popup

Report - cryptography_module_windows.exe

Gen1 Generic Malware Malicious Library UPX Anti_VM PE64 PE File OS Processor Check DLL ZIP Format
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.05.08 07:59 Machine s1_win7_x6403
Filename cryptography_module_windows.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score Not founds Behavior Score
3.2
ZERO API file : mailcious
VT API (file) 2 detected (AIDetectMalware, MALICIOUS)
md5 ec69806113c382160f37a6ace203e280
sha256 779a5fe11a1db6a3b4a064a57106c126b306a027b89200c72744eeac0db0bfe2
ssdeep 196608:uzy4Edk0FpymvdsCncs4njQthsiHzy7k7C7DZRdwKihxv/o13:p4DwBvaCncNnKhs57IC7vqva
imphash d170e2e5adcfc4c271f2eb78a565305e
impfuzzy 48:CkCP9rteS1hEc+pFCJcgT+OtaipbmbU1M:lCPFteS1hEc+pFst+iruyM
  Network IP location

Signature (7cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice Creates executable files on the filesystem
notice File has been identified by 2 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (16cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (download)
info IsDLL (no description) binaries (download)
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info zip_file_format ZIP file format binaries (download)

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
182.162.106.144
whois
KR LG DACOM Corporation 182.162.106.144 clean
172.67.193.79
whois
US CLOUDFLARENET 172.67.193.79 clean
182.162.106.33
whois
KR LG DACOM Corporation 182.162.106.33 malware
104.21.18.166
whois
US CLOUDFLARENET 104.21.18.166 clean
172.67.169.89
whois
US CLOUDFLARENET 172.67.169.89 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x140025028 GetCommandLineW
 0x140025030 GetEnvironmentVariableW
 0x140025038 SetEnvironmentVariableW
 0x140025040 ExpandEnvironmentStringsW
 0x140025048 CreateDirectoryW
 0x140025050 GetTempPathW
 0x140025058 WaitForSingleObject
 0x140025060 Sleep
 0x140025068 GetExitCodeProcess
 0x140025070 GetStartupInfoW
 0x140025078 FreeLibrary
 0x140025080 LoadLibraryExW
 0x140025088 CloseHandle
 0x140025090 GetCurrentProcess
 0x140025098 LocalFree
 0x1400250a0 FormatMessageW
 0x1400250a8 MultiByteToWideChar
 0x1400250b0 WideCharToMultiByte
 0x1400250b8 SetEndOfFile
 0x1400250c0 GetProcAddress
 0x1400250c8 GetModuleFileNameW
 0x1400250d0 SetDllDirectoryW
 0x1400250d8 CreateProcessW
 0x1400250e0 GetLastError
 0x1400250e8 RtlCaptureContext
 0x1400250f0 RtlLookupFunctionEntry
 0x1400250f8 RtlVirtualUnwind
 0x140025100 UnhandledExceptionFilter
 0x140025108 SetUnhandledExceptionFilter
 0x140025110 TerminateProcess
 0x140025118 IsProcessorFeaturePresent
 0x140025120 QueryPerformanceCounter
 0x140025128 GetCurrentProcessId
 0x140025130 GetCurrentThreadId
 0x140025138 GetSystemTimeAsFileTime
 0x140025140 InitializeSListHead
 0x140025148 IsDebuggerPresent
 0x140025150 GetModuleHandleW
 0x140025158 RtlUnwindEx
 0x140025160 SetLastError
 0x140025168 EnterCriticalSection
 0x140025170 LeaveCriticalSection
 0x140025178 DeleteCriticalSection
 0x140025180 InitializeCriticalSectionAndSpinCount
 0x140025188 TlsAlloc
 0x140025190 TlsGetValue
 0x140025198 TlsSetValue
 0x1400251a0 TlsFree
 0x1400251a8 RaiseException
 0x1400251b0 GetCommandLineA
 0x1400251b8 CreateFileW
 0x1400251c0 GetDriveTypeW
 0x1400251c8 GetFileInformationByHandle
 0x1400251d0 GetFileType
 0x1400251d8 PeekNamedPipe
 0x1400251e0 SystemTimeToTzSpecificLocalTime
 0x1400251e8 FileTimeToSystemTime
 0x1400251f0 GetFullPathNameW
 0x1400251f8 RemoveDirectoryW
 0x140025200 FindClose
 0x140025208 FindFirstFileExW
 0x140025210 FindNextFileW
 0x140025218 SetStdHandle
 0x140025220 SetConsoleCtrlHandler
 0x140025228 DeleteFileW
 0x140025230 ReadFile
 0x140025238 GetStdHandle
 0x140025240 WriteFile
 0x140025248 ExitProcess
 0x140025250 GetModuleHandleExW
 0x140025258 HeapFree
 0x140025260 GetConsoleMode
 0x140025268 ReadConsoleW
 0x140025270 SetFilePointerEx
 0x140025278 GetConsoleOutputCP
 0x140025280 GetFileSizeEx
 0x140025288 HeapAlloc
 0x140025290 CompareStringW
 0x140025298 LCMapStringW
 0x1400252a0 GetCurrentDirectoryW
 0x1400252a8 FlushFileBuffers
 0x1400252b0 GetFileAttributesExW
 0x1400252b8 GetStringTypeW
 0x1400252c0 IsValidCodePage
 0x1400252c8 GetACP
 0x1400252d0 GetOEMCP
 0x1400252d8 GetCPInfo
 0x1400252e0 GetEnvironmentStringsW
 0x1400252e8 FreeEnvironmentStringsW
 0x1400252f0 GetProcessHeap
 0x1400252f8 GetTimeZoneInformation
 0x140025300 HeapSize
 0x140025308 HeapReAlloc
 0x140025310 WriteConsoleW
ADVAPI32.dll
 0x140025000 ConvertSidToStringSidW
 0x140025008 GetTokenInformation
 0x140025010 OpenProcessToken
 0x140025018 ConvertStringSecurityDescriptorToSecurityDescriptorW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure