Report - wininit.exe

NSIS UPX Malicious Library PE File PE32 DLL
ScreenShot
Created 2023.07.26 14:36 Machine s1_win7_x6403
Filename wininit.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
AI Score
8
Behavior Score
2.0
ZERO API
VT API (file)
md5 73bbb2587a15c2e32d469cb3abe192c9
sha256 2dc7f4d1ca16af735a244cdb3e64db160212cbe800803dd7c4cf3f762a08c286
ssdeep 12288:YcXBA3P3dNH1eH9KS+jv/1eHr/gbS5x5pvmcUlxv:YSBAvdNa9WD8LoWzjuP7
imphash e2a592076b17ef8bfb48b7e03965a3fc
impfuzzy 48:Brdj692h5OyxYArOA8ltkz+eOxHALlla/35LFzn7+P9KQJ445EQl/KAEowSv0WbO:Brjh5txSH28dXJuKsI
  Network IP location

Signature (6cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Drops an executable to the user AppData folder
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (8cnts)

Level Name Description Collection
warning NSIS_Installer Null Soft Installer binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x408070 SetCurrentDirectoryW
 0x408074 GetFileAttributesW
 0x408078 GetFullPathNameW
 0x40807c Sleep
 0x408080 GetTickCount
 0x408084 GetFileSize
 0x408088 GetModuleFileNameW
 0x40808c MoveFileW
 0x408090 SetFileAttributesW
 0x408094 GetCurrentProcess
 0x408098 ExitProcess
 0x40809c SetEnvironmentVariableW
 0x4080a0 GetWindowsDirectoryW
 0x4080a4 GetTempPathW
 0x4080a8 GetCommandLineW
 0x4080ac GetVersion
 0x4080b0 SetErrorMode
 0x4080b4 lstrlenW
 0x4080b8 WaitForSingleObject
 0x4080bc CopyFileW
 0x4080c0 CompareFileTime
 0x4080c4 GlobalLock
 0x4080c8 CreateThread
 0x4080cc GetLastError
 0x4080d0 CreateDirectoryW
 0x4080d4 CreateProcessW
 0x4080d8 RemoveDirectoryW
 0x4080dc lstrcmpiA
 0x4080e0 CreateFileW
 0x4080e4 GetTempFileNameW
 0x4080e8 WriteFile
 0x4080ec lstrcpyA
 0x4080f0 lstrcpyW
 0x4080f4 MoveFileExW
 0x4080f8 lstrcatW
 0x4080fc GetSystemDirectoryW
 0x408100 GetProcAddress
 0x408104 GetModuleHandleA
 0x408108 GlobalFree
 0x40810c GlobalAlloc
 0x408110 GetShortPathNameW
 0x408114 SearchPathW
 0x408118 lstrcmpiW
 0x40811c SetFileTime
 0x408120 CloseHandle
 0x408124 ExpandEnvironmentStringsW
 0x408128 lstrcmpW
 0x40812c GlobalUnlock
 0x408130 lstrcpynW
 0x408134 GetDiskFreeSpaceW
 0x408138 GetExitCodeProcess
 0x40813c FindFirstFileW
 0x408140 FindNextFileW
 0x408144 DeleteFileW
 0x408148 SetFilePointer
 0x40814c ReadFile
 0x408150 FindClose
 0x408154 MulDiv
 0x408158 MultiByteToWideChar
 0x40815c lstrlenA
 0x408160 WideCharToMultiByte
 0x408164 GetPrivateProfileStringW
 0x408168 WritePrivateProfileStringW
 0x40816c FreeLibrary
 0x408170 LoadLibraryExW
 0x408174 GetModuleHandleW
USER32.dll
 0x408198 GetSystemMenu
 0x40819c SetClassLongW
 0x4081a0 IsWindowEnabled
 0x4081a4 EnableMenuItem
 0x4081a8 SetWindowPos
 0x4081ac GetSysColor
 0x4081b0 GetWindowLongW
 0x4081b4 SetCursor
 0x4081b8 LoadCursorW
 0x4081bc CheckDlgButton
 0x4081c0 GetMessagePos
 0x4081c4 LoadBitmapW
 0x4081c8 CallWindowProcW
 0x4081cc IsWindowVisible
 0x4081d0 CloseClipboard
 0x4081d4 SetClipboardData
 0x4081d8 EmptyClipboard
 0x4081dc OpenClipboard
 0x4081e0 wsprintfW
 0x4081e4 ScreenToClient
 0x4081e8 GetWindowRect
 0x4081ec GetSystemMetrics
 0x4081f0 SetDlgItemTextW
 0x4081f4 GetDlgItemTextW
 0x4081f8 MessageBoxIndirectW
 0x4081fc CharPrevW
 0x408200 CharNextA
 0x408204 wsprintfA
 0x408208 DispatchMessageW
 0x40820c PeekMessageW
 0x408210 GetDC
 0x408214 ReleaseDC
 0x408218 EnableWindow
 0x40821c InvalidateRect
 0x408220 SendMessageW
 0x408224 DefWindowProcW
 0x408228 BeginPaint
 0x40822c GetClientRect
 0x408230 FillRect
 0x408234 EndDialog
 0x408238 RegisterClassW
 0x40823c SystemParametersInfoW
 0x408240 CreateWindowExW
 0x408244 GetClassInfoW
 0x408248 DialogBoxParamW
 0x40824c CharNextW
 0x408250 ExitWindowsEx
 0x408254 DestroyWindow
 0x408258 LoadImageW
 0x40825c SetTimer
 0x408260 SetWindowTextW
 0x408264 PostQuitMessage
 0x408268 ShowWindow
 0x40826c GetDlgItem
 0x408270 IsWindow
 0x408274 SetWindowLongW
 0x408278 FindWindowExW
 0x40827c TrackPopupMenu
 0x408280 AppendMenuW
 0x408284 CreatePopupMenu
 0x408288 DrawTextW
 0x40828c EndPaint
 0x408290 CreateDialogParamW
 0x408294 SendMessageTimeoutW
 0x408298 SetForegroundWindow
GDI32.dll
 0x40804c SelectObject
 0x408050 SetBkMode
 0x408054 CreateFontIndirectW
 0x408058 SetTextColor
 0x40805c DeleteObject
 0x408060 GetDeviceCaps
 0x408064 CreateBrushIndirect
 0x408068 SetBkColor
SHELL32.dll
 0x40817c SHGetSpecialFolderLocation
 0x408180 SHGetPathFromIDListW
 0x408184 SHBrowseForFolderW
 0x408188 SHGetFileInfoW
 0x40818c ShellExecuteW
 0x408190 SHFileOperationW
ADVAPI32.dll
 0x408000 RegDeleteKeyW
 0x408004 SetFileSecurityW
 0x408008 OpenProcessToken
 0x40800c LookupPrivilegeValueW
 0x408010 AdjustTokenPrivileges
 0x408014 RegOpenKeyExW
 0x408018 RegEnumValueW
 0x40801c RegDeleteValueW
 0x408020 RegCloseKey
 0x408024 RegCreateKeyExW
 0x408028 RegSetValueExW
 0x40802c RegQueryValueExW
 0x408030 RegEnumKeyW
COMCTL32.dll
 0x408038 ImageList_AddMasked
 0x40803c None
 0x408040 ImageList_Destroy
 0x408044 ImageList_Create
ole32.dll
 0x4082a0 OleUninitialize
 0x4082a4 OleInitialize
 0x4082a8 CoTaskMemFree
 0x4082ac CoCreateInstance

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure