Report - hjv.exe

Malicious Library UPX PE File DllRegisterServer dll PE32 MZP Format
ScreenShot
Created 2024.05.11 19:47 Machine s1_win7_x6403
Filename hjv.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
3.4
ZERO API file : mailcious
VT API (file) 48 detected (AIDetectMalware, Modiloader, malicious, high confidence, score, Strab, Infected, V0e1, Attribute, HighConfidence, Artemis, RATX, Generic@AI, RDML, 6o8xQkrMwjq3gtAMqHjA, Redcap, cxvad, DownLoader46, REMCOS, YXEEIZ, MetaStealer, Detected, ai score=89, UUWW, R647787, BScope, RmRAT, Tdkl, Static AI, Suspicious PE)
md5 36166d066eca6b22121c54d5ced2b51c
sha256 8ab3fd118f9c8b251b57af13530f3453e1be5a75ee258f51d31b5d49346f1d31
ssdeep 24576:JfnYNSoeuTPZAX/LZN6gJEEEEEEEEEEEEEEEEEEEE:JMuVEEEEEEEEEEEEEEEEEEEE
imphash 193dcc23f0c4b3eebcdd62c20466f1b9
impfuzzy 192:ot3MDbuu0xSUvK9kso1XEpeFLG/G1Q+POQHA:E3m0q9uH1vPOQg
  Network IP location

Signature (7cnts)

Level Description
danger File has been identified by 48 AntiVirus engines on VirusTotal as malicious
watch Detects VMWare through the in instruction feature
watch Disables proxy possibly for traffic interception
notice Allocates read-write-execute memory (usually to unpack itself)
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (6cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
onedrive.live.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.139.11 mailcious
13.107.137.11 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.137.11 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

oleaut32.dll
 0x4b472c SysFreeString
 0x4b4730 SysReAllocStringLen
 0x4b4734 SysAllocStringLen
advapi32.dll
 0x4b473c RegQueryValueExA
 0x4b4740 RegOpenKeyExA
 0x4b4744 RegCloseKey
user32.dll
 0x4b474c GetKeyboardType
 0x4b4750 DestroyWindow
 0x4b4754 LoadStringA
 0x4b4758 MessageBoxA
 0x4b475c CharNextA
kernel32.dll
 0x4b4764 GetACP
 0x4b4768 Sleep
 0x4b476c VirtualFree
 0x4b4770 VirtualAlloc
 0x4b4774 GetTickCount
 0x4b4778 QueryPerformanceCounter
 0x4b477c GetCurrentThreadId
 0x4b4780 InterlockedDecrement
 0x4b4784 InterlockedIncrement
 0x4b4788 VirtualQuery
 0x4b478c WideCharToMultiByte
 0x4b4790 MultiByteToWideChar
 0x4b4794 lstrlenA
 0x4b4798 lstrcpynA
 0x4b479c LoadLibraryExA
 0x4b47a0 GetThreadLocale
 0x4b47a4 GetStartupInfoA
 0x4b47a8 GetProcAddress
 0x4b47ac GetModuleHandleA
 0x4b47b0 GetModuleFileNameA
 0x4b47b4 GetLocaleInfoA
 0x4b47b8 GetCommandLineA
 0x4b47bc FreeLibrary
 0x4b47c0 FindFirstFileA
 0x4b47c4 FindClose
 0x4b47c8 ExitProcess
 0x4b47cc CompareStringA
 0x4b47d0 WriteFile
 0x4b47d4 UnhandledExceptionFilter
 0x4b47d8 RtlUnwind
 0x4b47dc RaiseException
 0x4b47e0 GetStdHandle
kernel32.dll
 0x4b47e8 TlsSetValue
 0x4b47ec TlsGetValue
 0x4b47f0 LocalAlloc
 0x4b47f4 GetModuleHandleA
user32.dll
 0x4b47fc CreateWindowExA
 0x4b4800 WindowFromPoint
 0x4b4804 WaitMessage
 0x4b4808 UpdateWindow
 0x4b480c UnregisterClassA
 0x4b4810 UnhookWindowsHookEx
 0x4b4814 TranslateMessage
 0x4b4818 TranslateMDISysAccel
 0x4b481c TrackPopupMenu
 0x4b4820 SystemParametersInfoA
 0x4b4824 ShowWindow
 0x4b4828 ShowScrollBar
 0x4b482c ShowOwnedPopups
 0x4b4830 SetWindowsHookExA
 0x4b4834 SetWindowPos
 0x4b4838 SetWindowPlacement
 0x4b483c SetWindowLongW
 0x4b4840 SetWindowLongA
 0x4b4844 SetTimer
 0x4b4848 SetScrollRange
 0x4b484c SetScrollPos
 0x4b4850 SetScrollInfo
 0x4b4854 SetRect
 0x4b4858 SetPropA
 0x4b485c SetParent
 0x4b4860 SetMenuItemInfoA
 0x4b4864 SetMenu
 0x4b4868 SetForegroundWindow
 0x4b486c SetFocus
 0x4b4870 SetCursor
 0x4b4874 SetClassLongA
 0x4b4878 SetCapture
 0x4b487c SetActiveWindow
 0x4b4880 SendMessageW
 0x4b4884 SendMessageA
 0x4b4888 ScrollWindow
 0x4b488c ScreenToClient
 0x4b4890 RemovePropA
 0x4b4894 RemoveMenu
 0x4b4898 ReleaseDC
 0x4b489c ReleaseCapture
 0x4b48a0 RegisterWindowMessageA
 0x4b48a4 RegisterClipboardFormatA
 0x4b48a8 RegisterClassA
 0x4b48ac RedrawWindow
 0x4b48b0 PtInRect
 0x4b48b4 PostQuitMessage
 0x4b48b8 PostMessageA
 0x4b48bc PeekMessageW
 0x4b48c0 PeekMessageA
 0x4b48c4 OffsetRect
 0x4b48c8 OemToCharA
 0x4b48cc MessageBoxA
 0x4b48d0 MapWindowPoints
 0x4b48d4 MapVirtualKeyA
 0x4b48d8 LoadStringA
 0x4b48dc LoadKeyboardLayoutA
 0x4b48e0 LoadIconA
 0x4b48e4 LoadCursorA
 0x4b48e8 LoadBitmapA
 0x4b48ec KillTimer
 0x4b48f0 IsZoomed
 0x4b48f4 IsWindowVisible
 0x4b48f8 IsWindowUnicode
 0x4b48fc IsWindowEnabled
 0x4b4900 IsWindow
 0x4b4904 IsRectEmpty
 0x4b4908 IsIconic
 0x4b490c IsDialogMessageW
 0x4b4910 IsDialogMessageA
 0x4b4914 IsChild
 0x4b4918 InvalidateRect
 0x4b491c IntersectRect
 0x4b4920 InsertMenuItemA
 0x4b4924 InsertMenuA
 0x4b4928 InflateRect
 0x4b492c GetWindowThreadProcessId
 0x4b4930 GetWindowTextA
 0x4b4934 GetWindowRect
 0x4b4938 GetWindowPlacement
 0x4b493c GetWindowLongW
 0x4b4940 GetWindowLongA
 0x4b4944 GetWindowDC
 0x4b4948 GetTopWindow
 0x4b494c GetSystemMetrics
 0x4b4950 GetSystemMenu
 0x4b4954 GetSysColorBrush
 0x4b4958 GetSysColor
 0x4b495c GetSubMenu
 0x4b4960 GetScrollRange
 0x4b4964 GetScrollPos
 0x4b4968 GetScrollInfo
 0x4b496c GetPropA
 0x4b4970 GetParent
 0x4b4974 GetWindow
 0x4b4978 GetMessagePos
 0x4b497c GetMenuStringA
 0x4b4980 GetMenuState
 0x4b4984 GetMenuItemInfoA
 0x4b4988 GetMenuItemID
 0x4b498c GetMenuItemCount
 0x4b4990 GetMenu
 0x4b4994 GetLastActivePopup
 0x4b4998 GetKeyboardState
 0x4b499c GetKeyboardLayoutNameA
 0x4b49a0 GetKeyboardLayoutList
 0x4b49a4 GetKeyboardLayout
 0x4b49a8 GetKeyState
 0x4b49ac GetKeyNameTextA
 0x4b49b0 GetIconInfo
 0x4b49b4 GetForegroundWindow
 0x4b49b8 GetFocus
 0x4b49bc GetDesktopWindow
 0x4b49c0 GetDCEx
 0x4b49c4 GetDC
 0x4b49c8 GetCursorPos
 0x4b49cc GetCursor
 0x4b49d0 GetClipboardData
 0x4b49d4 GetClientRect
 0x4b49d8 GetClassLongA
 0x4b49dc GetClassInfoA
 0x4b49e0 GetCapture
 0x4b49e4 GetActiveWindow
 0x4b49e8 FrameRect
 0x4b49ec FindWindowA
 0x4b49f0 FillRect
 0x4b49f4 EqualRect
 0x4b49f8 EnumWindows
 0x4b49fc EnumThreadWindows
 0x4b4a00 EnumChildWindows
 0x4b4a04 EndPaint
 0x4b4a08 EnableWindow
 0x4b4a0c EnableScrollBar
 0x4b4a10 EnableMenuItem
 0x4b4a14 DrawTextA
 0x4b4a18 DrawMenuBar
 0x4b4a1c DrawIconEx
 0x4b4a20 DrawIcon
 0x4b4a24 DrawFrameControl
 0x4b4a28 DrawEdge
 0x4b4a2c DispatchMessageW
 0x4b4a30 DispatchMessageA
 0x4b4a34 DestroyWindow
 0x4b4a38 DestroyMenu
 0x4b4a3c DestroyIcon
 0x4b4a40 DestroyCursor
 0x4b4a44 DeleteMenu
 0x4b4a48 DefWindowProcA
 0x4b4a4c DefMDIChildProcA
 0x4b4a50 DefFrameProcA
 0x4b4a54 CreatePopupMenu
 0x4b4a58 CreateMenu
 0x4b4a5c CreateIcon
 0x4b4a60 ClientToScreen
 0x4b4a64 CheckMenuItem
 0x4b4a68 CallWindowProcA
 0x4b4a6c CallNextHookEx
 0x4b4a70 BeginPaint
 0x4b4a74 CharNextA
 0x4b4a78 CharLowerBuffA
 0x4b4a7c CharLowerA
 0x4b4a80 CharToOemA
 0x4b4a84 AdjustWindowRectEx
 0x4b4a88 ActivateKeyboardLayout
gdi32.dll
 0x4b4a90 UnrealizeObject
 0x4b4a94 StretchBlt
 0x4b4a98 SetWindowOrgEx
 0x4b4a9c SetWinMetaFileBits
 0x4b4aa0 SetViewportOrgEx
 0x4b4aa4 SetTextColor
 0x4b4aa8 SetStretchBltMode
 0x4b4aac SetROP2
 0x4b4ab0 SetPixel
 0x4b4ab4 SetEnhMetaFileBits
 0x4b4ab8 SetDIBColorTable
 0x4b4abc SetBrushOrgEx
 0x4b4ac0 SetBkMode
 0x4b4ac4 SetBkColor
 0x4b4ac8 SelectPalette
 0x4b4acc SelectObject
 0x4b4ad0 SaveDC
 0x4b4ad4 RestoreDC
 0x4b4ad8 Rectangle
 0x4b4adc RectVisible
 0x4b4ae0 RealizePalette
 0x4b4ae4 PlayEnhMetaFile
 0x4b4ae8 PatBlt
 0x4b4aec MoveToEx
 0x4b4af0 MaskBlt
 0x4b4af4 LineTo
 0x4b4af8 IntersectClipRect
 0x4b4afc GetWindowOrgEx
 0x4b4b00 GetWinMetaFileBits
 0x4b4b04 GetTextMetricsA
 0x4b4b08 GetTextExtentPoint32A
 0x4b4b0c GetSystemPaletteEntries
 0x4b4b10 GetStockObject
 0x4b4b14 GetRgnBox
 0x4b4b18 GetPixel
 0x4b4b1c GetPaletteEntries
 0x4b4b20 GetObjectA
 0x4b4b24 GetEnhMetaFilePaletteEntries
 0x4b4b28 GetEnhMetaFileHeader
 0x4b4b2c GetEnhMetaFileBits
 0x4b4b30 GetDeviceCaps
 0x4b4b34 GetDIBits
 0x4b4b38 GetDIBColorTable
 0x4b4b3c GetDCOrgEx
 0x4b4b40 GetCurrentPositionEx
 0x4b4b44 GetClipBox
 0x4b4b48 GetBrushOrgEx
 0x4b4b4c GetBitmapBits
 0x4b4b50 GdiFlush
 0x4b4b54 ExtFloodFill
 0x4b4b58 ExcludeClipRect
 0x4b4b5c DeleteObject
 0x4b4b60 DeleteEnhMetaFile
 0x4b4b64 DeleteDC
 0x4b4b68 CreateSolidBrush
 0x4b4b6c CreatePenIndirect
 0x4b4b70 CreatePalette
 0x4b4b74 CreateHalftonePalette
 0x4b4b78 CreateFontIndirectA
 0x4b4b7c CreateDIBitmap
 0x4b4b80 CreateDIBSection
 0x4b4b84 CreateCompatibleDC
 0x4b4b88 CreateCompatibleBitmap
 0x4b4b8c CreateBrushIndirect
 0x4b4b90 CreateBitmap
 0x4b4b94 CopyEnhMetaFileA
 0x4b4b98 BitBlt
version.dll
 0x4b4ba0 VerQueryValueA
 0x4b4ba4 GetFileVersionInfoSizeA
 0x4b4ba8 GetFileVersionInfoA
kernel32.dll
 0x4b4bb0 lstrcpyA
 0x4b4bb4 WriteFile
 0x4b4bb8 WaitForSingleObject
 0x4b4bbc VirtualQuery
 0x4b4bc0 VirtualAlloc
 0x4b4bc4 SizeofResource
 0x4b4bc8 SetThreadLocale
 0x4b4bcc SetFilePointer
 0x4b4bd0 SetEvent
 0x4b4bd4 SetErrorMode
 0x4b4bd8 SetEndOfFile
 0x4b4bdc ResetEvent
 0x4b4be0 ReadFile
 0x4b4be4 MulDiv
 0x4b4be8 LockResource
 0x4b4bec LoadResource
 0x4b4bf0 LoadLibraryA
 0x4b4bf4 LeaveCriticalSection
 0x4b4bf8 InitializeCriticalSection
 0x4b4bfc GlobalFindAtomA
 0x4b4c00 GlobalDeleteAtom
 0x4b4c04 GlobalAddAtomA
 0x4b4c08 GetVersionExA
 0x4b4c0c GetVersion
 0x4b4c10 GetTickCount
 0x4b4c14 GetThreadLocale
 0x4b4c18 GetStdHandle
 0x4b4c1c GetProcAddress
 0x4b4c20 GetModuleHandleW
 0x4b4c24 GetModuleHandleA
 0x4b4c28 GetModuleFileNameA
 0x4b4c2c GetLocaleInfoA
 0x4b4c30 GetLocalTime
 0x4b4c34 GetLastError
 0x4b4c38 GetFullPathNameA
 0x4b4c3c GetDiskFreeSpaceA
 0x4b4c40 GetDateFormatA
 0x4b4c44 GetCurrentThreadId
 0x4b4c48 GetCurrentProcessId
 0x4b4c4c GetCPInfo
 0x4b4c50 FreeResource
 0x4b4c54 InterlockedExchange
 0x4b4c58 FreeLibrary
 0x4b4c5c FormatMessageA
 0x4b4c60 FindResourceA
 0x4b4c64 EnumCalendarInfoA
 0x4b4c68 EnterCriticalSection
 0x4b4c6c DeleteCriticalSection
 0x4b4c70 CreateThread
 0x4b4c74 CreateFileA
 0x4b4c78 CreateEventA
 0x4b4c7c CompareStringA
 0x4b4c80 CloseHandle
advapi32.dll
 0x4b4c88 RegQueryValueExA
 0x4b4c8c RegOpenKeyExA
 0x4b4c90 RegFlushKey
 0x4b4c94 RegCloseKey
kernel32.dll
 0x4b4c9c Sleep
oleaut32.dll
 0x4b4ca4 SafeArrayPtrOfIndex
 0x4b4ca8 SafeArrayGetUBound
 0x4b4cac SafeArrayGetLBound
 0x4b4cb0 SafeArrayCreate
 0x4b4cb4 VariantChangeType
 0x4b4cb8 VariantCopy
 0x4b4cbc VariantClear
 0x4b4cc0 VariantInit
comctl32.dll
 0x4b4cc8 _TrackMouseEvent
 0x4b4ccc ImageList_SetIconSize
 0x4b4cd0 ImageList_GetIconSize
 0x4b4cd4 ImageList_Write
 0x4b4cd8 ImageList_Read
 0x4b4cdc ImageList_GetDragImage
 0x4b4ce0 ImageList_DragShowNolock
 0x4b4ce4 ImageList_DragMove
 0x4b4ce8 ImageList_DragLeave
 0x4b4cec ImageList_DragEnter
 0x4b4cf0 ImageList_EndDrag
 0x4b4cf4 ImageList_BeginDrag
 0x4b4cf8 ImageList_Remove
 0x4b4cfc ImageList_DrawEx
 0x4b4d00 ImageList_Replace
 0x4b4d04 ImageList_Draw
 0x4b4d08 ImageList_GetBkColor
 0x4b4d0c ImageList_SetBkColor
 0x4b4d10 ImageList_Add
 0x4b4d14 ImageList_GetImageCount
 0x4b4d18 ImageList_Destroy
 0x4b4d1c ImageList_Create
shell32.dll
 0x4b4d24 ShellAboutA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure