popup

Report - toolspub4.exe

Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.11.07 19:09 Machine s1_win7_x6403
Filename toolspub4.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
8
 Behavior Score
5.8
ZERO API file : malware
VT API (file)
md5 ba07981c0db641512c0004aac1654895
sha256 5e187eebf46c5a395024542b445a5c033a44155d350943a5f7babeb9d1630d1b
ssdeep 3072:pPDvPIEvLsI6ZU0cKcunOsOpgw2WX7cGTY5KmdW5rQdbuZseWK3gdtpzB:9oEvTGU0cKcuOsK3z7cGTAKm7q338
imphash 326ea291fa51c414a4c1a5d2ab64719d
impfuzzy 48:vNCJgg1Cz2mWolp4U1YHOqv+fco3GAXsKrvXDZVAC:vEgqzov47Hfv+fc6GAXsKvX11
  Network IP location

Signature (11cnts)

Level Description
danger Executed a process and injected code into it
watch Allocates execute permission to another process indicative of possible code injection
watch Detects Avast Antivirus through the presence of a library
watch Potential code injection by writing to the memory of another process
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice One or more potentially interesting buffers were extracted
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Yara rule detected in process memory
info Checks if process is being debugged by a debugger

Rules (12cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401000 FindFirstFileW
 0x401004 SetLocaleInfoA
 0x401008 WriteConsoleInputW
 0x40100c lstrlenA
 0x401010 GetConsoleAliasExesA
 0x401014 OpenJobObjectA
 0x401018 GetConsoleAliasA
 0x40101c SetConsoleScreenBufferSize
 0x401020 WriteConsoleInputA
 0x401024 MoveFileWithProgressA
 0x401028 ConvertFiberToThread
 0x40102c GetPrivateProfileStringW
 0x401030 ReadConsoleW
 0x401034 GetWindowsDirectoryA
 0x401038 WaitNamedPipeW
 0x40103c CreateActCtxW
 0x401040 GetEnvironmentStrings
 0x401044 GetPrivateProfileIntA
 0x401048 LoadLibraryW
 0x40104c SetCommConfig
 0x401050 FatalAppExitW
 0x401054 _hread
 0x401058 GetSystemPowerStatus
 0x40105c HeapDestroy
 0x401060 GetFileAttributesW
 0x401064 ReplaceFileW
 0x401068 IsDBCSLeadByte
 0x40106c GetCompressedFileSizeA
 0x401070 GetTimeZoneInformation
 0x401074 FindNextVolumeMountPointW
 0x401078 VirtualUnlock
 0x40107c GetShortPathNameA
 0x401080 GetConsoleOutputCP
 0x401084 GetConsoleAliasesW
 0x401088 GetStartupInfoA
 0x40108c GetLastError
 0x401090 GetCurrentDirectoryW
 0x401094 SetLastError
 0x401098 GetProcAddress
 0x40109c WriteProfileSectionA
 0x4010a0 RemoveDirectoryA
 0x4010a4 CopyFileA
 0x4010a8 GlobalGetAtomNameA
 0x4010ac LocalAlloc
 0x4010b0 SetConsoleCtrlHandler
 0x4010b4 CreateEventW
 0x4010b8 GetTapeParameters
 0x4010bc FoldStringW
 0x4010c0 GlobalFindAtomW
 0x4010c4 GetModuleHandleA
 0x4010c8 CancelIo
 0x4010cc FindNextFileW
 0x4010d0 GetStringTypeW
 0x4010d4 VirtualProtect
 0x4010d8 GetCurrentDirectoryA
 0x4010dc CompareStringA
 0x4010e0 OpenSemaphoreW
 0x4010e4 ReadConsoleInputW
 0x4010e8 GetWindowsDirectoryW
 0x4010ec FindFirstVolumeW
 0x4010f0 GetCurrentProcessId
 0x4010f4 MoveFileWithProgressW
 0x4010f8 AddConsoleAliasA
 0x4010fc GetTempPathA
 0x401100 ReadConsoleOutputCharacterW
 0x401104 EnumSystemLocalesW
 0x401108 AreFileApisANSI
 0x40110c DeleteFileA
 0x401110 ExpandEnvironmentStringsW
 0x401114 CloseHandle
 0x401118 WriteConsoleW
 0x40111c InterlockedIncrement
 0x401120 InterlockedDecrement
 0x401124 EncodePointer
 0x401128 DecodePointer
 0x40112c Sleep
 0x401130 InitializeCriticalSection
 0x401134 DeleteCriticalSection
 0x401138 EnterCriticalSection
 0x40113c LeaveCriticalSection
 0x401140 MoveFileA
 0x401144 HeapFree
 0x401148 HeapReAlloc
 0x40114c GetCommandLineW
 0x401150 HeapSetInformation
 0x401154 GetStartupInfoW
 0x401158 RaiseException
 0x40115c RtlUnwind
 0x401160 HeapAlloc
 0x401164 WideCharToMultiByte
 0x401168 LCMapStringW
 0x40116c MultiByteToWideChar
 0x401170 GetCPInfo
 0x401174 IsProcessorFeaturePresent
 0x401178 HeapCreate
 0x40117c HeapSize
 0x401180 GetModuleHandleW
 0x401184 ExitProcess
 0x401188 SetUnhandledExceptionFilter
 0x40118c WriteFile
 0x401190 GetStdHandle
 0x401194 GetModuleFileNameW
 0x401198 FreeEnvironmentStringsW
 0x40119c GetEnvironmentStringsW
 0x4011a0 SetHandleCount
 0x4011a4 InitializeCriticalSectionAndSpinCount
 0x4011a8 GetFileType
 0x4011ac TlsAlloc
 0x4011b0 TlsGetValue
 0x4011b4 TlsSetValue
 0x4011b8 TlsFree
 0x4011bc GetCurrentThreadId
 0x4011c0 QueryPerformanceCounter
 0x4011c4 GetTickCount
 0x4011c8 GetSystemTimeAsFileTime
 0x4011cc GetLocaleInfoW
 0x4011d0 TerminateProcess
 0x4011d4 GetCurrentProcess
 0x4011d8 UnhandledExceptionFilter
 0x4011dc IsDebuggerPresent
 0x4011e0 GetACP
 0x4011e4 GetOEMCP
 0x4011e8 IsValidCodePage
 0x4011ec GetUserDefaultLCID
 0x4011f0 GetLocaleInfoA
 0x4011f4 EnumSystemLocalesA
 0x4011f8 IsValidLocale
 0x4011fc SetFilePointer
 0x401200 GetConsoleCP
 0x401204 GetConsoleMode
 0x401208 FlushFileBuffers
 0x40120c SetStdHandle
 0x401210 CreateFileW
USER32.dll
 0x401218 CharUpperA

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure