Report - IP%E8%87%AA%E5%8A%A8%E6%8B%A8%E5%8F%B7%E7%BB%9F%E8%AE%A1.exe

Generic Malware Malicious Library ASPack UPX PE File DllRegisterServer dll PE32 OS Processor Check
ScreenShot
Created 2024.06.20 09:28 Machine s1_win7_x6401
Filename IP%E8%87%AA%E5%8A%A8%E6%8B%A8%E5%8F%B7%E7%BB%9F%E8%AE%A1.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
8
Behavior Score
2.2
ZERO API file : mailcious
VT API (file) 26 detected (AIDetectMalware, FlyStudio, Malicious, score, GenericRXAE, Unsafe, Attribute, HighConfidence, high confidence, high, Wacatac, ZexaF, XqW@au41Cnob, R002H0CFJ24, Static AI, Malicious PE, MxResIcn, FlyApplication, confidence)
md5 ed95ed22864405ca79a7910d5c2a527d
sha256 fb7502095d3146cd418843f5b1fb4ad195c4025598a18b206ca196ef383e0e9c
ssdeep 12288:HVAdYJCTjKsEs3iV3kxw1JyVqdVAO4X3oeW3VRsyqzVE5VQNZImgPtwZOI2cGGGo:HVswao73rQNZ9gPJI2wb
imphash 228bdf5427a9d49578ccd708e66d64ea
impfuzzy 192:oPeHFpPC9AU8TT4zSfEsKRcRcScaKSZ5QgE:3FZVT6EpVE
  Network IP location

Signature (6cnts)

Level Description
warning File has been identified by 26 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
info Checks amount of memory in system
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (8cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch ASPack_Zero ASPack packed file binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x484170 lstrcmpiA
 0x484174 SetEndOfFile
 0x484178 UnlockFile
 0x48417c LockFile
 0x484180 FlushFileBuffers
 0x484184 SetFilePointer
 0x484188 GetCurrentProcess
 0x48418c DuplicateHandle
 0x484190 lstrcpynA
 0x484194 SetLastError
 0x484198 FileTimeToLocalFileTime
 0x48419c FileTimeToSystemTime
 0x4841a0 LocalFree
 0x4841a4 MultiByteToWideChar
 0x4841a8 WideCharToMultiByte
 0x4841ac InterlockedDecrement
 0x4841b0 TerminateThread
 0x4841b4 InterlockedExchange
 0x4841b8 SetStdHandle
 0x4841bc IsBadCodePtr
 0x4841c0 IsBadReadPtr
 0x4841c4 CompareStringW
 0x4841c8 CompareStringA
 0x4841cc SetUnhandledExceptionFilter
 0x4841d0 GetStringTypeW
 0x4841d4 GetStringTypeA
 0x4841d8 IsBadWritePtr
 0x4841dc VirtualAlloc
 0x4841e0 LCMapStringW
 0x4841e4 LCMapStringA
 0x4841e8 SetEnvironmentVariableA
 0x4841ec VirtualFree
 0x4841f0 HeapCreate
 0x4841f4 HeapDestroy
 0x4841f8 GetEnvironmentVariableA
 0x4841fc GetFileType
 0x484200 GetStdHandle
 0x484204 SetHandleCount
 0x484208 GetEnvironmentStringsW
 0x48420c GetEnvironmentStrings
 0x484210 FreeEnvironmentStringsW
 0x484214 FreeEnvironmentStringsA
 0x484218 UnhandledExceptionFilter
 0x48421c GetACP
 0x484220 CreateSemaphoreA
 0x484224 ResumeThread
 0x484228 ReleaseSemaphore
 0x48422c EnterCriticalSection
 0x484230 LeaveCriticalSection
 0x484234 GetProfileStringA
 0x484238 WriteFile
 0x48423c ReadFile
 0x484240 GetLastError
 0x484244 WaitForMultipleObjects
 0x484248 CreateFileA
 0x48424c SetEvent
 0x484250 FindResourceA
 0x484254 LoadResource
 0x484258 LockResource
 0x48425c GetModuleFileNameA
 0x484260 GetCurrentThreadId
 0x484264 ExitProcess
 0x484268 GlobalSize
 0x48426c GlobalFree
 0x484270 DeleteCriticalSection
 0x484274 InitializeCriticalSection
 0x484278 lstrcatA
 0x48427c WinExec
 0x484280 lstrcpyA
 0x484284 FindNextFileA
 0x484288 GlobalReAlloc
 0x48428c HeapFree
 0x484290 HeapReAlloc
 0x484294 GetProcessHeap
 0x484298 HeapAlloc
 0x48429c GetFullPathNameA
 0x4842a0 FreeLibrary
 0x4842a4 LoadLibraryA
 0x4842a8 lstrlenA
 0x4842ac GetVersionExA
 0x4842b0 WritePrivateProfileStringA
 0x4842b4 CreateThread
 0x4842b8 CreateEventA
 0x4842bc Sleep
 0x4842c0 GlobalAlloc
 0x4842c4 GlobalLock
 0x4842c8 GlobalUnlock
 0x4842cc FindFirstFileA
 0x4842d0 FindClose
 0x4842d4 HeapSize
 0x4842d8 TerminateProcess
 0x4842dc GetLocalTime
 0x4842e0 GetSystemTime
 0x4842e4 GetTimeZoneInformation
 0x4842e8 RaiseException
 0x4842ec RtlUnwind
 0x4842f0 GetStartupInfoA
 0x4842f4 GetOEMCP
 0x4842f8 GetCPInfo
 0x4842fc GetProcessVersion
 0x484300 SetErrorMode
 0x484304 GlobalFlags
 0x484308 GetCurrentThread
 0x48430c GetFileTime
 0x484310 GetFileSize
 0x484314 TlsGetValue
 0x484318 LocalReAlloc
 0x48431c TlsSetValue
 0x484320 TlsFree
 0x484324 GetFileAttributesA
 0x484328 SetCurrentDirectoryA
 0x48432c GlobalHandle
 0x484330 TlsAlloc
 0x484334 LocalAlloc
 0x484338 lstrcmpA
 0x48433c GetVersion
 0x484340 GlobalGetAtomNameA
 0x484344 GlobalAddAtomA
 0x484348 GlobalFindAtomA
 0x48434c GlobalDeleteAtom
 0x484350 GetVolumeInformationA
 0x484354 GetModuleHandleA
 0x484358 GetProcAddress
 0x48435c MulDiv
 0x484360 GetCommandLineA
 0x484364 GetTickCount
 0x484368 CreateProcessA
 0x48436c WaitForSingleObject
 0x484370 CloseHandle
 0x484374 InterlockedIncrement
USER32.dll
 0x484398 OpenClipboard
 0x48439c SetClipboardData
 0x4843a0 EmptyClipboard
 0x4843a4 GetSystemMetrics
 0x4843a8 GetCursorPos
 0x4843ac MessageBoxA
 0x4843b0 SetWindowPos
 0x4843b4 SendMessageA
 0x4843b8 DestroyCursor
 0x4843bc SetParent
 0x4843c0 GetClipboardData
 0x4843c4 PostMessageA
 0x4843c8 GetTopWindow
 0x4843cc GetParent
 0x4843d0 GetFocus
 0x4843d4 GetClientRect
 0x4843d8 InvalidateRect
 0x4843dc ValidateRect
 0x4843e0 UpdateWindow
 0x4843e4 CloseClipboard
 0x4843e8 wsprintfA
 0x4843ec EqualRect
 0x4843f0 GetWindowRect
 0x4843f4 SetForegroundWindow
 0x4843f8 WaitForInputIdle
 0x4843fc IsWindow
 0x484400 DestroyMenu
 0x484404 IsChild
 0x484408 ReleaseDC
 0x48440c IsRectEmpty
 0x484410 FillRect
 0x484414 GetDC
 0x484418 SetCursor
 0x48441c LoadCursorA
 0x484420 SetCursorPos
 0x484424 SetActiveWindow
 0x484428 GetSysColor
 0x48442c SetWindowLongA
 0x484430 GetWindowLongA
 0x484434 RedrawWindow
 0x484438 EnableWindow
 0x48443c IsWindowVisible
 0x484440 OffsetRect
 0x484444 PtInRect
 0x484448 DestroyIcon
 0x48444c IntersectRect
 0x484450 SetRect
 0x484454 InflateRect
 0x484458 SetScrollPos
 0x48445c SetScrollRange
 0x484460 GetScrollRange
 0x484464 SetCapture
 0x484468 SystemParametersInfoA
 0x48446c LoadIconA
 0x484470 TranslateMessage
 0x484474 DrawFrameControl
 0x484478 DrawEdge
 0x48447c DrawFocusRect
 0x484480 WindowFromPoint
 0x484484 GetMessageA
 0x484488 DispatchMessageA
 0x48448c SetRectEmpty
 0x484490 RegisterClipboardFormatA
 0x484494 CreateIconFromResourceEx
 0x484498 CreateIconFromResource
 0x48449c DrawIconEx
 0x4844a0 CreatePopupMenu
 0x4844a4 AppendMenuA
 0x4844a8 ModifyMenuA
 0x4844ac CreateMenu
 0x4844b0 CreateAcceleratorTableA
 0x4844b4 GetDlgCtrlID
 0x4844b8 GetSubMenu
 0x4844bc EnableMenuItem
 0x4844c0 ClientToScreen
 0x4844c4 EnumDisplaySettingsA
 0x4844c8 LoadImageA
 0x4844cc ShowWindow
 0x4844d0 IsWindowEnabled
 0x4844d4 TranslateAcceleratorA
 0x4844d8 GetKeyState
 0x4844dc CopyAcceleratorTableA
 0x4844e0 PostQuitMessage
 0x4844e4 IsZoomed
 0x4844e8 GetSystemMenu
 0x4844ec GetWindowTextA
 0x4844f0 GetWindowTextLengthA
 0x4844f4 CharUpperA
 0x4844f8 GetWindowDC
 0x4844fc BeginPaint
 0x484500 EndPaint
 0x484504 TabbedTextOutA
 0x484508 DrawTextA
 0x48450c GrayStringA
 0x484510 GetDlgItem
 0x484514 DestroyWindow
 0x484518 CreateDialogIndirectParamA
 0x48451c EndDialog
 0x484520 GetNextDlgTabItem
 0x484524 GetWindowPlacement
 0x484528 RegisterWindowMessageA
 0x48452c GetForegroundWindow
 0x484530 GetLastActivePopup
 0x484534 GetMessageTime
 0x484538 RemovePropA
 0x48453c CallWindowProcA
 0x484540 GetPropA
 0x484544 UnhookWindowsHookEx
 0x484548 SetPropA
 0x48454c GetClassLongA
 0x484550 CallNextHookEx
 0x484554 SetWindowsHookExA
 0x484558 CreateWindowExA
 0x48455c GetMenuItemID
 0x484560 GetMenuItemCount
 0x484564 RegisterClassA
 0x484568 GetScrollPos
 0x48456c UnregisterClassA
 0x484570 AdjustWindowRectEx
 0x484574 MapWindowPoints
 0x484578 SendDlgItemMessageA
 0x48457c ScrollWindowEx
 0x484580 IsDialogMessageA
 0x484584 SetWindowTextA
 0x484588 MoveWindow
 0x48458c CheckMenuItem
 0x484590 SetMenuItemBitmaps
 0x484594 GetMenuState
 0x484598 GetMenuCheckMarkDimensions
 0x48459c GetClassNameA
 0x4845a0 GetDesktopWindow
 0x4845a4 LoadStringA
 0x4845a8 GetSysColorBrush
 0x4845ac DeleteMenu
 0x4845b0 GetClassInfoA
 0x4845b4 DefWindowProcA
 0x4845b8 GetMenu
 0x4845bc SetMenu
 0x4845c0 PeekMessageA
 0x4845c4 IsIconic
 0x4845c8 SetFocus
 0x4845cc GetActiveWindow
 0x4845d0 GetWindow
 0x4845d4 DestroyAcceleratorTable
 0x4845d8 SetWindowRgn
 0x4845dc GetMessagePos
 0x4845e0 ScreenToClient
 0x4845e4 ChildWindowFromPointEx
 0x4845e8 CopyRect
 0x4845ec LoadBitmapA
 0x4845f0 WinHelpA
 0x4845f4 KillTimer
 0x4845f8 SetTimer
 0x4845fc ReleaseCapture
 0x484600 GetCapture
GDI32.dll
 0x484024 SetStretchBltMode
 0x484028 GetClipRgn
 0x48402c CreatePolygonRgn
 0x484030 SelectClipRgn
 0x484034 DeleteObject
 0x484038 CreateDIBitmap
 0x48403c GetSystemPaletteEntries
 0x484040 CreatePalette
 0x484044 StretchBlt
 0x484048 SelectPalette
 0x48404c RealizePalette
 0x484050 GetDIBits
 0x484054 GetWindowExtEx
 0x484058 GetViewportOrgEx
 0x48405c GetWindowOrgEx
 0x484060 BeginPath
 0x484064 EndPath
 0x484068 PathToRegion
 0x48406c CreateEllipticRgn
 0x484070 CreateRoundRectRgn
 0x484074 GetTextColor
 0x484078 GetBkMode
 0x48407c GetBkColor
 0x484080 GetROP2
 0x484084 GetStretchBltMode
 0x484088 GetPolyFillMode
 0x48408c CreateCompatibleBitmap
 0x484090 CreateDCA
 0x484094 CreateBitmap
 0x484098 SelectObject
 0x48409c GetObjectA
 0x4840a0 PatBlt
 0x4840a4 FillRgn
 0x4840a8 CreateRectRgn
 0x4840ac CombineRgn
 0x4840b0 CreateSolidBrush
 0x4840b4 GetStockObject
 0x4840b8 CreateFontIndirectA
 0x4840bc EndPage
 0x4840c0 EndDoc
 0x4840c4 DeleteDC
 0x4840c8 StartDocA
 0x4840cc StartPage
 0x4840d0 BitBlt
 0x4840d4 CreateCompatibleDC
 0x4840d8 Ellipse
 0x4840dc Rectangle
 0x4840e0 LPtoDP
 0x4840e4 DPtoLP
 0x4840e8 GetCurrentObject
 0x4840ec RoundRect
 0x4840f0 GetTextExtentPoint32A
 0x4840f4 GetDeviceCaps
 0x4840f8 SaveDC
 0x4840fc RestoreDC
 0x484100 SetBkMode
 0x484104 SetPolyFillMode
 0x484108 SetROP2
 0x48410c SetTextColor
 0x484110 SetMapMode
 0x484114 SetViewportOrgEx
 0x484118 OffsetViewportOrgEx
 0x48411c SetViewportExtEx
 0x484120 ScaleViewportExtEx
 0x484124 SetWindowOrgEx
 0x484128 SetWindowExtEx
 0x48412c ScaleWindowExtEx
 0x484130 GetClipBox
 0x484134 ExcludeClipRect
 0x484138 MoveToEx
 0x48413c LineTo
 0x484140 CreateRectRgnIndirect
 0x484144 SetBkColor
 0x484148 CreatePen
 0x48414c GetTextMetricsA
 0x484150 Escape
 0x484154 ExtTextOutA
 0x484158 TextOutA
 0x48415c RectVisible
 0x484160 PtVisible
 0x484164 GetViewportExtEx
 0x484168 ExtSelectClipRgn
WINMM.dll
 0x484608 midiStreamRestart
 0x48460c midiStreamClose
 0x484610 midiOutReset
 0x484614 midiStreamStop
 0x484618 midiStreamOut
 0x48461c midiOutPrepareHeader
 0x484620 midiStreamProperty
 0x484624 midiStreamOpen
 0x484628 midiOutUnprepareHeader
 0x48462c waveOutOpen
 0x484630 waveOutGetNumDevs
 0x484634 waveOutClose
 0x484638 waveOutReset
 0x48463c waveOutPause
 0x484640 waveOutWrite
 0x484644 waveOutPrepareHeader
 0x484648 waveOutUnprepareHeader
WINSPOOL.DRV
 0x484650 ClosePrinter
 0x484654 DocumentPropertiesA
 0x484658 OpenPrinterA
ADVAPI32.dll
 0x484000 RegCloseKey
 0x484004 RegOpenKeyExA
 0x484008 RegSetValueExA
 0x48400c RegQueryValueA
 0x484010 RegCreateKeyExA
SHELL32.dll
 0x48438c ShellExecuteA
 0x484390 Shell_NotifyIconA
ole32.dll
 0x48469c OleUninitialize
 0x4846a0 CLSIDFromString
 0x4846a4 OleInitialize
OLEAUT32.dll
 0x48437c UnRegisterTypeLib
 0x484380 RegisterTypeLib
 0x484384 LoadTypeLib
COMCTL32.dll
 0x484018 ImageList_Destroy
 0x48401c None
WS2_32.dll
 0x484660 getpeername
 0x484664 accept
 0x484668 ioctlsocket
 0x48466c recvfrom
 0x484670 recv
 0x484674 WSAAsyncSelect
 0x484678 closesocket
 0x48467c WSACleanup
 0x484680 inet_ntoa
comdlg32.dll
 0x484688 GetFileTitleA
 0x48468c GetSaveFileNameA
 0x484690 GetOpenFileNameA
 0x484694 ChooseColorA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure