popup

Report - b.exe

Malicious Library UPX PE32 PE File OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.11.25 18:05 Machine s1_win7_x6401
Filename b.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
3.2
ZERO API file : malware
VT API (file) 50 detected (AIDetectMalware, malicious, high confidence, Packed2, GenericKD, GenericRXWL, Save, confidence, 100%, Attribute, HighConfidence, Kryptik, HVJO, Fsysna, RansomX, Obfuscated, qlisp, SMOKELOADER, YXDKXZ, high, score, Krypt, Static AI, Malicious PE, ai score=82, Detected, GenKryptik, StopCrypt, STOP, GDUTU8, Ransomware, Hpgandcrab, R609862, BScope, Sabsik, unsafe, RansomGen, Generic@AI, RDML, ccRDKAgCAtXYGkS5ZtIA, Outbreak, susgen, PossibleThreat)
md5 f6c58c6f968a8216b9b92a56bd14d421
sha256 7ab95ba29fd65216ae854a664092c3e2c0d7a7986ab8880bee77d3dc74a97467
ssdeep 49152:52pOlurcBHvEDrzmJGpKAmLWF4GWeNMTzUT0C:cxrmHvGrzmEcwFKeNOU4C
imphash 256fc3cc654a45420e670bf949759a36
impfuzzy 48:PpC12/CcO1YVpjm7sm+fcr63GXJtQO0c+ZNlbB:xU8Hjpm+fcrIGXJtQbcmd
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 50 AntiVirus engines on VirusTotal as malicious
watch Tries to unhook Windows functions monitored by Cuckoo
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x401000 GetFileSize
 0x401004 GetCommModemStatus
 0x401008 FindFirstFileW
 0x40100c WriteConsoleOutputCharacterW
 0x401010 BuildCommDCBAndTimeoutsA
 0x401014 WriteConsoleOutputW
 0x401018 ReadConsoleA
 0x40101c InterlockedDecrement
 0x401020 ZombifyActCtx
 0x401024 SetDefaultCommConfigW
 0x401028 GetProfileSectionA
 0x40102c WriteConsoleInputA
 0x401030 GetComputerNameW
 0x401034 GetProcessPriorityBoost
 0x401038 GetModuleHandleW
 0x40103c LocalFlags
 0x401040 GetPrivateProfileStringW
 0x401044 GetWindowsDirectoryA
 0x401048 GetCommandLineA
 0x40104c CreateActCtxW
 0x401050 GlobalAlloc
 0x401054 GetVolumeInformationA
 0x401058 GlobalFindAtomA
 0x40105c TerminateThread
 0x401060 DeleteVolumeMountPointW
 0x401064 InterlockedPopEntrySList
 0x401068 GlobalFlags
 0x40106c GetConsoleAliasW
 0x401070 SetTimeZoneInformation
 0x401074 CreateFileW
 0x401078 ReplaceFileA
 0x40107c CreateJobObjectA
 0x401080 GetNamedPipeHandleStateW
 0x401084 GetLargestConsoleWindowSize
 0x401088 FindFirstFileA
 0x40108c GetCPInfoExW
 0x401090 SetLastError
 0x401094 GetProcAddress
 0x401098 SetFirmwareEnvironmentVariableW
 0x40109c VerLanguageNameW
 0x4010a0 GlobalGetAtomNameA
 0x4010a4 LoadLibraryA
 0x4010a8 OpenWaitableTimerW
 0x4010ac BuildCommDCBAndTimeoutsW
 0x4010b0 FoldStringW
 0x4010b4 WriteProfileStringA
 0x4010b8 GetProcessShutdownParameters
 0x4010bc GetProcessAffinityMask
 0x4010c0 GetFileTime
 0x4010c4 PeekConsoleInputA
 0x4010c8 SetProcessShutdownParameters
 0x4010cc OpenSemaphoreW
 0x4010d0 ReadConsoleInputW
 0x4010d4 GetVolumeNameForVolumeMountPointW
 0x4010d8 MoveFileWithProgressW
 0x4010dc GetTempPathA
 0x4010e0 OpenFileMappingA
 0x4010e4 WriteConsoleW
 0x4010e8 CloseHandle
 0x4010ec SetFilePointer
 0x4010f0 FlushFileBuffers
 0x4010f4 GetConsoleMode
 0x4010f8 InterlockedIncrement
 0x4010fc EncodePointer
 0x401100 DecodePointer
 0x401104 Sleep
 0x401108 InitializeCriticalSection
 0x40110c DeleteCriticalSection
 0x401110 EnterCriticalSection
 0x401114 LeaveCriticalSection
 0x401118 GetLastError
 0x40111c WideCharToMultiByte
 0x401120 HeapFree
 0x401124 HeapReAlloc
 0x401128 ExitProcess
 0x40112c GetCommandLineW
 0x401130 HeapSetInformation
 0x401134 GetStartupInfoW
 0x401138 RaiseException
 0x40113c RtlUnwind
 0x401140 HeapAlloc
 0x401144 LCMapStringW
 0x401148 MultiByteToWideChar
 0x40114c GetCPInfo
 0x401150 IsProcessorFeaturePresent
 0x401154 GetACP
 0x401158 GetOEMCP
 0x40115c IsValidCodePage
 0x401160 TlsAlloc
 0x401164 TlsGetValue
 0x401168 TlsSetValue
 0x40116c TlsFree
 0x401170 GetCurrentThreadId
 0x401174 UnhandledExceptionFilter
 0x401178 SetUnhandledExceptionFilter
 0x40117c IsDebuggerPresent
 0x401180 TerminateProcess
 0x401184 GetCurrentProcess
 0x401188 HeapCreate
 0x40118c HeapSize
 0x401190 InitializeCriticalSectionAndSpinCount
 0x401194 LoadLibraryW
 0x401198 GetLocaleInfoW
 0x40119c WriteFile
 0x4011a0 GetStdHandle
 0x4011a4 GetModuleFileNameW
 0x4011a8 FreeEnvironmentStringsW
 0x4011ac GetEnvironmentStringsW
 0x4011b0 SetHandleCount
 0x4011b4 GetFileType
 0x4011b8 QueryPerformanceCounter
 0x4011bc GetTickCount
 0x4011c0 GetCurrentProcessId
 0x4011c4 GetSystemTimeAsFileTime
 0x4011c8 GetUserDefaultLCID
 0x4011cc GetLocaleInfoA
 0x4011d0 EnumSystemLocalesA
 0x4011d4 IsValidLocale
 0x4011d8 GetStringTypeW
 0x4011dc GetConsoleCP
 0x4011e0 SetStdHandle
USER32.dll
 0x4011f0 CharToOemBuffW
 0x4011f4 CharUpperW
MSIMG32.dll
 0x4011e8 AlphaBlend

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure