ScreenShot
| Created | 2023.09.06 07:45 | Machine | s1_win7_x6401 |
| Filename | DocRecevutta.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 26 detected (AIDetectMalware, GenericKD, Artemis, ConnectWise, Eldorado, ConnectWiseControl, RemoteAdmin, Siggen21, Tool, Convagent, edgo, PossibleThreat, MultiInjector, Detected, BScope, Muldrop, ai score=87, Generic@AI, RDML, +GXDk8z, +I3kgjh63Ks2ZA, susgen, MALICIOUS, grayware, confidence) | ||
| md5 | 334df8989da06aff9a71ab0f6534301a | ||
| sha256 | af5a12a388a7bf416d11b3123251e422f5fd94501e893d11e4fa91de3cb13220 | ||
| ssdeep | 98304:ifmE6+6efPU3nWn4bGbq6adYdsrGLPygQfpBo:IMefPUoWnsPygIp6 | ||
| imphash | 9771ee6344923fa220489ab01239bdfd | ||
| impfuzzy | 24:Hur+UvYDFMUntMS17hlJeDc+pl39T7oLU0OovbOPZvvQEvTZEQQ:HuCtMS17Oc+pp97N3tRvT6N | ||
Network IP location
Signature (11cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 26 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates known Upatre files |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (11cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win_Backdoor_njRAT_Zero | Win Backdoor njRAT | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | CAB_file_format | CAB archive file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | Microsoft_Office_File_Zero | Microsoft Office File | binaries (upload) |
| info | OS_Name_Check_Zero | OS Name Check Signature | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
mscoree.dll
0x40d134 CorBindToRuntimeEx
KERNEL32.dll
0x40d000 GetModuleFileNameA
0x40d004 DecodePointer
0x40d008 SizeofResource
0x40d00c LockResource
0x40d010 LoadLibraryW
0x40d014 LoadResource
0x40d018 FindResourceW
0x40d01c GetProcAddress
0x40d020 WriteConsoleW
0x40d024 SetFilePointerEx
0x40d028 GetConsoleMode
0x40d02c GetConsoleCP
0x40d030 FlushFileBuffers
0x40d034 HeapReAlloc
0x40d038 HeapSize
0x40d03c UnhandledExceptionFilter
0x40d040 SetUnhandledExceptionFilter
0x40d044 GetCurrentProcess
0x40d048 TerminateProcess
0x40d04c IsProcessorFeaturePresent
0x40d050 QueryPerformanceCounter
0x40d054 GetCurrentProcessId
0x40d058 GetCurrentThreadId
0x40d05c GetSystemTimeAsFileTime
0x40d060 InitializeSListHead
0x40d064 IsDebuggerPresent
0x40d068 GetStartupInfoW
0x40d06c GetModuleHandleW
0x40d070 RtlUnwind
0x40d074 GetLastError
0x40d078 SetLastError
0x40d07c EncodePointer
0x40d080 EnterCriticalSection
0x40d084 LeaveCriticalSection
0x40d088 DeleteCriticalSection
0x40d08c InitializeCriticalSectionAndSpinCount
0x40d090 TlsAlloc
0x40d094 TlsGetValue
0x40d098 TlsSetValue
0x40d09c TlsFree
0x40d0a0 FreeLibrary
0x40d0a4 LoadLibraryExW
0x40d0a8 RaiseException
0x40d0ac GetStdHandle
0x40d0b0 WriteFile
0x40d0b4 CreateFileW
0x40d0b8 MultiByteToWideChar
0x40d0bc WideCharToMultiByte
0x40d0c0 ExitProcess
0x40d0c4 GetModuleHandleExW
0x40d0c8 GetACP
0x40d0cc CloseHandle
0x40d0d0 HeapAlloc
0x40d0d4 HeapFree
0x40d0d8 FindClose
0x40d0dc FindFirstFileExA
0x40d0e0 FindNextFileA
0x40d0e4 IsValidCodePage
0x40d0e8 GetOEMCP
0x40d0ec GetCPInfo
0x40d0f0 GetCommandLineA
0x40d0f4 GetCommandLineW
0x40d0f8 GetEnvironmentStringsW
0x40d0fc FreeEnvironmentStringsW
0x40d100 LCMapStringW
0x40d104 SetStdHandle
0x40d108 GetFileType
0x40d10c GetStringTypeW
0x40d110 GetProcessHeap
OLEAUT32.dll
0x40d118 VariantInit
0x40d11c SafeArrayUnaccessData
0x40d120 SafeArrayCreateVector
0x40d124 SafeArrayDestroy
0x40d128 VariantClear
0x40d12c SafeArrayAccessData
EAT(Export Address Table) is none
mscoree.dll
0x40d134 CorBindToRuntimeEx
KERNEL32.dll
0x40d000 GetModuleFileNameA
0x40d004 DecodePointer
0x40d008 SizeofResource
0x40d00c LockResource
0x40d010 LoadLibraryW
0x40d014 LoadResource
0x40d018 FindResourceW
0x40d01c GetProcAddress
0x40d020 WriteConsoleW
0x40d024 SetFilePointerEx
0x40d028 GetConsoleMode
0x40d02c GetConsoleCP
0x40d030 FlushFileBuffers
0x40d034 HeapReAlloc
0x40d038 HeapSize
0x40d03c UnhandledExceptionFilter
0x40d040 SetUnhandledExceptionFilter
0x40d044 GetCurrentProcess
0x40d048 TerminateProcess
0x40d04c IsProcessorFeaturePresent
0x40d050 QueryPerformanceCounter
0x40d054 GetCurrentProcessId
0x40d058 GetCurrentThreadId
0x40d05c GetSystemTimeAsFileTime
0x40d060 InitializeSListHead
0x40d064 IsDebuggerPresent
0x40d068 GetStartupInfoW
0x40d06c GetModuleHandleW
0x40d070 RtlUnwind
0x40d074 GetLastError
0x40d078 SetLastError
0x40d07c EncodePointer
0x40d080 EnterCriticalSection
0x40d084 LeaveCriticalSection
0x40d088 DeleteCriticalSection
0x40d08c InitializeCriticalSectionAndSpinCount
0x40d090 TlsAlloc
0x40d094 TlsGetValue
0x40d098 TlsSetValue
0x40d09c TlsFree
0x40d0a0 FreeLibrary
0x40d0a4 LoadLibraryExW
0x40d0a8 RaiseException
0x40d0ac GetStdHandle
0x40d0b0 WriteFile
0x40d0b4 CreateFileW
0x40d0b8 MultiByteToWideChar
0x40d0bc WideCharToMultiByte
0x40d0c0 ExitProcess
0x40d0c4 GetModuleHandleExW
0x40d0c8 GetACP
0x40d0cc CloseHandle
0x40d0d0 HeapAlloc
0x40d0d4 HeapFree
0x40d0d8 FindClose
0x40d0dc FindFirstFileExA
0x40d0e0 FindNextFileA
0x40d0e4 IsValidCodePage
0x40d0e8 GetOEMCP
0x40d0ec GetCPInfo
0x40d0f0 GetCommandLineA
0x40d0f4 GetCommandLineW
0x40d0f8 GetEnvironmentStringsW
0x40d0fc FreeEnvironmentStringsW
0x40d100 LCMapStringW
0x40d104 SetStdHandle
0x40d108 GetFileType
0x40d10c GetStringTypeW
0x40d110 GetProcessHeap
OLEAUT32.dll
0x40d118 VariantInit
0x40d11c SafeArrayUnaccessData
0x40d120 SafeArrayCreateVector
0x40d124 SafeArrayDestroy
0x40d128 VariantClear
0x40d12c SafeArrayAccessData
EAT(Export Address Table) is none