popup

Report - bf85700e.exe

Malicious Library UPX PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.10.17 10:02 Machine s1_win7_x6401
Filename bf85700e.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
7
 Behavior Score
2.0
ZERO API file : clean
VT API (file) 35 detected (AIDetectMalware, malicious, high confidence, Mint, Zard, Stop, Lockbit, Save, confidence, 100%, Hacktool, Attribute, HighConfidence, score, Obfuscated, high, Static AI, Malicious PE, Detected, ai score=89, Sabsik, 1UONF, unsafe, Generic@AI, RDML, 9EvI9u, Ycpseau4n, zkXWg, Ransomeware, GandCrypt)
md5 49c3a1783950fa165b770f6cf5cc0619
sha256 4290c815db722f3b8accc02b6ea6f3a86f2851181533b72748ac4143ffd1edc4
ssdeep 12288:yXfM73cG18m7J0qU3jU0dTZ0Movf9zEoAYtt1jzC/o3qSt+lzuZv5Z:y0MG1zF0/3L5ajvf9gohpzl3q4o+b
imphash a589c292925e83b27bb92739ab013116
impfuzzy 48:vL0puct1oNZ3gCyZmFoO4S/JOOSVGcjtne770cIuAAQ9hvAi:QD83gCywWOrJOPUcjtne7QcIEC9
  Network IP location

Signature (4cnts)

Level Description
danger File has been identified by 35 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401010 WriteConsoleInputW
 0x401014 GetConsoleAliasesLengthW
 0x401018 CommConfigDialogA
 0x40101c FindResourceExW
 0x401020 BuildCommDCBAndTimeoutsA
 0x401024 MapUserPhysicalPages
 0x401028 WaitNamedPipeA
 0x40102c SetDefaultCommConfigW
 0x401030 GetEnvironmentStringsW
 0x401034 GetModuleHandleExW
 0x401038 WriteConsoleInputA
 0x40103c SetComputerNameW
 0x401040 OpenSemaphoreA
 0x401044 GetSystemDefaultLCID
 0x401048 SetTapeParameters
 0x40104c ConvertFiberToThread
 0x401050 ReadConsoleW
 0x401054 GetWindowsDirectoryA
 0x401058 GetConsoleAliasExesW
 0x40105c EnumTimeFormatsA
 0x401060 EnumTimeFormatsW
 0x401064 GetCommandLineA
 0x401068 GetDriveTypeA
 0x40106c GetVolumePathNameW
 0x401070 GetEnvironmentStrings
 0x401074 LoadLibraryW
 0x401078 GetConsoleMode
 0x40107c FatalAppExitW
 0x401080 ReadConsoleInputA
 0x401084 CreateEventA
 0x401088 SetConsoleCP
 0x40108c DeleteVolumeMountPointW
 0x401090 GetFileAttributesA
 0x401094 SetSystemPowerState
 0x401098 ReadFile
 0x40109c FindVolumeClose
 0x4010a0 GetACP
 0x4010a4 GetStartupInfoW
 0x4010a8 RaiseException
 0x4010ac GetShortPathNameA
 0x4010b0 GetNamedPipeHandleStateW
 0x4010b4 FindFirstFileA
 0x4010b8 GetLastError
 0x4010bc SetLastError
 0x4010c0 PeekConsoleInputW
 0x4010c4 SetVolumeLabelW
 0x4010c8 HeapUnlock
 0x4010cc MoveFileW
 0x4010d0 CopyFileA
 0x4010d4 EnumSystemCodePagesW
 0x4010d8 VerLanguageNameW
 0x4010dc GetTempFileNameA
 0x4010e0 FindClose
 0x4010e4 GetAtomNameA
 0x4010e8 LoadLibraryA
 0x4010ec LocalAlloc
 0x4010f0 CreateHardLinkW
 0x4010f4 AddAtomW
 0x4010f8 RemoveDirectoryW
 0x4010fc SetCommMask
 0x401100 FoldStringW
 0x401104 FoldStringA
 0x401108 GetPrivateProfileSectionNamesA
 0x40110c GetModuleHandleA
 0x401110 FindNextFileW
 0x401114 GetConsoleTitleW
 0x401118 VirtualProtect
 0x40111c QueryPerformanceFrequency
 0x401120 GetShortPathNameW
 0x401124 ReadConsoleOutputCharacterW
 0x401128 DeleteFileA
 0x40112c WriteConsoleW
 0x401130 SetFilePointer
 0x401134 FlushFileBuffers
 0x401138 GetVolumeNameForVolumeMountPointA
 0x40113c GetComputerNameA
 0x401140 GetCompressedFileSizeA
 0x401144 ExitProcess
 0x401148 GetConsoleCP
 0x40114c SetStdHandle
 0x401150 MoveFileA
 0x401154 HeapAlloc
 0x401158 GetProcAddress
 0x40115c GetModuleHandleW
 0x401160 DecodePointer
 0x401164 WideCharToMultiByte
 0x401168 HeapReAlloc
 0x40116c GetCommandLineW
 0x401170 HeapSetInformation
 0x401174 IsProcessorFeaturePresent
 0x401178 WriteFile
 0x40117c GetStdHandle
 0x401180 GetModuleFileNameW
 0x401184 HeapCreate
 0x401188 EncodePointer
 0x40118c EnterCriticalSection
 0x401190 LeaveCriticalSection
 0x401194 UnhandledExceptionFilter
 0x401198 SetUnhandledExceptionFilter
 0x40119c IsDebuggerPresent
 0x4011a0 TerminateProcess
 0x4011a4 GetCurrentProcess
 0x4011a8 InitializeCriticalSectionAndSpinCount
 0x4011ac DeleteCriticalSection
 0x4011b0 TlsAlloc
 0x4011b4 TlsGetValue
 0x4011b8 TlsSetValue
 0x4011bc TlsFree
 0x4011c0 InterlockedIncrement
 0x4011c4 GetCurrentThreadId
 0x4011c8 InterlockedDecrement
 0x4011cc HeapFree
 0x4011d0 GetCPInfo
 0x4011d4 GetOEMCP
 0x4011d8 IsValidCodePage
 0x4011dc CloseHandle
 0x4011e0 FreeEnvironmentStringsW
 0x4011e4 SetHandleCount
 0x4011e8 GetFileType
 0x4011ec QueryPerformanceCounter
 0x4011f0 GetTickCount
 0x4011f4 GetCurrentProcessId
 0x4011f8 GetSystemTimeAsFileTime
 0x4011fc Sleep
 0x401200 RtlUnwind
 0x401204 MultiByteToWideChar
 0x401208 HeapSize
 0x40120c LCMapStringW
 0x401210 GetStringTypeW
 0x401214 CreateFileW
USER32.dll
 0x401224 CharUpperBuffA
 0x401228 CharUpperW
GDI32.dll
 0x401008 GetTextFaceA
ADVAPI32.dll
 0x401000 AbortSystemShutdownA
SHELL32.dll
 0x40121c DragAcceptFiles
WINHTTP.dll
 0x401230 WinHttpWriteData

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure