Report - csrss00.exe

UPX Malicious Library PE File PE32 DLL
ScreenShot
Created 2023.07.12 17:38 Machine s1_win7_x6403
Filename csrss00.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
AI Score
5
Behavior Score
4.0
ZERO API file : malware
VT API (file) 43 detected (AIDetectMalware, Makoob, malicious, high confidence, Artemis, Vxxg, confidence, 100%, Attribute, HighConfidence, NSIS, score, FalseSign, Vdkl, uzzxj, Inject4, GULOADER, YXDGCZ, ai score=80, Wacapew, Detected, unsafe, Chgt)
md5 601f2b22a16a96c9ddaae24e2c5611f2
sha256 8c63c1e28683c7aa90cb40df346fe1d5dbc3b2bd994cd883cd7e551518486098
ssdeep 6144:kC2guh2RGxfWgrfXQi12xMhtj3+z0N+Y9uVza:fY2sxuUfXB2xMfbsS+YsVza
imphash b78ecf47c0a3e24a6f4af114e2d1f5de
impfuzzy 48:JSgtBHZ4O3O785r+tAlt8tz4eObGLllanBL8EFpV74dT+5EQX/1EowhSv0Qxly64:QgtZZ4WO7u9TqqqnUg
  Network IP location

Signature (9cnts)

Level Description
danger File has been identified by 43 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates a shortcut to an executable file
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Drops an executable to the user AppData folder
notice Queries for potentially installed applications
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x407070 SetEnvironmentVariableA
 0x407074 Sleep
 0x407078 GetTickCount
 0x40707c GetFileSize
 0x407080 GetModuleFileNameA
 0x407084 GetCurrentProcess
 0x407088 CopyFileA
 0x40708c GetFileAttributesA
 0x407090 SetFileAttributesA
 0x407094 GetWindowsDirectoryA
 0x407098 GetTempPathA
 0x40709c GetCommandLineA
 0x4070a0 lstrlenA
 0x4070a4 GetVersion
 0x4070a8 SetErrorMode
 0x4070ac lstrcpynA
 0x4070b0 ExitProcess
 0x4070b4 GetFullPathNameA
 0x4070b8 GlobalLock
 0x4070bc CreateThread
 0x4070c0 GetLastError
 0x4070c4 CreateDirectoryA
 0x4070c8 CreateProcessA
 0x4070cc RemoveDirectoryA
 0x4070d0 CreateFileA
 0x4070d4 GetTempFileNameA
 0x4070d8 ReadFile
 0x4070dc WriteFile
 0x4070e0 lstrcpyA
 0x4070e4 MoveFileExA
 0x4070e8 lstrcatA
 0x4070ec GetSystemDirectoryA
 0x4070f0 GetProcAddress
 0x4070f4 CloseHandle
 0x4070f8 SetCurrentDirectoryA
 0x4070fc MoveFileA
 0x407100 CompareFileTime
 0x407104 GetShortPathNameA
 0x407108 SearchPathA
 0x40710c lstrcmpiA
 0x407110 SetFileTime
 0x407114 lstrcmpA
 0x407118 ExpandEnvironmentStringsA
 0x40711c GlobalUnlock
 0x407120 GetDiskFreeSpaceA
 0x407124 GlobalFree
 0x407128 FindFirstFileA
 0x40712c FindNextFileA
 0x407130 DeleteFileA
 0x407134 SetFilePointer
 0x407138 GetPrivateProfileStringA
 0x40713c FindClose
 0x407140 MultiByteToWideChar
 0x407144 FreeLibrary
 0x407148 MulDiv
 0x40714c WritePrivateProfileStringA
 0x407150 LoadLibraryExA
 0x407154 GetModuleHandleA
 0x407158 GetExitCodeProcess
 0x40715c WaitForSingleObject
 0x407160 GlobalAlloc
USER32.dll
 0x407184 ScreenToClient
 0x407188 GetSystemMenu
 0x40718c SetClassLongA
 0x407190 IsWindowEnabled
 0x407194 SetWindowPos
 0x407198 GetSysColor
 0x40719c GetWindowLongA
 0x4071a0 SetCursor
 0x4071a4 LoadCursorA
 0x4071a8 CheckDlgButton
 0x4071ac GetMessagePos
 0x4071b0 LoadBitmapA
 0x4071b4 CallWindowProcA
 0x4071b8 IsWindowVisible
 0x4071bc CloseClipboard
 0x4071c0 SetClipboardData
 0x4071c4 EmptyClipboard
 0x4071c8 PostQuitMessage
 0x4071cc GetWindowRect
 0x4071d0 EnableMenuItem
 0x4071d4 CreatePopupMenu
 0x4071d8 GetSystemMetrics
 0x4071dc SetDlgItemTextA
 0x4071e0 GetDlgItemTextA
 0x4071e4 MessageBoxIndirectA
 0x4071e8 CharPrevA
 0x4071ec DispatchMessageA
 0x4071f0 PeekMessageA
 0x4071f4 ReleaseDC
 0x4071f8 EnableWindow
 0x4071fc InvalidateRect
 0x407200 SendMessageA
 0x407204 DefWindowProcA
 0x407208 BeginPaint
 0x40720c GetClientRect
 0x407210 FillRect
 0x407214 DrawTextA
 0x407218 EndDialog
 0x40721c RegisterClassA
 0x407220 SystemParametersInfoA
 0x407224 CreateWindowExA
 0x407228 GetClassInfoA
 0x40722c DialogBoxParamA
 0x407230 CharNextA
 0x407234 ExitWindowsEx
 0x407238 GetDC
 0x40723c CreateDialogParamA
 0x407240 SetTimer
 0x407244 GetDlgItem
 0x407248 SetWindowLongA
 0x40724c SetForegroundWindow
 0x407250 LoadImageA
 0x407254 IsWindow
 0x407258 SendMessageTimeoutA
 0x40725c FindWindowExA
 0x407260 OpenClipboard
 0x407264 TrackPopupMenu
 0x407268 AppendMenuA
 0x40726c EndPaint
 0x407270 DestroyWindow
 0x407274 wsprintfA
 0x407278 ShowWindow
 0x40727c SetWindowTextA
GDI32.dll
 0x40704c SelectObject
 0x407050 SetBkMode
 0x407054 CreateFontIndirectA
 0x407058 SetTextColor
 0x40705c DeleteObject
 0x407060 GetDeviceCaps
 0x407064 CreateBrushIndirect
 0x407068 SetBkColor
SHELL32.dll
 0x407168 SHGetSpecialFolderLocation
 0x40716c SHGetPathFromIDListA
 0x407170 SHBrowseForFolderA
 0x407174 SHGetFileInfoA
 0x407178 ShellExecuteA
 0x40717c SHFileOperationA
ADVAPI32.dll
 0x407000 RegDeleteKeyA
 0x407004 SetFileSecurityA
 0x407008 OpenProcessToken
 0x40700c LookupPrivilegeValueA
 0x407010 AdjustTokenPrivileges
 0x407014 RegOpenKeyExA
 0x407018 RegEnumValueA
 0x40701c RegDeleteValueA
 0x407020 RegCloseKey
 0x407024 RegCreateKeyExA
 0x407028 RegSetValueExA
 0x40702c RegQueryValueExA
 0x407030 RegEnumKeyA
COMCTL32.dll
 0x407038 ImageList_Create
 0x40703c ImageList_AddMasked
 0x407040 ImageList_Destroy
 0x407044 None
ole32.dll
 0x407284 OleUninitialize
 0x407288 OleInitialize
 0x40728c CoTaskMemFree
 0x407290 CoCreateInstance

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure