Report - MinerFullDetect.exe

UPX Malicious Library PE File PE32
ScreenShot
Created 2023.08.09 17:07 Machine s1_win7_x6401
Filename MinerFullDetect.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
1.8
ZERO API
VT API (file) 13 detected (AIDetectMalware, malicious, high confidence, confidence, Eldorado, 7Zip, Gencbl, Startun, Gencirc, R582204)
md5 f810de3ef202723a9fa3637e69115da6
sha256 7cecd6d2b7a8c9a835d73e404a1659afeb39e92a59fe19e57c8ab265c9f77c72
ssdeep 98304:EJ5C38lbZzsxc/QxovXoI1rt91KnH+rV8hliQTqvtqf+XIjagOc:EJjbdoc/QxGv1bsnerVCle8SIjROc
imphash f6baa5eaa8231d4fe8e922a2e6d240ea
impfuzzy 96:dZeusdRf+3s4+ycMVTXpZI6sSD+/+RGIXUo/zqr1:HeusdSKwZYSD+/9IXn/er1
  Network IP location

Signature (6cnts)

Level Description
watch File has been identified by 13 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info The executable uses a known packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

COMCTL32.dll
 0x41a010 None
SHELL32.dll
 0x41a25c SHGetSpecialFolderPathW
 0x41a260 ShellExecuteW
 0x41a264 SHGetMalloc
 0x41a268 SHGetPathFromIDListW
 0x41a26c SHBrowseForFolderW
 0x41a270 SHGetFileInfoW
 0x41a274 ShellExecuteExW
GDI32.dll
 0x41a018 CreateCompatibleDC
 0x41a01c CreateFontIndirectW
 0x41a020 DeleteObject
 0x41a024 DeleteDC
 0x41a028 GetCurrentObject
 0x41a02c StretchBlt
 0x41a030 GetDeviceCaps
 0x41a034 CreateCompatibleBitmap
 0x41a038 SelectObject
 0x41a03c SetStretchBltMode
 0x41a040 GetObjectW
ADVAPI32.dll
 0x41a000 FreeSid
 0x41a004 AllocateAndInitializeSid
 0x41a008 CheckTokenMembership
USER32.dll
 0x41a27c GetWindowLongW
 0x41a280 GetMenu
 0x41a284 SetWindowPos
 0x41a288 GetWindowDC
 0x41a28c ReleaseDC
 0x41a290 GetDlgItem
 0x41a294 GetParent
 0x41a298 GetWindowRect
 0x41a29c GetClassNameA
 0x41a2a0 CreateWindowExW
 0x41a2a4 SetTimer
 0x41a2a8 GetMessageW
 0x41a2ac DispatchMessageW
 0x41a2b0 KillTimer
 0x41a2b4 DestroyWindow
 0x41a2b8 SendMessageW
 0x41a2bc EndDialog
 0x41a2c0 wsprintfW
 0x41a2c4 GetWindowTextW
 0x41a2c8 GetWindowTextLengthW
 0x41a2cc GetSysColor
 0x41a2d0 wsprintfA
 0x41a2d4 SetWindowTextW
 0x41a2d8 MessageBoxA
 0x41a2dc ScreenToClient
 0x41a2e0 GetClientRect
 0x41a2e4 SetWindowLongW
 0x41a2e8 UnhookWindowsHookEx
 0x41a2ec SetFocus
 0x41a2f0 GetSystemMetrics
 0x41a2f4 SystemParametersInfoW
 0x41a2f8 ShowWindow
 0x41a2fc DrawTextW
 0x41a300 GetDC
 0x41a304 ClientToScreen
 0x41a308 GetWindow
 0x41a30c DialogBoxIndirectParamW
 0x41a310 DrawIconEx
 0x41a314 CallWindowProcW
 0x41a318 DefWindowProcW
 0x41a31c CallNextHookEx
 0x41a320 PtInRect
 0x41a324 SetWindowsHookExW
 0x41a328 LoadImageW
 0x41a32c LoadIconW
 0x41a330 MessageBeep
 0x41a334 EnableWindow
 0x41a338 IsWindow
 0x41a33c EnableMenuItem
 0x41a340 GetSystemMenu
 0x41a344 CreateWindowExA
 0x41a348 wvsprintfW
 0x41a34c CharUpperW
 0x41a350 GetKeyState
 0x41a354 CopyImage
ole32.dll
 0x41a35c CreateStreamOnHGlobal
 0x41a360 CoCreateInstance
 0x41a364 CoInitialize
OLEAUT32.dll
 0x41a248 VariantClear
 0x41a24c SysFreeString
 0x41a250 OleLoadPicture
 0x41a254 SysAllocString
KERNEL32.dll
 0x41a048 GetFileSize
 0x41a04c SetFilePointer
 0x41a050 ReadFile
 0x41a054 WaitForMultipleObjects
 0x41a058 GetModuleHandleA
 0x41a05c SetFileTime
 0x41a060 SetEndOfFile
 0x41a064 LeaveCriticalSection
 0x41a068 EnterCriticalSection
 0x41a06c DeleteCriticalSection
 0x41a070 FormatMessageW
 0x41a074 lstrcpyW
 0x41a078 LocalFree
 0x41a07c IsBadReadPtr
 0x41a080 GetSystemDirectoryW
 0x41a084 GetCurrentThreadId
 0x41a088 SuspendThread
 0x41a08c TerminateThread
 0x41a090 InitializeCriticalSection
 0x41a094 ResetEvent
 0x41a098 SetEvent
 0x41a09c CreateEventW
 0x41a0a0 GetVersionExW
 0x41a0a4 GetModuleFileNameW
 0x41a0a8 GetCurrentProcess
 0x41a0ac SetProcessWorkingSetSize
 0x41a0b0 SetCurrentDirectoryW
 0x41a0b4 GetDriveTypeW
 0x41a0b8 CreateFileW
 0x41a0bc GetCommandLineW
 0x41a0c0 GetStartupInfoW
 0x41a0c4 CreateProcessW
 0x41a0c8 CreateJobObjectW
 0x41a0cc ResumeThread
 0x41a0d0 AssignProcessToJobObject
 0x41a0d4 CreateIoCompletionPort
 0x41a0d8 SetInformationJobObject
 0x41a0dc GetQueuedCompletionStatus
 0x41a0e0 GetExitCodeProcess
 0x41a0e4 CloseHandle
 0x41a0e8 SetEnvironmentVariableW
 0x41a0ec GetTempPathW
 0x41a0f0 GetSystemTimeAsFileTime
 0x41a0f4 lstrlenW
 0x41a0f8 CompareFileTime
 0x41a0fc SetThreadLocale
 0x41a100 FindFirstFileW
 0x41a104 DeleteFileW
 0x41a108 FindNextFileW
 0x41a10c FindClose
 0x41a110 RemoveDirectoryW
 0x41a114 ExpandEnvironmentStringsW
 0x41a118 WideCharToMultiByte
 0x41a11c VirtualAlloc
 0x41a120 GlobalMemoryStatusEx
 0x41a124 lstrcmpW
 0x41a128 GetEnvironmentVariableW
 0x41a12c lstrcmpiW
 0x41a130 lstrlenA
 0x41a134 GetLocaleInfoW
 0x41a138 MultiByteToWideChar
 0x41a13c GetUserDefaultUILanguage
 0x41a140 GetSystemDefaultUILanguage
 0x41a144 GetSystemDefaultLCID
 0x41a148 lstrcmpiA
 0x41a14c GlobalAlloc
 0x41a150 GlobalFree
 0x41a154 MulDiv
 0x41a158 FindResourceExA
 0x41a15c SizeofResource
 0x41a160 LoadResource
 0x41a164 LockResource
 0x41a168 LoadLibraryA
 0x41a16c GetProcAddress
 0x41a170 GetModuleHandleW
 0x41a174 ExitProcess
 0x41a178 lstrcatW
 0x41a17c GetDiskFreeSpaceExW
 0x41a180 SetFileAttributesW
 0x41a184 SetLastError
 0x41a188 Sleep
 0x41a18c GetExitCodeThread
 0x41a190 WaitForSingleObject
 0x41a194 CreateThread
 0x41a198 GetLastError
 0x41a19c SystemTimeToFileTime
 0x41a1a0 GetLocalTime
 0x41a1a4 GetFileAttributesW
 0x41a1a8 CreateDirectoryW
 0x41a1ac WriteFile
 0x41a1b0 GetStdHandle
 0x41a1b4 VirtualFree
 0x41a1b8 GetStartupInfoA
MSVCRT.dll
 0x41a1c0 ??3@YAXPAX@Z
 0x41a1c4 ??2@YAPAXI@Z
 0x41a1c8 memcmp
 0x41a1cc free
 0x41a1d0 memcpy
 0x41a1d4 _wtol
 0x41a1d8 _controlfp
 0x41a1dc _except_handler3
 0x41a1e0 __set_app_type
 0x41a1e4 __p__fmode
 0x41a1e8 __p__commode
 0x41a1ec _adjust_fdiv
 0x41a1f0 __setusermatherr
 0x41a1f4 _initterm
 0x41a1f8 __getmainargs
 0x41a1fc _acmdln
 0x41a200 exit
 0x41a204 _XcptFilter
 0x41a208 _exit
 0x41a20c ??1type_info@@UAE@XZ
 0x41a210 _onexit
 0x41a214 __dllonexit
 0x41a218 _CxxThrowException
 0x41a21c _beginthreadex
 0x41a220 _EH_prolog
 0x41a224 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
 0x41a228 memset
 0x41a22c _wcsnicmp
 0x41a230 strncmp
 0x41a234 wcsncmp
 0x41a238 malloc
 0x41a23c memmove
 0x41a240 _purecall

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure