Report - Wblxhuaksujvhq.exe

Malicious Library UPX PE File PE32 MZP Format
ScreenShot
Created 2023.10.06 08:00 Machine s1_win7_x6401
Filename Wblxhuaksujvhq.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
Behavior Score
2.4
ZERO API file : mailcious
VT API (file)
md5 c7fcb915a272045036e5d8e0de23fd5a
sha256 0fcbcb5c98c97d26b4df12fc4b1f18c926df5e943b6cad241836985f5da0290e
ssdeep 24576:PQYmRM7kYk7XW+LLkxodkG16Be0jsb/ipPUVRWn6MgnVyZk1J3Hu9kQ9:PQwuBkxcGk1JrQ
imphash 0d86e42911c69e10a0bac6a25141540c
impfuzzy 96:oO4fXYU3Me0M4buu21qSUvK9eVsoWGXE7IXqpbU8LS1x+YdDwPOQCW:ot3MDbuu0qSUvK9kso1XE7Icg1d+POQd
  Network IP location

Signature (7cnts)

Level Description
watch Disables proxy possibly for traffic interception
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
onedrive.live.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

oleaut32.dll
 0x574728 SysFreeString
 0x57472c SysReAllocStringLen
 0x574730 SysAllocStringLen
advapi32.dll
 0x574738 RegQueryValueExA
 0x57473c RegOpenKeyExA
 0x574740 RegCloseKey
user32.dll
 0x574748 GetKeyboardType
 0x57474c DestroyWindow
 0x574750 LoadStringA
 0x574754 MessageBoxA
 0x574758 CharNextA
kernel32.dll
 0x574760 GetACP
 0x574764 Sleep
 0x574768 VirtualFree
 0x57476c VirtualAlloc
 0x574770 GetTickCount
 0x574774 QueryPerformanceCounter
 0x574778 GetCurrentThreadId
 0x57477c InterlockedDecrement
 0x574780 InterlockedIncrement
 0x574784 VirtualQuery
 0x574788 WideCharToMultiByte
 0x57478c MultiByteToWideChar
 0x574790 lstrlenA
 0x574794 lstrcpynA
 0x574798 LoadLibraryExA
 0x57479c GetThreadLocale
 0x5747a0 GetStartupInfoA
 0x5747a4 GetProcAddress
 0x5747a8 GetModuleHandleA
 0x5747ac GetModuleFileNameA
 0x5747b0 GetLocaleInfoA
 0x5747b4 GetCommandLineA
 0x5747b8 FreeLibrary
 0x5747bc FindFirstFileA
 0x5747c0 FindClose
 0x5747c4 ExitProcess
 0x5747c8 CompareStringA
 0x5747cc WriteFile
 0x5747d0 UnhandledExceptionFilter
 0x5747d4 RtlUnwind
 0x5747d8 RaiseException
 0x5747dc GetStdHandle
kernel32.dll
 0x5747e4 TlsSetValue
 0x5747e8 TlsGetValue
 0x5747ec LocalAlloc
 0x5747f0 GetModuleHandleA
user32.dll
 0x5747f8 CreateWindowExA
 0x5747fc WindowFromPoint
 0x574800 WaitMessage
 0x574804 UpdateWindow
 0x574808 UnregisterClassA
 0x57480c UnhookWindowsHookEx
 0x574810 TranslateMessage
 0x574814 TranslateMDISysAccel
 0x574818 TrackPopupMenu
 0x57481c SystemParametersInfoA
 0x574820 ShowWindow
 0x574824 ShowScrollBar
 0x574828 ShowOwnedPopups
 0x57482c SetWindowsHookExA
 0x574830 SetWindowPos
 0x574834 SetWindowPlacement
 0x574838 SetWindowLongW
 0x57483c SetWindowLongA
 0x574840 SetTimer
 0x574844 SetScrollRange
 0x574848 SetScrollPos
 0x57484c SetScrollInfo
 0x574850 SetRect
 0x574854 SetPropA
 0x574858 SetParent
 0x57485c SetMenuItemInfoA
 0x574860 SetMenuInfo
 0x574864 SetMenu
 0x574868 SetForegroundWindow
 0x57486c SetFocus
 0x574870 SetCursor
 0x574874 SetClassLongA
 0x574878 SetCapture
 0x57487c SetActiveWindow
 0x574880 SendMessageW
 0x574884 SendMessageA
 0x574888 ScrollWindow
 0x57488c ScreenToClient
 0x574890 RemovePropA
 0x574894 RemoveMenu
 0x574898 ReleaseDC
 0x57489c ReleaseCapture
 0x5748a0 RegisterWindowMessageA
 0x5748a4 RegisterClipboardFormatA
 0x5748a8 RegisterClassA
 0x5748ac RedrawWindow
 0x5748b0 PtInRect
 0x5748b4 PostQuitMessage
 0x5748b8 PostMessageA
 0x5748bc PeekMessageW
 0x5748c0 PeekMessageA
 0x5748c4 OffsetRect
 0x5748c8 OemToCharA
 0x5748cc MessageBoxA
 0x5748d0 MapWindowPoints
 0x5748d4 MapVirtualKeyA
 0x5748d8 LoadStringA
 0x5748dc LoadKeyboardLayoutA
 0x5748e0 LoadIconA
 0x5748e4 LoadCursorA
 0x5748e8 LoadBitmapA
 0x5748ec KillTimer
 0x5748f0 IsZoomed
 0x5748f4 IsWindowVisible
 0x5748f8 IsWindowUnicode
 0x5748fc IsWindowEnabled
 0x574900 IsWindow
 0x574904 IsRectEmpty
 0x574908 IsIconic
 0x57490c IsDialogMessageW
 0x574910 IsDialogMessageA
 0x574914 IsChild
 0x574918 InvalidateRect
 0x57491c IntersectRect
 0x574920 InsertMenuItemA
 0x574924 InsertMenuA
 0x574928 InflateRect
 0x57492c GetWindowThreadProcessId
 0x574930 GetWindowTextA
 0x574934 GetWindowRect
 0x574938 GetWindowPlacement
 0x57493c GetWindowLongW
 0x574940 GetWindowLongA
 0x574944 GetWindowDC
 0x574948 GetTopWindow
 0x57494c GetSystemMetrics
 0x574950 GetSystemMenu
 0x574954 GetSysColorBrush
 0x574958 GetSysColor
 0x57495c GetSubMenu
 0x574960 GetScrollRange
 0x574964 GetScrollPos
 0x574968 GetScrollInfo
 0x57496c GetPropA
 0x574970 GetParent
 0x574974 GetWindow
 0x574978 GetMessagePos
 0x57497c GetMenuStringA
 0x574980 GetMenuState
 0x574984 GetMenuItemInfoA
 0x574988 GetMenuItemID
 0x57498c GetMenuItemCount
 0x574990 GetMenu
 0x574994 GetLastActivePopup
 0x574998 GetKeyboardState
 0x57499c GetKeyboardLayoutNameA
 0x5749a0 GetKeyboardLayoutList
 0x5749a4 GetKeyboardLayout
 0x5749a8 GetKeyState
 0x5749ac GetKeyNameTextA
 0x5749b0 GetIconInfo
 0x5749b4 GetForegroundWindow
 0x5749b8 GetFocus
 0x5749bc GetDesktopWindow
 0x5749c0 GetDCEx
 0x5749c4 GetDC
 0x5749c8 GetCursorPos
 0x5749cc GetCursor
 0x5749d0 GetClientRect
 0x5749d4 GetClassLongA
 0x5749d8 GetClassInfoA
 0x5749dc GetCapture
 0x5749e0 GetActiveWindow
 0x5749e4 FrameRect
 0x5749e8 FindWindowA
 0x5749ec FillRect
 0x5749f0 EqualRect
 0x5749f4 EnumWindows
 0x5749f8 EnumThreadWindows
 0x5749fc EnumChildWindows
 0x574a00 EndPaint
 0x574a04 EnableWindow
 0x574a08 EnableScrollBar
 0x574a0c EnableMenuItem
 0x574a10 DrawTextA
 0x574a14 DrawMenuBar
 0x574a18 DrawIconEx
 0x574a1c DrawIcon
 0x574a20 DrawFrameControl
 0x574a24 DrawEdge
 0x574a28 DispatchMessageW
 0x574a2c DispatchMessageA
 0x574a30 DestroyWindow
 0x574a34 DestroyMenu
 0x574a38 DestroyIcon
 0x574a3c DestroyCursor
 0x574a40 DeleteMenu
 0x574a44 DefWindowProcA
 0x574a48 DefMDIChildProcA
 0x574a4c DefFrameProcA
 0x574a50 CreatePopupMenu
 0x574a54 CreateMenu
 0x574a58 CreateIcon
 0x574a5c ClientToScreen
 0x574a60 CheckMenuItem
 0x574a64 CallWindowProcA
 0x574a68 CallNextHookEx
 0x574a6c BeginPaint
 0x574a70 CharNextA
 0x574a74 CharLowerA
 0x574a78 CharToOemA
 0x574a7c AdjustWindowRectEx
 0x574a80 ActivateKeyboardLayout
gdi32.dll
 0x574a88 UnrealizeObject
 0x574a8c StretchBlt
 0x574a90 SetWindowOrgEx
 0x574a94 SetViewportOrgEx
 0x574a98 SetTextColor
 0x574a9c SetStretchBltMode
 0x574aa0 SetROP2
 0x574aa4 SetPixel
 0x574aa8 SetDIBColorTable
 0x574aac SetBrushOrgEx
 0x574ab0 SetBkMode
 0x574ab4 SetBkColor
 0x574ab8 SelectPalette
 0x574abc SelectObject
 0x574ac0 SaveDC
 0x574ac4 RestoreDC
 0x574ac8 RectVisible
 0x574acc RealizePalette
 0x574ad0 PatBlt
 0x574ad4 MoveToEx
 0x574ad8 MaskBlt
 0x574adc LineTo
 0x574ae0 IntersectClipRect
 0x574ae4 GetWindowOrgEx
 0x574ae8 GetTextMetricsA
 0x574aec GetTextExtentPoint32A
 0x574af0 GetSystemPaletteEntries
 0x574af4 GetStockObject
 0x574af8 GetRgnBox
 0x574afc GetPixel
 0x574b00 GetPaletteEntries
 0x574b04 GetObjectA
 0x574b08 GetDeviceCaps
 0x574b0c GetDIBits
 0x574b10 GetDIBColorTable
 0x574b14 GetDCOrgEx
 0x574b18 GetCurrentPositionEx
 0x574b1c GetClipBox
 0x574b20 GetBrushOrgEx
 0x574b24 GetBitmapBits
 0x574b28 ExcludeClipRect
 0x574b2c DeleteObject
 0x574b30 DeleteDC
 0x574b34 CreateSolidBrush
 0x574b38 CreatePenIndirect
 0x574b3c CreatePalette
 0x574b40 CreateHalftonePalette
 0x574b44 CreateFontIndirectA
 0x574b48 CreateDIBitmap
 0x574b4c CreateDIBSection
 0x574b50 CreateCompatibleDC
 0x574b54 CreateCompatibleBitmap
 0x574b58 CreateBrushIndirect
 0x574b5c CreateBitmap
 0x574b60 BitBlt
version.dll
 0x574b68 VerQueryValueA
 0x574b6c GetFileVersionInfoSizeA
 0x574b70 GetFileVersionInfoA
kernel32.dll
 0x574b78 lstrcpyA
 0x574b7c WriteFile
 0x574b80 WaitForSingleObject
 0x574b84 VirtualQuery
 0x574b88 VirtualProtect
 0x574b8c VirtualAlloc
 0x574b90 SizeofResource
 0x574b94 SetThreadLocale
 0x574b98 SetFilePointer
 0x574b9c SetEvent
 0x574ba0 SetErrorMode
 0x574ba4 SetEndOfFile
 0x574ba8 ResetEvent
 0x574bac ReadFile
 0x574bb0 MulDiv
 0x574bb4 LockResource
 0x574bb8 LoadResource
 0x574bbc LoadLibraryExA
 0x574bc0 LoadLibraryA
 0x574bc4 LeaveCriticalSection
 0x574bc8 InitializeCriticalSection
 0x574bcc GlobalFindAtomA
 0x574bd0 GlobalDeleteAtom
 0x574bd4 GlobalAddAtomA
 0x574bd8 GetVersionExA
 0x574bdc GetVersion
 0x574be0 GetTickCount
 0x574be4 GetThreadLocale
 0x574be8 GetStdHandle
 0x574bec GetProcAddress
 0x574bf0 GetModuleHandleW
 0x574bf4 GetModuleHandleA
 0x574bf8 GetModuleFileNameA
 0x574bfc GetLocaleInfoA
 0x574c00 GetLocalTime
 0x574c04 GetLastError
 0x574c08 GetFullPathNameA
 0x574c0c GetDiskFreeSpaceA
 0x574c10 GetDateFormatA
 0x574c14 GetCurrentThreadId
 0x574c18 GetCurrentProcessId
 0x574c1c GetCurrentProcess
 0x574c20 GetCPInfo
 0x574c24 FreeResource
 0x574c28 InterlockedExchange
 0x574c2c FreeLibrary
 0x574c30 FormatMessageA
 0x574c34 FlushFileBuffers
 0x574c38 FindResourceA
 0x574c3c EnumCalendarInfoA
 0x574c40 EnterCriticalSection
 0x574c44 DeleteCriticalSection
 0x574c48 CreateThread
 0x574c4c CreateFileA
 0x574c50 CreateEventA
 0x574c54 CompareStringA
 0x574c58 CloseHandle
advapi32.dll
 0x574c60 RegQueryValueExA
 0x574c64 RegOpenKeyExA
 0x574c68 RegFlushKey
 0x574c6c RegCloseKey
kernel32.dll
 0x574c74 Sleep
oleaut32.dll
 0x574c7c SafeArrayPtrOfIndex
 0x574c80 SafeArrayGetUBound
 0x574c84 SafeArrayGetLBound
 0x574c88 SafeArrayCreate
 0x574c8c VariantChangeType
 0x574c90 VariantCopy
 0x574c94 VariantClear
 0x574c98 VariantInit
comctl32.dll
 0x574ca0 _TrackMouseEvent
 0x574ca4 ImageList_SetIconSize
 0x574ca8 ImageList_GetIconSize
 0x574cac ImageList_Write
 0x574cb0 ImageList_Read
 0x574cb4 ImageList_DragShowNolock
 0x574cb8 ImageList_DragMove
 0x574cbc ImageList_DragLeave
 0x574cc0 ImageList_DragEnter
 0x574cc4 ImageList_EndDrag
 0x574cc8 ImageList_BeginDrag
 0x574ccc ImageList_Remove
 0x574cd0 ImageList_DrawEx
 0x574cd4 ImageList_Draw
 0x574cd8 ImageList_GetBkColor
 0x574cdc ImageList_SetBkColor
 0x574ce0 ImageList_Add
 0x574ce4 ImageList_GetImageCount
 0x574ce8 ImageList_Destroy
 0x574cec ImageList_Create
ntdll
 0x574cf4 NtQueryInformationFile
 0x574cf8 NtOpenFile
 0x574cfc NtClose
 0x574d00 NtReadFile
ntdll
 0x574d08 RtlDosPathNameToNtPathName_U

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure