popup

Report - Adobe.ClientSetup.exe

njRAT backdoor Generic Malware UPX Malicious Library Antivirus OS Name Check OS Processor Check CAB PE32 MSOffice File PE File DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.06.28 07:36 Machine s1_win7_x6402
Filename Adobe.ClientSetup.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
5.0
ZERO API file : clean
VT API (file) 15 detected (AIDetectMalware, Tool, Convagent, grayware, confidence, ConnectWise, Eldorado, RemoteAdmin, Generic@AI, RDML, M8M1qcVjjEJpZG7iwhKfRw, edgo, PossibleThreat, MultiInjector, Detected, BScope, Muldrop, susgen)
md5 d70cc583716119d01c718d49c5bd6af9
sha256 af446efec8d2eb3ed1634aedb1dc3da15726dd04d48c5cd1c400e99a780cd5d0
ssdeep 98304:/0eT06+6efPGcXtjBgm2JOrvnSdYdsxGWBnxdGsC:/0oefPRXYmhvnSnLFxd+
imphash 9771ee6344923fa220489ab01239bdfd
impfuzzy 24:Hur+UvYDFMUntMS17hlJeDc+pl39T7oLU0OovbOPZvvQEvTZEQQ:HuCtMS17Oc+pp97N3tRvT6N
  Network IP location

Signature (15cnts)

Level Description
watch Creates known Upatre files
watch File has been identified by 15 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path
info Uses Windows APIs to generate a cryptographic key

Rules (19cnts)

Level Name Description Collection
danger Win_Backdoor_njRAT_Zero Win Backdoor njRAT binaries (upload)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Antivirus Contains references to security software binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info CAB_file_format CAB archive file binaries (download)
info CAB_file_format CAB archive file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info Microsoft_Office_File_Zero Microsoft Office File binaries (download)
info Microsoft_Office_File_Zero Microsoft Office File binaries (upload)
info OS_Name_Check_Zero OS Name Check Signature binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
instance-nlf9kz-relay.screenconnect.com
whois
US RGnet OU 147.28.146.16 clean
147.28.146.16
whois
US RGnet OU 147.28.146.16 clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x40d134 CorBindToRuntimeEx
KERNEL32.dll
 0x40d000 GetModuleFileNameA
 0x40d004 DecodePointer
 0x40d008 SizeofResource
 0x40d00c LockResource
 0x40d010 LoadLibraryW
 0x40d014 LoadResource
 0x40d018 FindResourceW
 0x40d01c GetProcAddress
 0x40d020 WriteConsoleW
 0x40d024 SetFilePointerEx
 0x40d028 GetConsoleMode
 0x40d02c GetConsoleCP
 0x40d030 FlushFileBuffers
 0x40d034 HeapReAlloc
 0x40d038 HeapSize
 0x40d03c UnhandledExceptionFilter
 0x40d040 SetUnhandledExceptionFilter
 0x40d044 GetCurrentProcess
 0x40d048 TerminateProcess
 0x40d04c IsProcessorFeaturePresent
 0x40d050 QueryPerformanceCounter
 0x40d054 GetCurrentProcessId
 0x40d058 GetCurrentThreadId
 0x40d05c GetSystemTimeAsFileTime
 0x40d060 InitializeSListHead
 0x40d064 IsDebuggerPresent
 0x40d068 GetStartupInfoW
 0x40d06c GetModuleHandleW
 0x40d070 RtlUnwind
 0x40d074 GetLastError
 0x40d078 SetLastError
 0x40d07c EncodePointer
 0x40d080 EnterCriticalSection
 0x40d084 LeaveCriticalSection
 0x40d088 DeleteCriticalSection
 0x40d08c InitializeCriticalSectionAndSpinCount
 0x40d090 TlsAlloc
 0x40d094 TlsGetValue
 0x40d098 TlsSetValue
 0x40d09c TlsFree
 0x40d0a0 FreeLibrary
 0x40d0a4 LoadLibraryExW
 0x40d0a8 RaiseException
 0x40d0ac GetStdHandle
 0x40d0b0 WriteFile
 0x40d0b4 CreateFileW
 0x40d0b8 MultiByteToWideChar
 0x40d0bc WideCharToMultiByte
 0x40d0c0 ExitProcess
 0x40d0c4 GetModuleHandleExW
 0x40d0c8 GetACP
 0x40d0cc CloseHandle
 0x40d0d0 HeapAlloc
 0x40d0d4 HeapFree
 0x40d0d8 FindClose
 0x40d0dc FindFirstFileExA
 0x40d0e0 FindNextFileA
 0x40d0e4 IsValidCodePage
 0x40d0e8 GetOEMCP
 0x40d0ec GetCPInfo
 0x40d0f0 GetCommandLineA
 0x40d0f4 GetCommandLineW
 0x40d0f8 GetEnvironmentStringsW
 0x40d0fc FreeEnvironmentStringsW
 0x40d100 LCMapStringW
 0x40d104 SetStdHandle
 0x40d108 GetFileType
 0x40d10c GetStringTypeW
 0x40d110 GetProcessHeap
OLEAUT32.dll
 0x40d118 VariantInit
 0x40d11c SafeArrayUnaccessData
 0x40d120 SafeArrayCreateVector
 0x40d124 SafeArrayDestroy
 0x40d128 VariantClear
 0x40d12c SafeArrayAccessData

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure