Report - random.exe

Amadey PE File PE32
ScreenShot
Created 2024.06.16 10:31 Machine s1_win7_x6401
Filename random.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
10
Behavior Score
10.0
ZERO API file : malware
VT API (file) 41 detected (AIDetectMalware, malicious, high confidence, score, GenericKDZ, Unsafe, Attribute, HighConfidence, Themida, TrojanX, Generic@AI, RDML, y+YDW0pTaDjeBwUnnvUdaw, Real Protect, high, Generic ML PUA, ai score=87, Sabsik, R645974, ZexaF, 0DWaaew, bppi, Amadey, Probably Heur, ExeHeaderL, Deyma, Static AI, Malicious PE, MxResIcn, confidence, 100%)
md5 11afad19e16fa87f34c05c8e61e78811
sha256 7ae8e8605e091e9e28a0e8f26b9c7de8c4dd086eea711a612f19a87283b5e6c1
ssdeep 24576:29N52KTQAlvFX66EhtRpGK04ahqRGRz+4VzaAXWa7zXVK2uBZNxL6ntpGmsGOdwY:29L2KBdwjF2llRzJrL7REXSrGmQ5zyR
imphash 2eabe9054cad5152567f0699947a2c5b
impfuzzy 3:sBv:A
  Network IP location

Signature (21cnts)

Level Description
danger File has been identified by 41 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Checks for the presence of known devices from debuggers and forensic tools
watch Checks for the presence of known windows from debuggers and forensic tools
watch Checks the version of Bios
watch Communicates with host for which no DNS query was performed
watch Detects VMWare through the in instruction feature
watch Installs itself for autorun at Windows startup
notice A process attempted to delay the analysis task.
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Expresses interest in specific running processes
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://77.91.77.81/Kiru9gu/index.php RU Foton Telecom CJSC 77.91.77.81 40037 mailcious
114.132.189.148 Unknown 114.132.189.148 mailcious
77.91.77.81 RU Foton Telecom CJSC 77.91.77.81 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x46a036 lstrcpy

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure