popup

Report - toolspub3.exe

UPX Malicious Library AntiDebug AntiVM PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.09.16 14:17 Machine s1_win7_x6401
Filename toolspub3.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
9
 Behavior Score
6.8
ZERO API file : malware
VT API (file) 30 detected (AIDetectMalware, Zbot, m6l9, Stop, Artemis, Save, malicious, Kryptik, Eldorado, Attribute, HighConfidence, Windows, Smokeloader, score, Strab, BotX, Lockbit, high, Krypt, Detected, unsafe, CLASSIC, Static AI, Malicious PE, confidence, 100%)
md5 116ddc22e7db24aa1280fec03b1214a2
sha256 6f2ff4beca2ddfb19a229f614f81576648daa2db28d7b52bd408b177467513ba
ssdeep 6144:ePAvvzhN8fXslaHy9Awn9f6lkOyvHjYE:e4LhSby9fB3fj
imphash a9bf299729b09a43be583e7770d2853b
impfuzzy 48:Q31cTmsmpqx+rf803jKTYOQ1ticpe7OcgTONtEi:Ql1Kxyf803WYJ1ticpe7Ocg6
  Network IP location

Signature (12cnts)

Level Description
danger Executed a process and injected code into it
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Detects Avast Antivirus through the presence of a library
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice One or more potentially interesting buffers were extracted
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info Checks if process is being debugged by a debugger

Rules (12cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401018 MoveFileExA
 0x40101c SystemTimeToTzSpecificLocalTime
 0x401020 InterlockedDecrement
 0x401024 SetDefaultCommConfigW
 0x401028 GetEnvironmentStringsW
 0x40102c SetConsoleScreenBufferSize
 0x401030 SetVolumeMountPointW
 0x401034 BackupSeek
 0x401038 GetModuleHandleW
 0x40103c GetNumberFormatA
 0x401040 SetFileTime
 0x401044 GetConsoleAliasExesW
 0x401048 GetCommandLineA
 0x40104c GetDriveTypeA
 0x401050 GetEnvironmentStrings
 0x401054 GetPrivateProfileIntA
 0x401058 LoadLibraryW
 0x40105c TerminateThread
 0x401060 CopyFileW
 0x401064 SetConsoleCP
 0x401068 GetVolumePathNameA
 0x40106c GetStartupInfoW
 0x401070 CreateJobObjectA
 0x401074 OpenMutexW
 0x401078 GetHandleInformation
 0x40107c GetLastError
 0x401080 GetCurrentDirectoryW
 0x401084 GetNumaProcessorNode
 0x401088 EnumSystemCodePagesW
 0x40108c LoadLibraryA
 0x401090 GetProcessId
 0x401094 LocalAlloc
 0x401098 GetFileType
 0x40109c RemoveDirectoryW
 0x4010a0 GetProfileStringA
 0x4010a4 FindNextChangeNotification
 0x4010a8 FindAtomA
 0x4010ac GlobalWire
 0x4010b0 EnumDateFormatsA
 0x4010b4 GetModuleHandleA
 0x4010b8 FreeEnvironmentStringsW
 0x4010bc FindNextFileW
 0x4010c0 VirtualProtect
 0x4010c4 GetCurrentDirectoryA
 0x4010c8 EnumDateFormatsW
 0x4010cc FatalAppExitA
 0x4010d0 GetShortPathNameW
 0x4010d4 OpenSemaphoreW
 0x4010d8 FindAtomW
 0x4010dc GetWindowsDirectoryW
 0x4010e0 FindFirstVolumeW
 0x4010e4 AddConsoleAliasA
 0x4010e8 CreateFileW
 0x4010ec GetConsoleAliasesLengthW
 0x4010f0 FindFirstFileW
 0x4010f4 GetComputerNameA
 0x4010f8 EnumResourceNamesW
 0x4010fc SetLastError
 0x401100 GetCommandLineW
 0x401104 CloseHandle
 0x401108 ReadFile
 0x40110c FlushFileBuffers
 0x401110 GetStringTypeW
 0x401114 HeapFree
 0x401118 HeapAlloc
 0x40111c GetProcAddress
 0x401120 ExitProcess
 0x401124 DecodePointer
 0x401128 DeleteFileA
 0x40112c EncodePointer
 0x401130 HeapReAlloc
 0x401134 HeapSetInformation
 0x401138 RaiseException
 0x40113c UnhandledExceptionFilter
 0x401140 SetUnhandledExceptionFilter
 0x401144 IsDebuggerPresent
 0x401148 TerminateProcess
 0x40114c GetCurrentProcess
 0x401150 IsProcessorFeaturePresent
 0x401154 HeapCreate
 0x401158 WriteFile
 0x40115c GetStdHandle
 0x401160 GetModuleFileNameW
 0x401164 EnterCriticalSection
 0x401168 LeaveCriticalSection
 0x40116c InitializeCriticalSectionAndSpinCount
 0x401170 DeleteCriticalSection
 0x401174 TlsAlloc
 0x401178 TlsGetValue
 0x40117c TlsSetValue
 0x401180 TlsFree
 0x401184 InterlockedIncrement
 0x401188 GetCurrentThreadId
 0x40118c Sleep
 0x401190 HeapSize
 0x401194 SetHandleCount
 0x401198 QueryPerformanceCounter
 0x40119c GetTickCount
 0x4011a0 GetCurrentProcessId
 0x4011a4 GetSystemTimeAsFileTime
 0x4011a8 SetFilePointer
 0x4011ac WideCharToMultiByte
 0x4011b0 GetConsoleCP
 0x4011b4 GetConsoleMode
 0x4011b8 GetCPInfo
 0x4011bc GetACP
 0x4011c0 GetOEMCP
 0x4011c4 IsValidCodePage
 0x4011c8 RtlUnwind
 0x4011cc MultiByteToWideChar
 0x4011d0 SetStdHandle
 0x4011d4 WriteConsoleW
 0x4011d8 LCMapStringW
USER32.dll
 0x4011e8 GetListBoxInfo
 0x4011ec CharUpperW
GDI32.dll
 0x401008 SelectPalette
 0x40100c GetTextFaceW
 0x401010 GetCharWidthW
ADVAPI32.dll
 0x401000 LookupAccountSidW
SHELL32.dll
 0x4011e0 DragFinish
ole32.dll
 0x4011fc CoGetInstanceFromFile
WINHTTP.dll
 0x4011f4 WinHttpWriteData

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure