Report - dwmop.exe

UPX Malicious Library OS Processor Check PE File PE32
ScreenShot
Created 2023.07.12 17:31 Machine s1_win7_x6403
Filename dwmop.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
9
Behavior Score
1.8
ZERO API file : malware
VT API (file) 27 detected (AIDetectMalware, Stop, Save, malicious, confidence, 100%, Kryptik, KDS1, Eldorado, Attribute, HighConfidence, high confidence, score, Mokes, Obfuscated, Lockbit, high, Static AI, Malicious PE, Wacatac, Detected, unsafe, Generic@AI, RDML, 6+L63i8xYHiuBbCAtvsnwA, susgen)
md5 9749f1713629f82f7c889752d3c616e5
sha256 1aced5b0b35c26283d78ba9f316cda7ec72fe74d8c9bf863f8aaac0e13f8584c
ssdeep 3072:7r5SgoL6smNRbN6hY3Wk8KhPet+oNhwjFMsChEW2fS2+jzylX:xnxDWkJlTihw6bEWMIH0
imphash 8461c300e4915effe1117a39053730dc
impfuzzy 48:/ZjO6tGeWlSp45U3G39hOT+c/0BtJXcvcBL:xJWk45U3O7O+c/0BtJXcvch
  Network IP location

Signature (4cnts)

Level Description
warning File has been identified by 27 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401000 GetVolumeNameForVolumeMountPointA
 0x401004 CreateMutexW
 0x401008 lstrcpynA
 0x40100c DeleteVolumeMountPointA
 0x401010 InterlockedIncrement
 0x401014 HeapFree
 0x401018 GetUserDefaultLCID
 0x40101c WriteConsoleInputA
 0x401020 BackupSeek
 0x401024 FreeEnvironmentStringsA
 0x401028 GetModuleHandleW
 0x40102c UnlockFileEx
 0x401030 FindNextVolumeMountPointA
 0x401034 GetConsoleAliasesLengthA
 0x401038 GetNumberFormatA
 0x40103c GetWindowsDirectoryA
 0x401040 GetConsoleAliasExesW
 0x401044 WaitNamedPipeW
 0x401048 GetCommandLineA
 0x40104c GetVolumePathNameW
 0x401050 ActivateActCtx
 0x401054 GlobalAlloc
 0x401058 GetPrivateProfileIntA
 0x40105c LoadLibraryW
 0x401060 FreeConsole
 0x401064 GetCalendarInfoA
 0x401068 GetConsoleWindow
 0x40106c GetConsoleAliasExesLengthW
 0x401070 GetFileAttributesA
 0x401074 IsDBCSLeadByte
 0x401078 GetCompressedFileSizeA
 0x40107c lstrlenW
 0x401080 GetStringTypeExA
 0x401084 GetNamedPipeHandleStateW
 0x401088 EnumSystemLocalesA
 0x40108c GetLastError
 0x401090 ReadConsoleOutputCharacterA
 0x401094 GetProcAddress
 0x401098 MoveFileW
 0x40109c RemoveDirectoryA
 0x4010a0 EnterCriticalSection
 0x4010a4 GlobalGetAtomNameA
 0x4010a8 CreateSemaphoreW
 0x4010ac WriteConsoleA
 0x4010b0 OpenWaitableTimerW
 0x4010b4 SetCalendarInfoW
 0x4010b8 GetFileType
 0x4010bc BuildCommDCBAndTimeoutsW
 0x4010c0 AddAtomW
 0x4010c4 GetProfileStringA
 0x4010c8 VirtualLock
 0x4010cc OpenJobObjectW
 0x4010d0 FindNextFileA
 0x4010d4 CreateIoCompletionPort
 0x4010d8 _lread
 0x4010dc GetModuleHandleA
 0x4010e0 GetCurrentDirectoryA
 0x4010e4 EnumDateFormatsW
 0x4010e8 PeekConsoleInputA
 0x4010ec GetShortPathNameW
 0x4010f0 FindFirstVolumeA
 0x4010f4 SetFileShortNameA
 0x4010f8 GetVersionExA
 0x4010fc ReadConsoleInputW
 0x401100 TerminateJobObject
 0x401104 MoveFileWithProgressW
 0x401108 DeleteFileA
 0x40110c lstrcpyA
 0x401110 HeapReAlloc
 0x401114 IsProcessorFeaturePresent
 0x401118 InterlockedDecrement
 0x40111c Sleep
 0x401120 InitializeCriticalSection
 0x401124 DeleteCriticalSection
 0x401128 LeaveCriticalSection
 0x40112c EncodePointer
 0x401130 DecodePointer
 0x401134 HeapAlloc
 0x401138 HeapSetInformation
 0x40113c GetStartupInfoW
 0x401140 RtlUnwind
 0x401144 ExitProcess
 0x401148 WriteFile
 0x40114c GetStdHandle
 0x401150 GetModuleFileNameW
 0x401154 HeapCreate
 0x401158 UnhandledExceptionFilter
 0x40115c SetUnhandledExceptionFilter
 0x401160 IsDebuggerPresent
 0x401164 TerminateProcess
 0x401168 GetCurrentProcess
 0x40116c HeapSize
 0x401170 RaiseException
 0x401174 GetModuleFileNameA
 0x401178 FreeEnvironmentStringsW
 0x40117c WideCharToMultiByte
 0x401180 GetEnvironmentStringsW
 0x401184 SetHandleCount
 0x401188 InitializeCriticalSectionAndSpinCount
 0x40118c TlsAlloc
 0x401190 TlsGetValue
 0x401194 TlsSetValue
 0x401198 TlsFree
 0x40119c SetLastError
 0x4011a0 GetCurrentThreadId
 0x4011a4 QueryPerformanceCounter
 0x4011a8 GetTickCount
 0x4011ac GetCurrentProcessId
 0x4011b0 GetSystemTimeAsFileTime
 0x4011b4 GetCPInfo
 0x4011b8 GetACP
 0x4011bc GetOEMCP
 0x4011c0 IsValidCodePage
 0x4011c4 GetStringTypeW
 0x4011c8 MultiByteToWideChar
 0x4011cc LCMapStringW
USER32.dll
 0x4011d4 CharUpperBuffW
WINHTTP.dll
 0x4011dc WinHttpGetProxyForUrl

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure