Report - ClientCaller.exe

Malicious Library Downloader UPX DllRegisterServer dll PE File PE32 MZP Format
ScreenShot
Created 2024.06.17 09:23 Machine s1_win7_x6401
Filename ClientCaller.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
2.4
ZERO API file : clean
VT API (file) 41 detected (AIDetectMalware, malicious, moderate confidence, score, Fragtor, Unsafe, Vjrn, Attribute, HighConfidence, Artemis, MalwareX, Generic@AI, RDMK, cmRtazoLjQ37ilTzT+yJtNLNQXln, moderate, Detected, ai score=83, PossibleThreat, ZelphiF, 0G0@auybkleb, Chgt, Static AI, Suspicious PE, MxResIcn, confidence)
md5 b90b8f1b397bcaeb8ead207d5d9af8e4
sha256 7b04123c12624c5861df853aebebc1261279624b1ddd28ce6e8585ab61669421
ssdeep 12288:SSSL5qBOqq+k3IFZYE/5wGL4sE+J5Pk9+7hykPcl1X/wDl4d6P0:S1VqEIkIwwpm9+1yOcl9S4d
imphash 66b2d95d12ea3f85fd5ebe484f5744f7
impfuzzy 192:f3ufG1aBbuuArSUvK9aqooqE6pCPbOQadO:f3x1yAA9ooPbOQt
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 41 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (7cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Network_Downloader File Downloader binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4bd17c DeleteCriticalSection
 0x4bd180 LeaveCriticalSection
 0x4bd184 EnterCriticalSection
 0x4bd188 InitializeCriticalSection
 0x4bd18c VirtualFree
 0x4bd190 VirtualAlloc
 0x4bd194 LocalFree
 0x4bd198 LocalAlloc
 0x4bd19c GetVersion
 0x4bd1a0 GetCurrentThreadId
 0x4bd1a4 InterlockedDecrement
 0x4bd1a8 InterlockedIncrement
 0x4bd1ac VirtualQuery
 0x4bd1b0 WideCharToMultiByte
 0x4bd1b4 MultiByteToWideChar
 0x4bd1b8 lstrlenA
 0x4bd1bc lstrcpynA
 0x4bd1c0 LoadLibraryExA
 0x4bd1c4 GetThreadLocale
 0x4bd1c8 GetStartupInfoA
 0x4bd1cc GetProcAddress
 0x4bd1d0 GetModuleHandleA
 0x4bd1d4 GetModuleFileNameA
 0x4bd1d8 GetLocaleInfoA
 0x4bd1dc GetCommandLineA
 0x4bd1e0 FreeLibrary
 0x4bd1e4 FindFirstFileA
 0x4bd1e8 FindClose
 0x4bd1ec ExitProcess
 0x4bd1f0 ExitThread
 0x4bd1f4 CreateThread
 0x4bd1f8 WriteFile
 0x4bd1fc UnhandledExceptionFilter
 0x4bd200 RtlUnwind
 0x4bd204 RaiseException
 0x4bd208 GetStdHandle
user32.dll
 0x4bd210 GetKeyboardType
 0x4bd214 LoadStringA
 0x4bd218 MessageBoxA
 0x4bd21c CharNextA
advapi32.dll
 0x4bd224 RegQueryValueExA
 0x4bd228 RegOpenKeyExA
 0x4bd22c RegCloseKey
oleaut32.dll
 0x4bd234 SysFreeString
 0x4bd238 SysReAllocStringLen
 0x4bd23c SysAllocStringLen
kernel32.dll
 0x4bd244 TlsSetValue
 0x4bd248 TlsGetValue
 0x4bd24c LocalAlloc
 0x4bd250 GetModuleHandleA
advapi32.dll
 0x4bd258 RegSetValueExA
 0x4bd25c RegQueryValueExA
 0x4bd260 RegQueryValueA
 0x4bd264 RegOpenKeyExA
 0x4bd268 RegFlushKey
 0x4bd26c RegCreateKeyExA
 0x4bd270 RegCloseKey
kernel32.dll
 0x4bd278 lstrcpyA
 0x4bd27c WriteFile
 0x4bd280 WinExec
 0x4bd284 WaitForSingleObject
 0x4bd288 VirtualQuery
 0x4bd28c VirtualAlloc
 0x4bd290 Sleep
 0x4bd294 SizeofResource
 0x4bd298 SetThreadLocale
 0x4bd29c SetFilePointer
 0x4bd2a0 SetEvent
 0x4bd2a4 SetErrorMode
 0x4bd2a8 SetEndOfFile
 0x4bd2ac ResumeThread
 0x4bd2b0 ResetEvent
 0x4bd2b4 ReadFile
 0x4bd2b8 MultiByteToWideChar
 0x4bd2bc MulDiv
 0x4bd2c0 LockResource
 0x4bd2c4 LoadResource
 0x4bd2c8 LoadLibraryA
 0x4bd2cc LeaveCriticalSection
 0x4bd2d0 InitializeCriticalSection
 0x4bd2d4 GlobalUnlock
 0x4bd2d8 GlobalReAlloc
 0x4bd2dc GlobalHandle
 0x4bd2e0 GlobalLock
 0x4bd2e4 GlobalFree
 0x4bd2e8 GlobalFindAtomA
 0x4bd2ec GlobalDeleteAtom
 0x4bd2f0 GlobalAlloc
 0x4bd2f4 GlobalAddAtomA
 0x4bd2f8 GetVersionExA
 0x4bd2fc GetVersion
 0x4bd300 GetTimeZoneInformation
 0x4bd304 GetTickCount
 0x4bd308 GetThreadLocale
 0x4bd30c GetTempPathA
 0x4bd310 GetSystemInfo
 0x4bd314 GetStringTypeExA
 0x4bd318 GetStdHandle
 0x4bd31c GetProcAddress
 0x4bd320 GetModuleHandleA
 0x4bd324 GetModuleFileNameA
 0x4bd328 GetLocaleInfoA
 0x4bd32c GetLocalTime
 0x4bd330 GetLastError
 0x4bd334 GetFullPathNameA
 0x4bd338 GetFileSize
 0x4bd33c GetExitCodeThread
 0x4bd340 GetDiskFreeSpaceA
 0x4bd344 GetDateFormatA
 0x4bd348 GetCurrentThreadId
 0x4bd34c GetCurrentProcessId
 0x4bd350 GetCPInfo
 0x4bd354 GetACP
 0x4bd358 FreeResource
 0x4bd35c InterlockedIncrement
 0x4bd360 InterlockedExchange
 0x4bd364 InterlockedDecrement
 0x4bd368 FreeLibrary
 0x4bd36c FormatMessageA
 0x4bd370 FindResourceA
 0x4bd374 FindFirstFileA
 0x4bd378 FindClose
 0x4bd37c FileTimeToLocalFileTime
 0x4bd380 FileTimeToDosDateTime
 0x4bd384 EnumCalendarInfoA
 0x4bd388 EnterCriticalSection
 0x4bd38c DeleteCriticalSection
 0x4bd390 CreateThread
 0x4bd394 CreateFileA
 0x4bd398 CreateEventA
 0x4bd39c CompareStringA
 0x4bd3a0 CloseHandle
version.dll
 0x4bd3a8 VerQueryValueA
 0x4bd3ac GetFileVersionInfoSizeA
 0x4bd3b0 GetFileVersionInfoA
gdi32.dll
 0x4bd3b8 UnrealizeObject
 0x4bd3bc StretchBlt
 0x4bd3c0 SetWindowOrgEx
 0x4bd3c4 SetViewportOrgEx
 0x4bd3c8 SetTextColor
 0x4bd3cc SetStretchBltMode
 0x4bd3d0 SetROP2
 0x4bd3d4 SetPixel
 0x4bd3d8 SetDIBColorTable
 0x4bd3dc SetBrushOrgEx
 0x4bd3e0 SetBkMode
 0x4bd3e4 SetBkColor
 0x4bd3e8 SelectPalette
 0x4bd3ec SelectObject
 0x4bd3f0 SaveDC
 0x4bd3f4 RestoreDC
 0x4bd3f8 RectVisible
 0x4bd3fc RealizePalette
 0x4bd400 PatBlt
 0x4bd404 MoveToEx
 0x4bd408 MaskBlt
 0x4bd40c LineTo
 0x4bd410 IntersectClipRect
 0x4bd414 GetWindowOrgEx
 0x4bd418 GetTextMetricsA
 0x4bd41c GetTextExtentPoint32A
 0x4bd420 GetSystemPaletteEntries
 0x4bd424 GetStockObject
 0x4bd428 GetPixel
 0x4bd42c GetPaletteEntries
 0x4bd430 GetObjectA
 0x4bd434 GetDeviceCaps
 0x4bd438 GetDIBits
 0x4bd43c GetDIBColorTable
 0x4bd440 GetDCOrgEx
 0x4bd444 GetCurrentPositionEx
 0x4bd448 GetClipBox
 0x4bd44c GetBrushOrgEx
 0x4bd450 GetBitmapBits
 0x4bd454 ExcludeClipRect
 0x4bd458 DeleteObject
 0x4bd45c DeleteDC
 0x4bd460 CreateSolidBrush
 0x4bd464 CreatePenIndirect
 0x4bd468 CreatePalette
 0x4bd46c CreateHalftonePalette
 0x4bd470 CreateFontIndirectA
 0x4bd474 CreateDIBitmap
 0x4bd478 CreateDIBSection
 0x4bd47c CreateCompatibleDC
 0x4bd480 CreateCompatibleBitmap
 0x4bd484 CreateBrushIndirect
 0x4bd488 CreateBitmap
 0x4bd48c BitBlt
user32.dll
 0x4bd494 CreateWindowExA
 0x4bd498 WindowFromPoint
 0x4bd49c WinHelpA
 0x4bd4a0 WaitMessage
 0x4bd4a4 UpdateWindow
 0x4bd4a8 UnregisterClassA
 0x4bd4ac UnhookWindowsHookEx
 0x4bd4b0 TranslateMessage
 0x4bd4b4 TranslateMDISysAccel
 0x4bd4b8 TrackPopupMenu
 0x4bd4bc SystemParametersInfoA
 0x4bd4c0 ShowWindow
 0x4bd4c4 ShowScrollBar
 0x4bd4c8 ShowOwnedPopups
 0x4bd4cc ShowCursor
 0x4bd4d0 SetWindowsHookExA
 0x4bd4d4 SetWindowTextA
 0x4bd4d8 SetWindowPos
 0x4bd4dc SetWindowPlacement
 0x4bd4e0 SetWindowLongA
 0x4bd4e4 SetTimer
 0x4bd4e8 SetScrollRange
 0x4bd4ec SetScrollPos
 0x4bd4f0 SetScrollInfo
 0x4bd4f4 SetRect
 0x4bd4f8 SetPropA
 0x4bd4fc SetParent
 0x4bd500 SetMenuItemInfoA
 0x4bd504 SetMenu
 0x4bd508 SetForegroundWindow
 0x4bd50c SetFocus
 0x4bd510 SetCursor
 0x4bd514 SetClassLongA
 0x4bd518 SetCapture
 0x4bd51c SetActiveWindow
 0x4bd520 SendMessageA
 0x4bd524 ScrollWindow
 0x4bd528 ScreenToClient
 0x4bd52c RemovePropA
 0x4bd530 RemoveMenu
 0x4bd534 ReleaseDC
 0x4bd538 ReleaseCapture
 0x4bd53c RegisterWindowMessageA
 0x4bd540 RegisterClipboardFormatA
 0x4bd544 RegisterClassA
 0x4bd548 RedrawWindow
 0x4bd54c PtInRect
 0x4bd550 PostQuitMessage
 0x4bd554 PostMessageA
 0x4bd558 PeekMessageA
 0x4bd55c OffsetRect
 0x4bd560 OemToCharA
 0x4bd564 MsgWaitForMultipleObjects
 0x4bd568 MessageBoxA
 0x4bd56c MapWindowPoints
 0x4bd570 MapVirtualKeyA
 0x4bd574 LoadStringA
 0x4bd578 LoadKeyboardLayoutA
 0x4bd57c LoadIconA
 0x4bd580 LoadCursorA
 0x4bd584 LoadBitmapA
 0x4bd588 KillTimer
 0x4bd58c IsZoomed
 0x4bd590 IsWindowVisible
 0x4bd594 IsWindowEnabled
 0x4bd598 IsWindow
 0x4bd59c IsRectEmpty
 0x4bd5a0 IsIconic
 0x4bd5a4 IsDialogMessageA
 0x4bd5a8 IsChild
 0x4bd5ac InvalidateRect
 0x4bd5b0 IntersectRect
 0x4bd5b4 InsertMenuItemA
 0x4bd5b8 InsertMenuA
 0x4bd5bc InflateRect
 0x4bd5c0 GetWindowThreadProcessId
 0x4bd5c4 GetWindowTextA
 0x4bd5c8 GetWindowRect
 0x4bd5cc GetWindowPlacement
 0x4bd5d0 GetWindowLongA
 0x4bd5d4 GetWindowDC
 0x4bd5d8 GetTopWindow
 0x4bd5dc GetSystemMetrics
 0x4bd5e0 GetSystemMenu
 0x4bd5e4 GetSysColorBrush
 0x4bd5e8 GetSysColor
 0x4bd5ec GetSubMenu
 0x4bd5f0 GetScrollRange
 0x4bd5f4 GetScrollPos
 0x4bd5f8 GetScrollInfo
 0x4bd5fc GetPropA
 0x4bd600 GetParent
 0x4bd604 GetWindow
 0x4bd608 GetMenuStringA
 0x4bd60c GetMenuState
 0x4bd610 GetMenuItemInfoA
 0x4bd614 GetMenuItemID
 0x4bd618 GetMenuItemCount
 0x4bd61c GetMenu
 0x4bd620 GetLastActivePopup
 0x4bd624 GetKeyboardState
 0x4bd628 GetKeyboardLayoutList
 0x4bd62c GetKeyboardLayout
 0x4bd630 GetKeyState
 0x4bd634 GetKeyNameTextA
 0x4bd638 GetIconInfo
 0x4bd63c GetForegroundWindow
 0x4bd640 GetFocus
 0x4bd644 GetDesktopWindow
 0x4bd648 GetDCEx
 0x4bd64c GetDC
 0x4bd650 GetCursorPos
 0x4bd654 GetCursor
 0x4bd658 GetClientRect
 0x4bd65c GetClassNameA
 0x4bd660 GetClassInfoA
 0x4bd664 GetCapture
 0x4bd668 GetActiveWindow
 0x4bd66c FrameRect
 0x4bd670 FindWindowA
 0x4bd674 FillRect
 0x4bd678 EqualRect
 0x4bd67c EnumWindows
 0x4bd680 EnumThreadWindows
 0x4bd684 EndPaint
 0x4bd688 EnableWindow
 0x4bd68c EnableScrollBar
 0x4bd690 EnableMenuItem
 0x4bd694 DrawTextA
 0x4bd698 DrawMenuBar
 0x4bd69c DrawIconEx
 0x4bd6a0 DrawIcon
 0x4bd6a4 DrawFrameControl
 0x4bd6a8 DrawEdge
 0x4bd6ac DispatchMessageA
 0x4bd6b0 DestroyWindow
 0x4bd6b4 DestroyMenu
 0x4bd6b8 DestroyIcon
 0x4bd6bc DestroyCursor
 0x4bd6c0 DeleteMenu
 0x4bd6c4 DefWindowProcA
 0x4bd6c8 DefMDIChildProcA
 0x4bd6cc DefFrameProcA
 0x4bd6d0 CreatePopupMenu
 0x4bd6d4 CreateMenu
 0x4bd6d8 CreateIcon
 0x4bd6dc ClientToScreen
 0x4bd6e0 CheckMenuItem
 0x4bd6e4 CallWindowProcA
 0x4bd6e8 CallNextHookEx
 0x4bd6ec BeginPaint
 0x4bd6f0 CharNextA
 0x4bd6f4 CharLowerA
 0x4bd6f8 CharUpperBuffA
 0x4bd6fc CharToOemA
 0x4bd700 AdjustWindowRectEx
 0x4bd704 ActivateKeyboardLayout
ole32.dll
 0x4bd70c CoTaskMemFree
 0x4bd710 StringFromCLSID
kernel32.dll
 0x4bd718 Sleep
oleaut32.dll
 0x4bd720 SafeArrayPtrOfIndex
 0x4bd724 SafeArrayPutElement
 0x4bd728 SafeArrayGetElement
 0x4bd72c SafeArrayUnaccessData
 0x4bd730 SafeArrayAccessData
 0x4bd734 SafeArrayGetUBound
 0x4bd738 SafeArrayGetLBound
 0x4bd73c SafeArrayCreate
 0x4bd740 VariantChangeType
 0x4bd744 VariantCopyInd
 0x4bd748 VariantCopy
 0x4bd74c VariantClear
 0x4bd750 VariantInit
ole32.dll
 0x4bd758 CoCreateInstance
 0x4bd75c CoGetMalloc
 0x4bd760 CoUninitialize
 0x4bd764 CoInitialize
 0x4bd768 IsEqualGUID
oleaut32.dll
 0x4bd770 CreateErrorInfo
 0x4bd774 GetErrorInfo
 0x4bd778 SetErrorInfo
 0x4bd77c SafeArrayCopy
 0x4bd780 SafeArrayUnaccessData
 0x4bd784 SafeArrayAccessData
 0x4bd788 SafeArrayGetUBound
 0x4bd78c SafeArrayDestroy
 0x4bd790 SafeArrayCreate
 0x4bd794 SysFreeString
comctl32.dll
 0x4bd79c ImageList_SetIconSize
 0x4bd7a0 ImageList_GetIconSize
 0x4bd7a4 ImageList_Write
 0x4bd7a8 ImageList_Read
 0x4bd7ac ImageList_GetDragImage
 0x4bd7b0 ImageList_DragShowNolock
 0x4bd7b4 ImageList_SetDragCursorImage
 0x4bd7b8 ImageList_DragMove
 0x4bd7bc ImageList_DragLeave
 0x4bd7c0 ImageList_DragEnter
 0x4bd7c4 ImageList_EndDrag
 0x4bd7c8 ImageList_BeginDrag
 0x4bd7cc ImageList_Remove
 0x4bd7d0 ImageList_DrawEx
 0x4bd7d4 ImageList_Draw
 0x4bd7d8 ImageList_GetBkColor
 0x4bd7dc ImageList_SetBkColor
 0x4bd7e0 ImageList_ReplaceIcon
 0x4bd7e4 ImageList_Add
 0x4bd7e8 ImageList_GetImageCount
 0x4bd7ec ImageList_Destroy
 0x4bd7f0 ImageList_Create
wininet.dll
 0x4bd7f8 DeleteUrlCacheEntry
URLMON.DLL
 0x4bd800 URLDownloadToFileA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure