popup

Report - 112.exe

UPX Malicious Library OS Processor Check PE File PE32 PE64
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.07.24 17:03 Machine s1_win7_x6401
Filename 112.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
 Behavior Score
3.8
ZERO API file : malware
VT API (file) 33 detected (AIDetectMalware, Miner, Save, VMProtect, AGen, malicious, high confidence, J suspicious, score, njRAT, bcoln, TrojanX, SMOKELOADER, YXDGWZ, Krypt, Wacatac, Coinminer, 9IJ0BU, Detected, Artemis, Cordimik, CLOUD, Behavior, confidence, 100%)
md5 d301e057a599f796b6d1335a30efd1e7
sha256 59595ebfcadd54198faf0ad6a2c2418a262cb3900392eacb285f2e32b631bf6c
ssdeep 196608:04Qcq8KK8Ioew+kpFmLQFgYK6nHPTZar7crAHjDtqi/RzmTMNq/fw:EcqcRoe5kFmGbbSsADcMRCTJw
imphash fa8d20faea9ef7b4e2b7fbfe93442593
impfuzzy 48:J9FprOcLy1XFjn6S3NYfBtDXMKc+pncEpFH:JVrFLy1XFLDufBtDXMKc+pn7pFH
  Network IP location

Signature (10cnts)

Level Description
danger File has been identified by 33 AntiVirus engines on VirusTotal as malicious
watch Deletes executed files from disk
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops a binary and executes it
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x429000 GetLastError
 0x429004 SetLastError
 0x429008 FormatMessageW
 0x42900c GetFileType
 0x429010 GetStdHandle
 0x429014 WriteFile
 0x429018 ReadFile
 0x42901c FlushFileBuffers
 0x429020 SetEndOfFile
 0x429024 SetFilePointer
 0x429028 SetFileTime
 0x42902c CloseHandle
 0x429030 CreateFileW
 0x429034 GetCurrentProcessId
 0x429038 CreateDirectoryW
 0x42903c SetFileAttributesW
 0x429040 GetFileAttributesW
 0x429044 DeleteFileW
 0x429048 MoveFileW
 0x42904c FindClose
 0x429050 FindFirstFileW
 0x429054 FindNextFileW
 0x429058 GetVersionExW
 0x42905c GetCurrentDirectoryW
 0x429060 GetFullPathNameW
 0x429064 FoldStringW
 0x429068 GetModuleFileNameW
 0x42906c GetModuleHandleW
 0x429070 FindResourceW
 0x429074 FreeLibrary
 0x429078 GetProcAddress
 0x42907c ExitProcess
 0x429080 SetThreadExecutionState
 0x429084 Sleep
 0x429088 LoadLibraryW
 0x42908c GetSystemDirectoryW
 0x429090 CompareStringW
 0x429094 AllocConsole
 0x429098 FreeConsole
 0x42909c AttachConsole
 0x4290a0 WriteConsoleW
 0x4290a4 SystemTimeToTzSpecificLocalTime
 0x4290a8 TzSpecificLocalTimeToSystemTime
 0x4290ac SystemTimeToFileTime
 0x4290b0 LocalFileTimeToFileTime
 0x4290b4 FileTimeToSystemTime
 0x4290b8 GetCPInfo
 0x4290bc IsDBCSLeadByte
 0x4290c0 MultiByteToWideChar
 0x4290c4 WideCharToMultiByte
 0x4290c8 GlobalAlloc
 0x4290cc LockResource
 0x4290d0 GlobalLock
 0x4290d4 GlobalUnlock
 0x4290d8 GlobalFree
 0x4290dc LoadResource
 0x4290e0 SizeofResource
 0x4290e4 SetCurrentDirectoryW
 0x4290e8 GetTimeFormatW
 0x4290ec GetDateFormatW
 0x4290f0 LocalFree
 0x4290f4 GetCurrentProcess
 0x4290f8 GetExitCodeProcess
 0x4290fc WaitForSingleObject
 0x429100 GetLocalTime
 0x429104 GetTickCount
 0x429108 MapViewOfFile
 0x42910c UnmapViewOfFile
 0x429110 CreateFileMappingW
 0x429114 OpenFileMappingW
 0x429118 GetCommandLineW
 0x42911c SetEnvironmentVariableW
 0x429120 ExpandEnvironmentStringsW
 0x429124 GetTempPathW
 0x429128 MoveFileExW
 0x42912c GetLocaleInfoW
 0x429130 GetNumberFormatW
 0x429134 GetOEMCP
 0x429138 DecodePointer
 0x42913c SetFilePointerEx
 0x429140 GetConsoleMode
 0x429144 GetConsoleCP
 0x429148 HeapSize
 0x42914c SetStdHandle
 0x429150 GetProcessHeap
 0x429154 FreeEnvironmentStringsW
 0x429158 GetEnvironmentStringsW
 0x42915c RaiseException
 0x429160 GetSystemInfo
 0x429164 VirtualProtect
 0x429168 VirtualQuery
 0x42916c LoadLibraryExA
 0x429170 IsProcessorFeaturePresent
 0x429174 IsDebuggerPresent
 0x429178 UnhandledExceptionFilter
 0x42917c SetUnhandledExceptionFilter
 0x429180 GetStartupInfoW
 0x429184 QueryPerformanceCounter
 0x429188 GetCurrentThreadId
 0x42918c GetSystemTimeAsFileTime
 0x429190 InitializeSListHead
 0x429194 TerminateProcess
 0x429198 RtlUnwind
 0x42919c EncodePointer
 0x4291a0 EnterCriticalSection
 0x4291a4 LeaveCriticalSection
 0x4291a8 DeleteCriticalSection
 0x4291ac InitializeCriticalSectionAndSpinCount
 0x4291b0 TlsAlloc
 0x4291b4 TlsGetValue
 0x4291b8 TlsSetValue
 0x4291bc TlsFree
 0x4291c0 LoadLibraryExW
 0x4291c4 QueryPerformanceFrequency
 0x4291c8 GetModuleHandleExW
 0x4291cc GetModuleFileNameA
 0x4291d0 GetACP
 0x4291d4 HeapFree
 0x4291d8 HeapAlloc
 0x4291dc HeapReAlloc
 0x4291e0 GetStringTypeW
 0x4291e4 LCMapStringW
 0x4291e8 FindFirstFileExA
 0x4291ec FindNextFileA
 0x4291f0 IsValidCodePage
 0x4291f4 GetCommandLineA
OLEAUT32.dll
 0x4291fc VariantClear
gdiplus.dll
 0x429204 GdipCreateBitmapFromStream
 0x429208 GdipAlloc
 0x42920c GdipCloneImage
 0x429210 GdipDisposeImage
 0x429214 GdipCreateBitmapFromStreamICM
 0x429218 GdipCreateHBITMAPFromBitmap
 0x42921c GdiplusStartup
 0x429220 GdiplusShutdown
 0x429224 GdipFree

EAT(Export Address Table) Library


Similarity measure (PE file only) - Checking for service failure