Report - Go.exe

Generic Malware Malicious Library Malicious Packer UPX PE File PE64
ScreenShot
Created 2023.12.15 08:28 Machine s1_win7_x6401
Filename Go.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
3
Behavior Score
2.0
ZERO API file : clean
VT API (file)
md5 dcf8c8ef55fd294027997128de155b9f
sha256 236c90cde83b3dc403c3c186193b0d2cd14b067f6b4c840d5f0baee57840eba9
ssdeep 49152:V2JQb0rvdEeF5XsHuCmDKTkB7a1GwvvnE0jVBTs6vUaB:5wHH0kUHZjA6v/B
imphash a85f38e7f91123fad59670d6f5a40ae7
impfuzzy 96:uAXXurXUX1PqXxSLDYyT38vzvQp6fm2NGlQvM8X+r6f3cXDivfMBUUPKDimrKEF:YrkFPqMYqMvNGlQv+r6fczivfMBhStr7
  Network IP location

Signature (5cnts)

Level Description
watch Created a service where a service was also not started
watch Installs itself for autorun at Windows startup
notice Foreign language identified in PE resource
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (13cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
spa.gotohttp.com BR UCloud (HK) Holdings Group Limited 152.32.197.201 clean
usw.gotohttp.com Unknown 43.130.10.102 clean
hk.gotohttp.com US Alibaba (US) Technology Co., Ltd. 47.241.41.42 clean
def.gotohttp.com Unknown 43.130.10.102 clean
tk.gotohttp.com Unknown 103.143.72.251 clean
eu.gotohttp.com Unknown 43.131.61.143 clean
use.gotohttp.com CA Tencent Building, Kejizhongyi Avenue 49.51.102.118 clean
47.241.41.42 US Alibaba (US) Technology Co., Ltd. 47.241.41.42 clean
152.32.197.201 BR UCloud (HK) Holdings Group Limited 152.32.197.201 clean
43.130.10.102 Unknown 43.130.10.102 clean
103.143.72.251 Unknown 103.143.72.251 clean
43.131.61.143 Unknown 43.131.61.143 clean
49.51.102.118 CA Tencent Building, Kejizhongyi Avenue 49.51.102.118 clean

Suricata ids

PE API

IAT(Import Address Table) Library

WS2_32.dll
 0x140186b08 send
 0x140186b10 ioctlsocket
 0x140186b18 WSAGetLastError
 0x140186b20 recv
 0x140186b28 connect
 0x140186b30 inet_ntoa
 0x140186b38 htons
 0x140186b40 closesocket
 0x140186b48 inet_addr
 0x140186b50 htonl
 0x140186b58 getsockname
 0x140186b60 setsockopt
 0x140186b68 sendto
 0x140186b70 ind
 0x140186b78 gethostbyname
 0x140186b80 listen
 0x140186b88 accept
 0x140186b90 select
 0x140186b98 __WSAFDIsSet
 0x140186ba0 getpeername
 0x140186ba8 socket
 0x140186bb0 WSAStartup
KERNEL32.dll
 0x1401861f8 ProcessIdToSessionId
 0x140186200 OpenProcess
 0x140186208 RemoveDirectoryW
 0x140186210 FindClose
 0x140186218 FindNextFileW
 0x140186220 DeleteFileW
 0x140186228 FindFirstFileW
 0x140186230 GetDriveTypeW
 0x140186238 CreateEventW
 0x140186240 SetEvent
 0x140186248 GlobalFree
 0x140186250 GlobalUnlock
 0x140186258 GlobalLock
 0x140186260 GlobalAlloc
 0x140186268 WriteFile
 0x140186270 GetFileAttributesW
 0x140186278 GlobalSize
 0x140186280 ReadFile
 0x140186288 GetFileSize
 0x140186290 SetFileTime
 0x140186298 CreateFileW
 0x1401862a0 MoveFileW
 0x1401862a8 CreateDirectoryW
 0x1401862b0 GetTempPathA
 0x1401862b8 ResetEvent
 0x1401862c0 WaitForSingleObject
 0x1401862c8 TerminateThread
 0x1401862d0 SetThreadPriority
 0x1401862d8 CreateThread
 0x1401862e0 WideCharToMultiByte
 0x1401862e8 GetSystemTimeAsFileTime
 0x1401862f0 GetLocalTime
 0x1401862f8 OutputDebugStringA
 0x140186300 CreateFileA
 0x140186308 DeviceIoControl
 0x140186310 FindFirstFileA
 0x140186318 FindNextFileA
 0x140186320 DeleteFileA
 0x140186328 RtlVirtualUnwind
 0x140186330 QueryPerformanceCounter
 0x140186338 QueryPerformanceFrequency
 0x140186340 GetSystemInfo
 0x140186348 HeapSize
 0x140186350 CreateToolhelp32Snapshot
 0x140186358 HeapSetInformation
 0x140186360 IsValidCodePage
 0x140186368 GetOEMCP
 0x140186370 GetACP
 0x140186378 GetCPInfo
 0x140186380 FlsAlloc
 0x140186388 FlsFree
 0x140186390 FlsSetValue
 0x140186398 FlsGetValue
 0x1401863a0 DecodePointer
 0x1401863a8 EncodePointer
 0x1401863b0 GetStdHandle
 0x1401863b8 GetTimeZoneInformation
 0x1401863c0 GetStartupInfoW
 0x1401863c8 RtlCaptureContext
 0x1401863d0 IsDebuggerPresent
 0x1401863d8 SetUnhandledExceptionFilter
 0x1401863e0 UnhandledExceptionFilter
 0x1401863e8 TerminateProcess
 0x1401863f0 GetDriveTypeA
 0x1401863f8 FileTimeToLocalFileTime
 0x140186400 FileTimeToSystemTime
 0x140186408 VirtualQuery
 0x140186410 VirtualProtect
 0x140186418 ExitProcess
 0x140186420 HeapReAlloc
 0x140186428 RtlUnwindEx
 0x140186430 RtlLookupFunctionEntry
 0x140186438 RtlPcToFileHeader
 0x140186440 InterlockedPopEntrySList
 0x140186448 VirtualAlloc
 0x140186450 VirtualFree
 0x140186458 GetProcessHeap
 0x140186460 HeapAlloc
 0x140186468 HeapFree
 0x140186470 InterlockedPushEntrySList
 0x140186478 LoadLibraryA
 0x140186480 SetHandleCount
 0x140186488 GetFileType
 0x140186490 GetStartupInfoA
 0x140186498 SetFilePointer
 0x1401864a0 GetConsoleCP
 0x1401864a8 GetConsoleMode
 0x1401864b0 GetFullPathNameA
 0x1401864b8 GetCurrentDirectoryA
 0x1401864c0 FreeEnvironmentStringsW
 0x1401864c8 Process32FirstW
 0x1401864d0 Process32NextW
 0x1401864d8 LoadLibraryW
 0x1401864e0 CreateProcessA
 0x1401864e8 VerSetConditionMask
 0x1401864f0 VerifyVersionInfoW
 0x1401864f8 CreateFileMappingW
 0x140186500 GetVersionExW
 0x140186508 GetModuleFileNameA
 0x140186510 Sleep
 0x140186518 CreateMutexW
 0x140186520 GetModuleFileNameW
 0x140186528 LoadLibraryExW
 0x140186530 FindResourceW
 0x140186538 LoadResource
 0x140186540 SizeofResource
 0x140186548 MultiByteToWideChar
 0x140186550 FreeLibrary
 0x140186558 lstrcmpiW
 0x140186560 GetModuleHandleW
 0x140186568 GetProcAddress
 0x140186570 GetLastError
 0x140186578 lstrlenW
 0x140186580 GetTickCount
 0x140186588 UnmapViewOfFile
 0x140186590 MapViewOfFile
 0x140186598 OpenFileMappingW
 0x1401865a0 CloseHandle
 0x1401865a8 GetCurrentProcessId
 0x1401865b0 InitializeCriticalSection
 0x1401865b8 SetLastError
 0x1401865c0 GetCurrentThreadId
 0x1401865c8 DeleteCriticalSection
 0x1401865d0 InitializeCriticalSectionAndSpinCount
 0x1401865d8 GetCurrentProcess
 0x1401865e0 FlushInstructionCache
 0x1401865e8 LeaveCriticalSection
 0x1401865f0 EnterCriticalSection
 0x1401865f8 RaiseException
 0x140186600 GetEnvironmentStringsW
 0x140186608 GetCommandLineW
 0x140186610 LCMapStringA
 0x140186618 LCMapStringW
 0x140186620 FlushFileBuffers
 0x140186628 GetLocaleInfoA
 0x140186630 GetStringTypeA
 0x140186638 GetStringTypeW
 0x140186640 SetStdHandle
 0x140186648 WriteConsoleA
 0x140186650 GetConsoleOutputCP
 0x140186658 WriteConsoleW
 0x140186660 CompareStringA
 0x140186668 CompareStringW
 0x140186670 SetEnvironmentVariableA
 0x140186678 SetEndOfFile
 0x140186680 LocalAlloc
 0x140186688 HeapCreate
USER32.dll
 0x1401866f0 EnumDisplayMonitors
 0x1401866f8 GetCursorInfo
 0x140186700 GetIconInfo
 0x140186708 GetPriorityClipboardFormat
 0x140186710 GetClipboardSequenceNumber
 0x140186718 ExitWindowsEx
 0x140186720 GetClipboardData
 0x140186728 MapVirtualKeyW
 0x140186730 SendInput
 0x140186738 OpenClipboard
 0x140186740 EmptyClipboard
 0x140186748 SetClipboardData
 0x140186750 CloseClipboard
 0x140186758 GetThreadDesktop
 0x140186760 FindWindowW
 0x140186768 SetDlgItemTextW
 0x140186770 SetDlgItemInt
 0x140186778 SendDlgItemMessageW
 0x140186780 GetDlgItemTextW
 0x140186788 GetDlgItemInt
 0x140186790 FillRect
 0x140186798 DrawTextA
 0x1401867a0 SetScrollInfo
 0x1401867a8 GetScrollInfo
 0x1401867b0 ShowScrollBar
 0x1401867b8 SetScrollPos
 0x1401867c0 GetScrollRange
 0x1401867c8 GetScrollPos
 0x1401867d0 EnableWindow
 0x1401867d8 ClientToScreen
 0x1401867e0 EnumDisplaySettingsW
 0x1401867e8 CreatePopupMenu
 0x1401867f0 AppendMenuW
 0x1401867f8 GetActiveWindow
 0x140186800 GetWindowThreadProcessId
 0x140186808 GetDlgCtrlID
 0x140186810 GetKeyState
 0x140186818 LockWorkStation
 0x140186820 GetSystemMetrics
 0x140186828 GetCursorPos
 0x140186830 LoadIconW
 0x140186838 PtInRect
 0x140186840 SetCursor
 0x140186848 ReleaseCapture
 0x140186850 OffsetRect
 0x140186858 EndPaint
 0x140186860 BeginPaint
 0x140186868 GetWindowLongPtrW
 0x140186870 GetSubMenu
 0x140186878 TrackPopupMenu
 0x140186880 CallWindowProcW
 0x140186888 MonitorFromPoint
 0x140186890 DestroyMenu
 0x140186898 CheckMenuItem
 0x1401868a0 EnableMenuItem
 0x1401868a8 DeleteMenu
 0x1401868b0 LoadMenuW
 0x1401868b8 DrawTextW
 0x1401868c0 SetForegroundWindow
 0x1401868c8 SystemParametersInfoW
 0x1401868d0 ChangeDisplaySettingsW
 0x1401868d8 GetUserObjectInformationW
 0x1401868e0 RegisterClassW
 0x1401868e8 UnregisterClassW
 0x1401868f0 EnumWindows
 0x1401868f8 MoveWindow
 0x140186900 WindowFromPoint
 0x140186908 DrawIconEx
 0x140186910 DestroyIcon
 0x140186918 LoadImageW
 0x140186920 SetWindowLongW
 0x140186928 GetParent
 0x140186930 GetWindow
 0x140186938 MonitorFromWindow
 0x140186940 GetMonitorInfoW
 0x140186948 UnionRect
 0x140186950 mouse_event
 0x140186958 IntersectRect
 0x140186960 DialogBoxParamW
 0x140186968 OpenInputDesktop
 0x140186970 MapWindowPoints
 0x140186978 IsWindow
 0x140186980 IsDialogMessageW
 0x140186988 SetFocus
 0x140186990 SetCapture
 0x140186998 KillTimer
 0x1401869a0 SetTimer
 0x1401869a8 IsWindowVisible
 0x1401869b0 ReleaseDC
 0x1401869b8 GetDC
 0x1401869c0 GetWindowRect
 0x1401869c8 GetWindowTextLengthW
 0x1401869d0 GetWindowTextW
 0x1401869d8 SetWindowTextW
 0x1401869e0 SendMessageW
 0x1401869e8 GetWindowLongW
 0x1401869f0 DefWindowProcW
 0x1401869f8 MessageBoxW
 0x140186a00 CreateWindowExW
 0x140186a08 RegisterClassExW
 0x140186a10 CharNextW
 0x140186a18 PeekMessageW
 0x140186a20 LoadStringW
 0x140186a28 LoadCursorW
 0x140186a30 GetClassInfoExW
 0x140186a38 OpenDesktopW
 0x140186a40 SetThreadDesktop
 0x140186a48 CloseDesktop
 0x140186a50 GetMessageW
 0x140186a58 PostQuitMessage
 0x140186a60 TranslateMessage
 0x140186a68 DispatchMessageW
 0x140186a70 CreateDialogParamW
 0x140186a78 SetWindowLongPtrW
 0x140186a80 GetDlgItemTextA
 0x140186a88 EndDialog
 0x140186a90 DestroyWindow
 0x140186a98 PostThreadMessageW
 0x140186aa0 GetDlgItem
 0x140186aa8 ShowWindow
 0x140186ab0 InvalidateRect
 0x140186ab8 UpdateWindow
 0x140186ac0 GetClientRect
 0x140186ac8 SetWindowPos
 0x140186ad0 PostMessageW
 0x140186ad8 UnregisterClassA
 0x140186ae0 GetCapture
GDI32.dll
 0x1401860e0 BitBlt
 0x1401860e8 ExtSelectClipRgn
 0x1401860f0 CreateDCW
 0x1401860f8 RestoreDC
 0x140186100 SaveDC
 0x140186108 GetPaletteEntries
 0x140186110 StretchBlt
 0x140186118 CreateCompatibleDC
 0x140186120 CreateDIBSection
 0x140186128 SetStretchBltMode
 0x140186130 GetObjectW
 0x140186138 GetDIBits
 0x140186140 GetDeviceCaps
 0x140186148 GetTextExtentExPointW
 0x140186150 CreatePen
 0x140186158 CreateHatchBrush
 0x140186160 CreateFontW
 0x140186168 ExtTextOutW
 0x140186170 RoundRect
 0x140186178 Polygon
 0x140186180 Ellipse
 0x140186188 ExcludeClipRect
 0x140186190 SelectClipRgn
 0x140186198 SetViewportOrgEx
 0x1401861a0 SetTextColor
 0x1401861a8 SetBkMode
 0x1401861b0 SetBkColor
 0x1401861b8 GetStockObject
 0x1401861c0 DeleteDC
 0x1401861c8 DeleteObject
 0x1401861d0 CreateSolidBrush
 0x1401861d8 CreateRectRgn
 0x1401861e0 SelectObject
 0x1401861e8 Rectangle
ADVAPI32.dll
 0x140186000 RegisterServiceCtrlHandlerW
 0x140186008 SetServiceStatus
 0x140186010 LookupPrivilegeValueW
 0x140186018 AdjustTokenPrivileges
 0x140186020 OpenProcessToken
 0x140186028 DuplicateTokenEx
 0x140186030 SetTokenInformation
 0x140186038 CreateProcessAsUserW
 0x140186040 DeleteService
 0x140186048 CreateServiceW
 0x140186050 OpenServiceW
 0x140186058 StartServiceW
 0x140186060 ControlService
 0x140186068 ChangeServiceConfig2W
 0x140186070 OpenSCManagerW
 0x140186078 CloseServiceHandle
 0x140186080 GetUserNameW
 0x140186088 RegQueryValueExW
 0x140186090 RegEnumKeyExW
 0x140186098 RegQueryInfoKeyW
 0x1401860a0 RegSetValueExW
 0x1401860a8 RegOpenKeyExW
 0x1401860b0 RegCreateKeyExW
 0x1401860b8 RegCloseKey
 0x1401860c0 RegDeleteValueW
 0x1401860c8 RegDeleteKeyW
 0x1401860d0 StartServiceCtrlDispatcherW
SHELL32.dll
 0x1401866b8 SHGetFolderPathW
 0x1401866c0 DragFinish
 0x1401866c8 Shell_NotifyIconW
 0x1401866d0 DragAcceptFiles
 0x1401866d8 ShellExecuteA
 0x1401866e0 DragQueryFileW
ole32.dll
 0x140186bc0 CoTaskMemRealloc
 0x140186bc8 CoCreateInstance
 0x140186bd0 CoTaskMemFree
 0x140186bd8 CoInitializeEx
 0x140186be0 CoUninitialize
 0x140186be8 PropVariantClear
 0x140186bf0 CoTaskMemAlloc
OLEAUT32.dll
 0x140186698 VariantClear
 0x1401866a0 VarUI4FromStr
 0x1401866a8 VariantInit
USERENV.dll
 0x140186af0 CreateEnvironmentBlock
 0x140186af8 DestroyEnvironmentBlock

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure