popup

Report - 999999.exe

Backdoor Farfli Hide_EXE Generic Malware Malicious Library UPX PE File PE32 DLL OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.06.16 09:55 Machine s1_win7_x6403
Filename 999999.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
7.2
ZERO API file : malware
VT API (file) 69 detected (AIDetectMalware, YoungLotus, malicious, high confidence, score, FCWQ, Unsafe, Farfli, V63r, DropperX, Gh0stRAT, dpanmc, Zusy, CLASSIC, qqkhu, DownLoader12, ZEGOST, SM29, moderate, Detected, ai score=83, TCM@5ruomd, Venik, Eldorado, R128989, ZexaF, dm1@aq6CFGjf, BScope, Nitol, Gencirc, GenAsa, BZKdUv1dR3c, Static AI, Suspicious PE, susgen, confidence, 100%)
md5 2b6bdd0a18e76a5df3a867a49f951125
sha256 b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f
ssdeep 768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ahPC:Ub1MsHz3JDwhyWr+N95OTga6Z
imphash 24ffff844f7eed74e1f1064cc9840ba9
impfuzzy 48:hDC9QEId0D5Ok3nIx02G+R1qnOwX1KXZAoESeFKQ6:1C9QLzdRG+R1qn1X1GH
  Network IP location

Signature (15cnts)

Level Description
danger File has been identified by 69 AntiVirus engines on VirusTotal as malicious
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
watch Installs itself for autorun at Windows startup
notice A process created a hidden window
notice Creates a service
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
notice Searches running processes potentially to identify processes for sandbox evasion
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Command line console output was observed
info The executable uses a known packer

Rules (13cnts)

Level Name Description Collection
danger Win_Backdoor_Farfli gives threat-actors several options of gaining access to the affected system. binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning hide_executable_file Hide executable file binaries (download)
warning hide_executable_file Hide executable file binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
111.229.102.8
whois
CN Shenzhen Tencent Computer Systems Company Limited 111.229.102.8 clean

Suricata ids

PE API

IAT(Import Address Table) Library

MFC42.DLL
 0x403054 None
 0x403058 None
 0x40305c None
 0x403060 None
 0x403064 None
 0x403068 None
 0x40306c None
 0x403070 None
 0x403074 None
 0x403078 None
 0x40307c None
 0x403080 None
 0x403084 None
 0x403088 None
 0x40308c None
 0x403090 None
 0x403094 None
 0x403098 None
 0x40309c None
 0x4030a0 None
 0x4030a4 None
 0x4030a8 None
 0x4030ac None
 0x4030b0 None
 0x4030b4 None
 0x4030b8 None
 0x4030bc None
 0x4030c0 None
 0x4030c4 None
 0x4030c8 None
 0x4030cc None
 0x4030d0 None
 0x4030d4 None
 0x4030d8 None
 0x4030dc None
 0x4030e0 None
 0x4030e4 None
 0x4030e8 None
 0x4030ec None
 0x4030f0 None
 0x4030f4 None
 0x4030f8 None
 0x4030fc None
 0x403100 None
 0x403104 None
 0x403108 None
 0x40310c None
 0x403110 None
 0x403114 None
 0x403118 None
 0x40311c None
 0x403120 None
 0x403124 None
 0x403128 None
 0x40312c None
 0x403130 None
 0x403134 None
 0x403138 None
 0x40313c None
 0x403140 None
 0x403144 None
 0x403148 None
 0x40314c None
 0x403150 None
 0x403154 None
 0x403158 None
 0x40315c None
 0x403160 None
 0x403164 None
 0x403168 None
 0x40316c None
 0x403170 None
 0x403174 None
 0x403178 None
 0x40317c None
 0x403180 None
 0x403184 None
 0x403188 None
 0x40318c None
 0x403190 None
 0x403194 None
 0x403198 None
 0x40319c None
 0x4031a0 None
 0x4031a4 None
 0x4031a8 None
 0x4031ac None
 0x4031b0 None
 0x4031b4 None
 0x4031b8 None
 0x4031bc None
 0x4031c0 None
 0x4031c4 None
 0x4031c8 None
 0x4031cc None
 0x4031d0 None
 0x4031d4 None
 0x4031d8 None
 0x4031dc None
 0x4031e0 None
 0x4031e4 None
 0x4031e8 None
 0x4031ec None
 0x4031f0 None
MSVCRT.dll
 0x4031f8 _controlfp
 0x4031fc __set_app_type
 0x403200 __p__fmode
 0x403204 __p__commode
 0x403208 _adjust_fdiv
 0x40320c __setusermatherr
 0x403210 _initterm
 0x403214 __getmainargs
 0x403218 _acmdln
 0x40321c exit
 0x403220 _XcptFilter
 0x403224 _exit
 0x403228 _onexit
 0x40322c __dllonexit
 0x403230 _except_handler3
 0x403234 memset
 0x403238 __p__pgmptr
 0x40323c sprintf
 0x403240 memcpy
 0x403244 _access
 0x403248 __CxxFrameHandler
 0x40324c strstr
 0x403250 _setmbcp
 0x403254 _mkdir
KERNEL32.dll
 0x403000 CloseHandle
 0x403004 CreateFileA
 0x403008 FreeLibrary
 0x40300c GetTickCount
 0x403010 GetFileAttributesA
 0x403014 ExpandEnvironmentStringsA
 0x403018 GetLastError
 0x40301c GetProcAddress
 0x403020 LoadLibraryA
 0x403024 lstrcpyA
 0x403028 GetCommandLineA
 0x40302c Sleep
 0x403030 lstrcmpiA
 0x403034 SetThreadPriority
 0x403038 GetCurrentThread
 0x40303c SetPriorityClass
 0x403040 GetCurrentProcess
 0x403044 GetModuleHandleA
 0x403048 GetStartupInfoA
 0x40304c WriteFile
USER32.dll
 0x40325c SendMessageA
 0x403260 IsIconic
 0x403264 GetClientRect
 0x403268 EnableWindow
 0x40326c LoadIconA
 0x403270 GetSystemMetrics
 0x403274 wsprintfA
 0x403278 DrawIcon

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure