Report - smbscanlocal-1bf850b4d9587c1017a75a47680584c4.exe

UPX PE File PE32
ScreenShot
Created 2023.07.20 07:03 Machine s1_win7_x6401
Filename smbscanlocal-1bf850b4d9587c1017a75a47680584c4.exe
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
AI Score Not founds Behavior Score
3.0
ZERO API file : malware
VT API (file) 56 detected (Common, malicious, moderate confidence, DeepScan, IGENERIC, RanumBot, Save, confidence, 100%, ZexaF, coGfamdJUcn, ABRisk, DSBY, a variant of WinGo, score, jurlyp, Gencirc, lfdkq, USASHBB23, WinGo, ai score=83, GrayWare, Kryptik, Wacatac, Malware@#1bvvo2myfleiu, Tnega, Detected, R555141, Artemis, unsafe, RnkBend, CLOUD, Static AI, Malicious PE, susgen)
md5 1bf850b4d9587c1017a75a47680584c4
sha256 ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
ssdeep 49152:UELEoxcmAny6Zh9DzmwJe/sKomVVE0zXlKSQjYU:lEoxcpnjPe/xJ7jQ
imphash 6ed4f5f04d62b18d96b26d6db7c18840
impfuzzy 3:swBJAEPw1MO/OywS9KTXzhAXwEQaxRn:dBJAEoZ/OEGDzyRn
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 56 AntiVirus engines on VirusTotal as malicious
watch Detects the presence of Wine emulator
notice The binary likely contains encrypted or compressed data indicative of a packer
notice The executable is compressed using UPX
info Command line console output was observed
info The executable uses a known packer

Rules (3cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.DLL
 0x8e7028 LoadLibraryA
 0x8e702c ExitProcess
 0x8e7030 GetProcAddress
 0x8e7034 VirtualProtect

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure