 GetWindowLongA
 0x4d7614 GetWindowDC
 0x4d7618 GetTopWindow
 0x4d761c GetSystemMetrics
 0x4d7620 GetSystemMenu
 0x4d7624 GetSysColorBrush
 0x4d7628 GetSysColor
 0x4d762c GetSubMenu
 0x4d7630 GetScrollRange
 0x4d7634 GetScrollPos
 0x4d7638 GetScrollInfo
 0x4d763c GetPropA
 0x4d7640 GetParent
 0x4d7644 GetWindow
 0x4d7648 GetMessageTime
 0x4d764c GetMenuStringA
 0x4d7650 GetMenuState
 0x4d7654 GetMenuItemInfoA
 0x4d7658 GetMenuItemID
 0x4d765c GetMenuItemCount
 0x4d7660 GetMenu
 0x4d7664 GetLastActivePopup
 0x4d7668 GetKeyboardState
 0x4d766c GetKeyboardLayoutList
 0x4d7670 GetKeyboardLayout
 0x4d7674 GetKeyState
 0x4d7678 GetKeyNameTextA
 0x4d767c GetIconInfo
 0x4d7680 GetForegroundWindow
 0x4d7684 GetFocus
 0x4d7688 GetDesktopWindow
 0x4d768c GetDCEx
 0x4d7690 GetDC
 0x4d7694 GetCursorPos
 0x4d7698 GetCursor
 0x4d769c GetClipboardData
 0x4d76a0 GetClientRect
 0x4d76a4 GetClassNameA
 0x4d76a8 GetClassInfoA
 0x4d76ac GetCapture
 0x4d76b0 GetActiveWindow
 0x4d76b4 FrameRect
 0x4d76b8 FindWindowA
 0x4d76bc FillRect
 0x4d76c0 EqualRect
 0x4d76c4 EnumWindows
 0x4d76c8 EnumThreadWindows
 0x4d76cc EndPaint
 0x4d76d0 EnableWindow
 0x4d76d4 EnableScrollBar
 0x4d76d8 EnableMenuItem
 0x4d76dc DrawTextA
 0x4d76e0 DrawMenuBar
 0x4d76e4 DrawIconEx
 0x4d76e8 DrawIcon
 0x4d76ec DrawFrameControl
 0x4d76f0 DrawEdge
 0x4d76f4 DispatchMessageA
 0x4d76f8 DestroyWindow
 0x4d76fc DestroyMenu
 0x4d7700 DestroyIcon
 0x4d7704 DestroyCursor
 0x4d7708 DeleteMenu
 0x4d770c DefWindowProcA
 0x4d7710 DefMDIChildProcA
 0x4d7714 DefFrameProcA
 0x4d7718 CreatePopupMenu
 0x4d771c CreateMenu
 0x4d7720 CreateIcon
 0x4d7724 ClientToScreen
 0x4d7728 CheckMenuItem
 0x4d772c CallWindowProcA
 0x4d7730 CallNextHookEx
 0x4d7734 BeginPaint
 0x4d7738 CharNextA
 0x4d773c CharLowerBuffA
 0x4d7740 CharLowerA
 0x4d7744 CharUpperBuffA
 0x4d7748 CharToOemA
 0x4d774c AdjustWindowRectEx
 0x4d7750 ActivateKeyboardLayout
kernel32.dll
 0x4d7758 Sleep
oleaut32.dll
 0x4d7760 SafeArrayPtrOfIndex
 0x4d7764 SafeArrayPutElement
 0x4d7768 SafeArrayGetElement
 0x4d776c SafeArrayUnaccessData
 0x4d7770 SafeArrayAccessData
 0x4d7774 SafeArrayGetUBound
 0x4d7778 SafeArrayGetLBound
 0x4d777c SafeArrayCreate
 0x4d7780 VariantChangeType
 0x4d7784 VariantCopyInd
 0x4d7788 VariantCopy
 0x4d778c VariantClear
 0x4d7790 VariantInit
ole32.dll
 0x4d7798 CreateStreamOnHGlobal
 0x4d779c IsAccelerator
 0x4d77a0 OleDraw
 0x4d77a4 OleSetMenuDescriptor
 0x4d77a8 CoCreateInstance
 0x4d77ac CoGetClassObject
 0x4d77b0 CoUninitialize
 0x4d77b4 CoInitialize
 0x4d77b8 IsEqualGUID
oleaut32.dll
 0x4d77c0 GetErrorInfo
 0x4d77c4 SysFreeString
comctl32.dll
 0x4d77cc ImageList_SetIconSize
 0x4d77d0 ImageList_GetIconSize
 0x4d77d4 ImageList_Write
 0x4d77d8 ImageList_Read
 0x4d77dc ImageList_GetDragImage
 0x4d77e0 ImageList_DragShowNolock
 0x4d77e4 ImageList_SetDragCursorImage
 0x4d77e8 ImageList_DragMove
 0x4d77ec ImageList_DragLeave
 0x4d77f0 ImageList_DragEnter
 0x4d77f4 ImageList_EndDrag
 0x4d77f8 ImageList_BeginDrag
 0x4d77fc ImageList_Remove
 0x4d7800 ImageList_DrawEx
 0x4d7804 ImageList_Draw
 0x4d7808 ImageList_GetBkColor
 0x4d780c ImageList_SetBkColor
 0x4d7810 ImageList_ReplaceIcon
 0x4d7814 ImageList_Add
 0x4d7818 ImageList_SetImageCount
 0x4d781c ImageList_GetImageCount
 0x4d7820 ImageList_Destroy
 0x4d7824 ImageList_Create
 0x4d7828 InitCommonControls
Kernel32
 0x4d7830 GetProcAddress
ntdll
 0x4d7838 NtWriteVirtualMemory
 0x4d783c NtProtectVirtualMemory
uRL
 0x4d7844 AutodialHookCallback
ntdll
 0x4d784c NtQueryInformationFile
 0x4d7850 NtOpenFile
 0x4d7854 NtClose
 0x4d7858 NtReadFile
ntdll
 0x4d7860 RtlDosPathNameToNtPathName_U

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure