Report - dhvedok.exe

HermeticWiper UPX Malicious Library MZP Format PE File PE32
ScreenShot
Created 2023.07.28 10:26 Machine s1_win7_x6403
Filename dhvedok.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
Behavior Score
2.2
ZERO API file : mailcious
VT API (file) 47 detected (Common, Bsymem, Zusy, unsafe, Coroxy, Vdpl, Attribute, HighConfidence, malicious, high confidence, GenKryptik, GMCW, score, CrypterX, Gencirc, cjseu, ObfuscatedPoly, ai score=85, Malware@#3kok1b3xb9wgo, Detected, R593359, GenericRXWG, Chgt, R002H0CGQ23, NeRRuyY8ThO, Krypt, susgen, ETDG, confidence, 100%)
md5 f0f5e6f32198fa1837b3090b7fd71fbb
sha256 b8cdfada8522638a45efdac45fe27eb60b9860222d2486036e12d4a18688445b
ssdeep 6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVelKh:If3zKrMduNndr3zDepGkVwvhHXEV00
imphash 9b9dd0ce11be5cc7646e9cc1614960e6
impfuzzy 96:8cfpHYU3O0MJ4VXhpVU8zS10+YKbuu2RrSUvK9LVqo1GqE6nDwPOQR85:f3lJk1QKbuuArSUvK9RqooqE6EPOQRi
  Network IP location

Signature (4cnts)

Level Description
danger File has been identified by 47 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (6cnts)

Level Name Description Collection
danger HermeticWiper_Zero HermeticWiper binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x45612c DeleteCriticalSection
 0x456130 LeaveCriticalSection
 0x456134 EnterCriticalSection
 0x456138 InitializeCriticalSection
 0x45613c VirtualFree
 0x456140 VirtualAlloc
 0x456144 LocalFree
 0x456148 LocalAlloc
 0x45614c GetVersion
 0x456150 GetCurrentThreadId
 0x456154 InterlockedDecrement
 0x456158 InterlockedIncrement
 0x45615c VirtualQuery
 0x456160 WideCharToMultiByte
 0x456164 MultiByteToWideChar
 0x456168 lstrlenA
 0x45616c lstrcpynA
 0x456170 LoadLibraryExA
 0x456174 GetThreadLocale
 0x456178 GetStartupInfoA
 0x45617c GetProcAddress
 0x456180 GetModuleHandleA
 0x456184 GetModuleFileNameA
 0x456188 GetLocaleInfoA
 0x45618c GetCommandLineA
 0x456190 FreeLibrary
 0x456194 FindFirstFileA
 0x456198 FindClose
 0x45619c ExitProcess
 0x4561a0 WriteFile
 0x4561a4 UnhandledExceptionFilter
 0x4561a8 RtlUnwind
 0x4561ac RaiseException
 0x4561b0 GetStdHandle
user32.dll
 0x4561b8 GetKeyboardType
 0x4561bc LoadStringA
 0x4561c0 MessageBoxA
 0x4561c4 CharNextA
advapi32.dll
 0x4561cc RegQueryValueExA
 0x4561d0 RegOpenKeyExA
 0x4561d4 RegCloseKey
oleaut32.dll
 0x4561dc SysFreeString
 0x4561e0 SysReAllocStringLen
 0x4561e4 SysAllocStringLen
kernel32.dll
 0x4561ec TlsSetValue
 0x4561f0 TlsGetValue
 0x4561f4 LocalAlloc
 0x4561f8 GetModuleHandleA
advapi32.dll
 0x456200 RegQueryValueExA
 0x456204 RegOpenKeyExA
 0x456208 RegCloseKey
 0x45620c GetUserNameA
kernel32.dll
 0x456214 lstrcpyA
 0x456218 WriteFile
 0x45621c WaitForSingleObject
 0x456220 VirtualQuery
 0x456224 VirtualAlloc
 0x456228 Sleep
 0x45622c SizeofResource
 0x456230 SetThreadLocale
 0x456234 SetFilePointer
 0x456238 SetEvent
 0x45623c SetErrorMode
 0x456240 SetEndOfFile
 0x456244 ResetEvent
 0x456248 ReadFile
 0x45624c MulDiv
 0x456250 LockResource
 0x456254 LoadResource
 0x456258 LoadLibraryA
 0x45625c LeaveCriticalSection
 0x456260 InitializeCriticalSection
 0x456264 GlobalUnlock
 0x456268 GlobalReAlloc
 0x45626c GlobalHandle
 0x456270 GlobalLock
 0x456274 GlobalFree
 0x456278 GlobalFindAtomA
 0x45627c GlobalDeleteAtom
 0x456280 GlobalAlloc
 0x456284 GlobalAddAtomA
 0x456288 GetVersionExA
 0x45628c GetVersion
 0x456290 GetTickCount
 0x456294 GetThreadLocale
 0x456298 GetTempPathA
 0x45629c GetSystemInfo
 0x4562a0 GetStringTypeExA
 0x4562a4 GetStdHandle
 0x4562a8 GetProcAddress
 0x4562ac GetModuleHandleA
 0x4562b0 GetModuleFileNameA
 0x4562b4 GetLocaleInfoA
 0x4562b8 GetLocalTime
 0x4562bc GetLastError
 0x4562c0 GetFullPathNameA
 0x4562c4 GetFileSize
 0x4562c8 GetDiskFreeSpaceA
 0x4562cc GetDateFormatA
 0x4562d0 GetCurrentThreadId
 0x4562d4 GetCurrentProcessId
 0x4562d8 GetCPInfo
 0x4562dc GetACP
 0x4562e0 FreeResource
 0x4562e4 InterlockedExchange
 0x4562e8 FreeLibrary
 0x4562ec FormatMessageA
 0x4562f0 FindResourceA
 0x4562f4 EnumCalendarInfoA
 0x4562f8 EnterCriticalSection
 0x4562fc DeleteCriticalSection
 0x456300 CreateThread
 0x456304 CreateFileA
 0x456308 CreateEventA
 0x45630c CompareStringA
 0x456310 CloseHandle
version.dll
 0x456318 VerQueryValueA
 0x45631c GetFileVersionInfoSizeA
 0x456320 GetFileVersionInfoA
gdi32.dll
 0x456328 WidenPath
 0x45632c UnrealizeObject
 0x456330 StretchBlt
 0x456334 SetWindowOrgEx
 0x456338 SetViewportOrgEx
 0x45633c SetTextColor
 0x456340 SetStretchBltMode
 0x456344 SetROP2
 0x456348 SetPixel
 0x45634c SetDIBColorTable
 0x456350 SetBrushOrgEx
 0x456354 SetBkMode
 0x456358 SetBkColor
 0x45635c SelectPalette
 0x456360 SelectObject
 0x456364 SaveDC
 0x456368 RestoreDC
 0x45636c RectVisible
 0x456370 RealizePalette
 0x456374 PatBlt
 0x456378 MoveToEx
 0x45637c MaskBlt
 0x456380 LineTo
 0x456384 IntersectClipRect
 0x456388 GetWindowOrgEx
 0x45638c GetTextMetricsA
 0x456390 GetTextExtentPoint32A
 0x456394 GetSystemPaletteUse
 0x456398 GetSystemPaletteEntries
 0x45639c GetStockObject
 0x4563a0 GetPixel
 0x4563a4 GetPaletteEntries
 0x4563a8 GetObjectA
 0x4563ac GetDeviceCaps
 0x4563b0 GetDIBits
 0x4563b4 GetDIBColorTable
 0x4563b8 GetDCOrgEx
 0x4563bc GetCurrentPositionEx
 0x4563c0 GetClipBox
 0x4563c4 GetBrushOrgEx
 0x4563c8 GetBitmapBits
 0x4563cc ExcludeClipRect
 0x4563d0 DeleteObject
 0x4563d4 DeleteDC
 0x4563d8 CreateSolidBrush
 0x4563dc CreatePenIndirect
 0x4563e0 CreatePalette
 0x4563e4 CreateHalftonePalette
 0x4563e8 CreateFontIndirectA
 0x4563ec CreateDIBitmap
 0x4563f0 CreateDIBSection
 0x4563f4 CreateCompatibleDC
 0x4563f8 CreateCompatibleBitmap
 0x4563fc CreateBrushIndirect
 0x456400 CreateBitmap
 0x456404 BitBlt
user32.dll
 0x45640c CreateWindowExA
 0x456410 WindowFromPoint
 0x456414 WinHelpA
 0x456418 WaitMessage
 0x45641c UpdateWindow
 0x456420 UnregisterClassA
 0x456424 UnhookWindowsHookEx
 0x456428 TranslateMessage
 0x45642c TranslateMDISysAccel
 0x456430 TrackPopupMenu
 0x456434 SystemParametersInfoA
 0x456438 ShowWindow
 0x45643c ShowScrollBar
 0x456440 ShowOwnedPopups
 0x456444 ShowCursor
 0x456448 SetWindowsHookExA
 0x45644c SetWindowTextA
 0x456450 SetWindowPos
 0x456454 SetWindowPlacement
 0x456458 SetWindowLongA
 0x45645c SetTimer
 0x456460 SetScrollRange
 0x456464 SetScrollPos
 0x456468 SetScrollInfo
 0x45646c SetRect
 0x456470 SetPropA
 0x456474 SetParent
 0x456478 SetMenuItemInfoA
 0x45647c SetMenu
 0x456480 SetForegroundWindow
 0x456484 SetFocus
 0x456488 SetCursor
 0x45648c SetClassLongA
 0x456490 SetCapture
 0x456494 SetActiveWindow
 0x456498 SendMessageA
 0x45649c ScrollWindow
 0x4564a0 ScreenToClient
 0x4564a4 RemovePropA
 0x4564a8 RemoveMenu
 0x4564ac ReleaseDC
 0x4564b0 ReleaseCapture
 0x4564b4 RegisterWindowMessageA
 0x4564b8 RegisterClipboardFormatA
 0x4564bc RegisterClassA
 0x4564c0 RedrawWindow
 0x4564c4 PtInRect
 0x4564c8 PostQuitMessage
 0x4564cc PostMessageA
 0x4564d0 PeekMessageA
 0x4564d4 OffsetRect
 0x4564d8 OemToCharA
 0x4564dc MessageBoxA
 0x4564e0 MapWindowPoints
 0x4564e4 MapVirtualKeyA
 0x4564e8 LoadStringA
 0x4564ec LoadKeyboardLayoutA
 0x4564f0 LoadIconA
 0x4564f4 LoadCursorA
 0x4564f8 LoadBitmapA
 0x4564fc KillTimer
 0x456500 IsZoomed
 0x456504 IsWindowVisible
 0x456508 IsWindowEnabled
 0x45650c IsWindow
 0x456510 IsRectEmpty
 0x456514 IsIconic
 0x456518 IsDialogMessageA
 0x45651c IsChild
 0x456520 InvalidateRect
 0x456524 IntersectRect
 0x456528 InsertMenuItemA
 0x45652c InsertMenuA
 0x456530 InflateRect
 0x456534 GetWindowThreadProcessId
 0x456538 GetWindowTextA
 0x45653c GetWindowRect
 0x456540 GetWindowPlacement
 0x456544 GetWindowLongA
 0x456548 GetWindowDC
 0x45654c GetTopWindow
 0x456550 GetSystemMetrics
 0x456554 GetSystemMenu
 0x456558 GetSysColorBrush
 0x45655c GetSysColor
 0x456560 GetSubMenu
 0x456564 GetScrollRange
 0x456568 GetScrollPos
 0x45656c GetScrollInfo
 0x456570 GetPropA
 0x456574 GetParent
 0x456578 GetWindow
 0x45657c GetMenuStringA
 0x456580 GetMenuState
 0x456584 GetMenuItemInfoA
 0x456588 GetMenuItemID
 0x45658c GetMenuItemCount
 0x456590 GetMenu
 0x456594 GetLastActivePopup
 0x456598 GetKeyboardState
 0x45659c GetKeyboardLayoutList
 0x4565a0 GetKeyboardLayout
 0x4565a4 GetKeyState
 0x4565a8 GetKeyNameTextA
 0x4565ac GetIconInfo
 0x4565b0 GetForegroundWindow
 0x4565b4 GetFocus
 0x4565b8 GetDesktopWindow
 0x4565bc GetDCEx
 0x4565c0 GetDC
 0x4565c4 GetCursorPos
 0x4565c8 GetCursor
 0x4565cc GetClientRect
 0x4565d0 GetClassNameA
 0x4565d4 GetClassInfoA
 0x4565d8 GetCapture
 0x4565dc GetActiveWindow
 0x4565e0 FrameRect
 0x4565e4 FindWindowA
 0x4565e8 FillRect
 0x4565ec EqualRect
 0x4565f0 EnumWindows
 0x4565f4 EnumThreadWindows
 0x4565f8 EndPaint
 0x4565fc EnableWindow
 0x456600 EnableScrollBar
 0x456604 EnableMenuItem
 0x456608 DrawTextA
 0x45660c DrawMenuBar
 0x456610 DrawIconEx
 0x456614 DrawIcon
 0x456618 DrawFrameControl
 0x45661c DrawEdge
 0x456620 DispatchMessageA
 0x456624 DestroyWindow
 0x456628 DestroyMenu
 0x45662c DestroyIcon
 0x456630 DestroyCursor
 0x456634 DeleteMenu
 0x456638 DefWindowProcA
 0x45663c DefMDIChildProcA
 0x456640 DefFrameProcA
 0x456644 CreatePopupMenu
 0x456648 CreateMenu
 0x45664c CreateIcon
 0x456650 ClientToScreen
 0x456654 CheckMenuItem
 0x456658 CallWindowProcA
 0x45665c CallNextHookEx
 0x456660 BeginPaint
 0x456664 CharNextA
 0x456668 CharLowerA
 0x45666c CharToOemA
 0x456670 AdjustWindowRectEx
 0x456674 ActivateKeyboardLayout
kernel32.dll
 0x45667c Sleep
oleaut32.dll
 0x456684 SafeArrayPtrOfIndex
 0x456688 SafeArrayGetUBound
 0x45668c SafeArrayGetLBound
 0x456690 SafeArrayCreate
 0x456694 VariantChangeType
 0x456698 VariantCopy
 0x45669c VariantClear
 0x4566a0 VariantInit
comctl32.dll
 0x4566a8 ImageList_SetIconSize
 0x4566ac ImageList_GetIconSize
 0x4566b0 ImageList_Write
 0x4566b4 ImageList_Read
 0x4566b8 ImageList_GetDragImage
 0x4566bc ImageList_DragShowNolock
 0x4566c0 ImageList_SetDragCursorImage
 0x4566c4 ImageList_DragMove
 0x4566c8 ImageList_DragLeave
 0x4566cc ImageList_DragEnter
 0x4566d0 ImageList_EndDrag
 0x4566d4 ImageList_BeginDrag
 0x4566d8 ImageList_Remove
 0x4566dc ImageList_DrawEx
 0x4566e0 ImageList_Draw
 0x4566e4 ImageList_GetBkColor
 0x4566e8 ImageList_SetBkColor
 0x4566ec ImageList_ReplaceIcon
 0x4566f0 ImageList_Add
 0x4566f4 ImageList_GetImageCount
 0x4566f8 ImageList_Destroy
 0x4566fc ImageList_Create
shell32.dll
 0x456704 ShellExecuteExW

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure