Report - Payload.exe

Malicious Library Malicious Packer PE32 PE File
ScreenShot
Created 2024.01.06 10:45 Machine s1_win7_x6401
Filename Payload.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
4.2
ZERO API file : malware
VT API (file) 59 detected (FamVT, RorenNHc, Swrort, Windows, Metasploit, CryptZ, Marte, Rozena, Save, CobaltStrike, malicious, confidence, 100%, score, ccnc, Shell, MsfShell, Gen2, RozenaGen, SMAL01, EncPk, Static AI, Malicious PE, Eldorado, ai score=88, GrayWare, Tampering, Meterpreter, A@4jwdqr, Elzob, 19A8VV2, Detected, R1283, ZexaF, eq1@aGaydNfi, unsafe, GdSda, HackTool, CLASSIC, susgen)
md5 9f4a5ffa55c42cdc2b338b2988064a68
sha256 ca62c0c61f385358ca0217b114e31eef2949f1ad95ed8604d756999dac40c643
ssdeep 1536:ISr02cRwWhoNIgQ72mj603r2Mb+KR0Nc8QsJq39:ORwtQym203Ce0Nc8QsC9
imphash 481f47bbb2c9c21e108d65f52b04c448
impfuzzy 48:K+x02G0oErgsXit/qOJLawRr+pe4yVj9hYykN6tqW:K+RGpErJXw/qmRr+pYjDkN6tqW
  Network IP location

Signature (5cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 59 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer

Rules (4cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
193.117.208.148 GB Virtual1 Limited 193.117.208.148 malware

Suricata ids

PE API

IAT(Import Address Table) Library

MSVCRT.dll
 0x40c0c8 _iob
 0x40c0cc _except_handler3
 0x40c0d0 __set_app_type
 0x40c0d4 __p__fmode
 0x40c0d8 __p__commode
 0x40c0dc _adjust_fdiv
 0x40c0e0 __setusermatherr
 0x40c0e4 _initterm
 0x40c0e8 __getmainargs
 0x40c0ec __p___initenv
 0x40c0f0 _XcptFilter
 0x40c0f4 _exit
 0x40c0f8 _onexit
 0x40c0fc __dllonexit
 0x40c100 strrchr
 0x40c104 wcsncmp
 0x40c108 _close
 0x40c10c wcslen
 0x40c110 wcscpy
 0x40c114 strerror
 0x40c118 modf
 0x40c11c strspn
 0x40c120 realloc
 0x40c124 __p__environ
 0x40c128 __p__wenviron
 0x40c12c _errno
 0x40c130 free
 0x40c134 strncmp
 0x40c138 strstr
 0x40c13c strncpy
 0x40c140 _ftol
 0x40c144 qsort
 0x40c148 fopen
 0x40c14c perror
 0x40c150 fclose
 0x40c154 fflush
 0x40c158 calloc
 0x40c15c malloc
 0x40c160 signal
 0x40c164 printf
 0x40c168 _isctype
 0x40c16c atoi
 0x40c170 exit
 0x40c174 __mb_cur_max
 0x40c178 _pctype
 0x40c17c strchr
 0x40c180 fprintf
 0x40c184 _controlfp
 0x40c188 _strdup
 0x40c18c _strnicmp
KERNEL32.dll
 0x40c00c PeekNamedPipe
 0x40c010 ReadFile
 0x40c014 WriteFile
 0x40c018 LoadLibraryA
 0x40c01c GetProcAddress
 0x40c020 GetVersionExA
 0x40c024 GetExitCodeProcess
 0x40c028 TerminateProcess
 0x40c02c LeaveCriticalSection
 0x40c030 SetEvent
 0x40c034 ReleaseMutex
 0x40c038 EnterCriticalSection
 0x40c03c DeleteCriticalSection
 0x40c040 InitializeCriticalSection
 0x40c044 CreateMutexA
 0x40c048 GetFileType
 0x40c04c SetLastError
 0x40c050 FreeEnvironmentStringsW
 0x40c054 GetEnvironmentStringsW
 0x40c058 GlobalFree
 0x40c05c GetCommandLineW
 0x40c060 TlsAlloc
 0x40c064 TlsFree
 0x40c068 DuplicateHandle
 0x40c06c GetCurrentProcess
 0x40c070 SetHandleInformation
 0x40c074 CloseHandle
 0x40c078 GetSystemTimeAsFileTime
 0x40c07c FileTimeToSystemTime
 0x40c080 GetTimeZoneInformation
 0x40c084 FileTimeToLocalFileTime
 0x40c088 SystemTimeToFileTime
 0x40c08c SystemTimeToTzSpecificLocalTime
 0x40c090 Sleep
 0x40c094 FormatMessageA
 0x40c098 GetLastError
 0x40c09c WaitForSingleObject
 0x40c0a0 CreateEventA
 0x40c0a4 SetStdHandle
 0x40c0a8 SetFilePointer
 0x40c0ac CreateFileA
 0x40c0b0 CreateFileW
 0x40c0b4 GetOverlappedResult
 0x40c0b8 DeviceIoControl
 0x40c0bc GetFileInformationByHandle
 0x40c0c0 LocalFree
ADVAPI32.dll
 0x40c000 FreeSid
 0x40c004 AllocateAndInitializeSid
WSOCK32.dll
 0x40c1a0 getsockopt
 0x40c1a4 connect
 0x40c1a8 htons
 0x40c1ac gethostbyname
 0x40c1b0 ntohl
 0x40c1b4 inet_ntoa
 0x40c1b8 setsockopt
 0x40c1bc socket
 0x40c1c0 closesocket
 0x40c1c4 select
 0x40c1c8 ioctlsocket
 0x40c1cc __WSAFDIsSet
 0x40c1d0 WSAStartup
 0x40c1d4 WSACleanup
 0x40c1d8 WSAGetLastError
WS2_32.dll
 0x40c194 WSARecv
 0x40c198 WSASend

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure