popup

Report - toolspub1.exe

Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.10.03 13:04 Machine s1_win7_x6401
Filename toolspub1.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
2.8
ZERO API file : malware
VT API (file) 36 detected (AIDetectMalware, malicious, high confidence, Stop, Save, confidence, 100%, Attribute, HighConfidence, Kryptik, HUUU, score, Convagent, TrojanX, Generic@AI, RDML, 5eaZ, cUjBCyAKvEnOlWr5Q, Lockbit, moderate, Static AI, Malicious PE, Phonzy, Detected, R609044, unsafe, Obfuscated, susgen, HHTS)
md5 607138573a8c8556859e37ba5b6d7655
sha256 a7c4f0af041a9091aa202135f3dada507f10bd7204db9fb1d29500f262c5e9e9
ssdeep 3072:ssrCpy3EK+UDTayupnobpG9sqXtHqRV3ma3CTZ5I9F2n/Q:BxfxDsVB9nkR5b2n
imphash a7960cb042304220b44306228fd698f9
impfuzzy 48:JEBXV41udRKwU5ktdSjBcsIStsDrOEUvCQIleY3:JVEMKtdSjBcsIStsDzoc
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 36 AntiVirus engines on VirusTotal as malicious
watch Detects Avast Antivirus through the presence of a library
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (12cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401010 SetVolumeLabelA
 0x401014 RemoveVectoredExceptionHandler
 0x401018 GetCPInfo
 0x40101c EndUpdateResourceW
 0x401020 OpenJobObjectA
 0x401024 ReadConsoleA
 0x401028 InterlockedCompareExchange
 0x40102c SetComputerNameW
 0x401030 AddConsoleAliasW
 0x401034 SetVolumeMountPointW
 0x401038 CreateHardLinkA
 0x40103c GetProcessPriorityBoost
 0x401040 GetTickCount
 0x401044 GetNumberFormatA
 0x401048 GetWindowsDirectoryA
 0x40104c CreateActCtxW
 0x401050 GlobalFindAtomA
 0x401054 LoadLibraryW
 0x401058 TerminateThread
 0x40105c ReadConsoleInputA
 0x401060 SizeofResource
 0x401064 GetFileAttributesA
 0x401068 TransactNamedPipe
 0x40106c FindNextVolumeW
 0x401070 CreateSemaphoreA
 0x401074 WritePrivateProfileSectionW
 0x401078 FileTimeToSystemTime
 0x40107c SetLastError
 0x401080 GetProcAddress
 0x401084 FillConsoleOutputCharacterA
 0x401088 PeekConsoleInputW
 0x40108c BeginUpdateResourceW
 0x401090 EnumSystemCodePagesW
 0x401094 OpenWaitableTimerA
 0x401098 LoadLibraryA
 0x40109c InterlockedExchangeAdd
 0x4010a0 LocalAlloc
 0x4010a4 GetFileType
 0x4010a8 AddAtomW
 0x4010ac RemoveDirectoryW
 0x4010b0 GetCommMask
 0x4010b4 FoldStringA
 0x4010b8 FindNextFileA
 0x4010bc OpenFileMappingW
 0x4010c0 FreeEnvironmentStringsW
 0x4010c4 EnumResourceNamesA
 0x4010c8 MoveFileWithProgressW
 0x4010cc ReadConsoleOutputCharacterW
 0x4010d0 LocalFree
 0x4010d4 GetVolumeInformationW
 0x4010d8 CloseHandle
 0x4010dc CreateFileA
 0x4010e0 WriteConsoleW
 0x4010e4 GetConsoleOutputCP
 0x4010e8 DebugActiveProcess
 0x4010ec GetDateFormatW
 0x4010f0 VirtualAlloc
 0x4010f4 WriteConsoleA
 0x4010f8 FlushFileBuffers
 0x4010fc MultiByteToWideChar
 0x401100 GetCommandLineA
 0x401104 GetStartupInfoA
 0x401108 TerminateProcess
 0x40110c GetCurrentProcess
 0x401110 UnhandledExceptionFilter
 0x401114 SetUnhandledExceptionFilter
 0x401118 IsDebuggerPresent
 0x40111c HeapAlloc
 0x401120 GetLastError
 0x401124 HeapFree
 0x401128 RaiseException
 0x40112c GetModuleHandleW
 0x401130 TlsGetValue
 0x401134 TlsAlloc
 0x401138 TlsSetValue
 0x40113c TlsFree
 0x401140 InterlockedIncrement
 0x401144 GetCurrentThreadId
 0x401148 InterlockedDecrement
 0x40114c Sleep
 0x401150 HeapSize
 0x401154 ExitProcess
 0x401158 ReadFile
 0x40115c EnterCriticalSection
 0x401160 LeaveCriticalSection
 0x401164 GetACP
 0x401168 GetOEMCP
 0x40116c IsValidCodePage
 0x401170 SetHandleCount
 0x401174 GetStdHandle
 0x401178 DeleteCriticalSection
 0x40117c SetFilePointer
 0x401180 WriteFile
 0x401184 GetModuleFileNameA
 0x401188 FreeEnvironmentStringsA
 0x40118c GetEnvironmentStrings
 0x401190 WideCharToMultiByte
 0x401194 GetEnvironmentStringsW
 0x401198 HeapCreate
 0x40119c VirtualFree
 0x4011a0 QueryPerformanceCounter
 0x4011a4 GetCurrentProcessId
 0x4011a8 GetSystemTimeAsFileTime
 0x4011ac GetConsoleCP
 0x4011b0 GetConsoleMode
 0x4011b4 HeapReAlloc
 0x4011b8 GetModuleHandleA
 0x4011bc InitializeCriticalSectionAndSpinCount
 0x4011c0 RtlUnwind
 0x4011c4 SetStdHandle
 0x4011c8 LCMapStringA
 0x4011cc LCMapStringW
 0x4011d0 GetStringTypeA
 0x4011d4 GetStringTypeW
 0x4011d8 GetLocaleInfoA
USER32.dll
 0x4011e0 GetMessagePos
 0x4011e4 GetWindowTextLengthW
 0x4011e8 LoadMenuA
 0x4011ec LoadMenuW
 0x4011f0 CreateWindowStationA
 0x4011f4 CharToOemBuffW
 0x4011f8 ChangeDisplaySettingsA
GDI32.dll
 0x401008 CreateDCA
ADVAPI32.dll
 0x401000 InitiateSystemShutdownA
ole32.dll
 0x401200 CoMarshalHresult

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure