Report - jfskxgiowyrhn.exe

UPX AntiDebug AntiVM PE File .NET EXE PE32
ScreenShot
Created 2023.08.25 07:37 Machine s1_win7_x6401
Filename jfskxgiowyrhn.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
7
Behavior Score
5.6
ZERO API file : clean
VT API (file)
md5 50552fe7269260bc90e22d2461925696
sha256 b74f49047aa90d3f56619882edd333f0ed838a93a734a74b60a0639884e64618
ssdeep 6144:aNFZSCbkCP30Qaxxs7jOQShh2C3aQrarhI:dChMbQC3aQrara
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (12cnts)

Level Description
danger Executed a process and injected code into it
watch Allocates execute permission to another process indicative of possible code injection
watch Manipulates memory of a non-child process indicative of process injection
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (12cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x442000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure