Report - num.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer Anti_VM PE File PE32 DLL OS Processor Check
ScreenShot
Created 2024.06.25 07:52 Machine s1_win7_x6403
Filename num.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
Behavior Score
11.0
ZERO API file : malware
VT API (file) 40 detected (AIDetectMalware, malicious, high confidence, score, Jaik, Unsafe, Save, Attribute, HighConfidence, Stealc, PWSX, ccmw, XPACK, Real Protect, high, Generic ML PUA, ai score=80, Wacatac, BScope, Probably Heur, ExeHeaderL, Static AI, Malicious PE, susgen, confidence)
md5 919db35f2bf4dad6dd23e16b68dbb205
sha256 99dfe8a4454f28c944e3c749150aecdaa97e19bcc5a9cf644a509b7eb1d4e50f
ssdeep 98304:z8Ho3wEF+ZSxV4CQrRZIfIM8R6nhYufLX6CL2VeUs:z8IqRSxi6dLqi
imphash 1a5b175c8374e57d652c524ac6f60456
impfuzzy 3:sUx2AEB/yVcn:nEBa2n
  Network IP location

Signature (24cnts)

Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
watch Checks the CPU name from registry
watch Checks the version of Bios
watch Collects information about installed applications
watch Communicates with host for which no DNS query was performed
watch Detects Virtual Machines through their custom firmware
watch Detects VMWare through the in instruction feature
watch Harvests credentials from local email clients
watch Harvests credentials from local FTP client softwares
notice Allocates read-write-execute memory (usually to unpack itself)
notice An executable file was downloaded by the process num.exe
notice Creates executable files on the filesystem
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Queries for potentially installed applications
notice Searches running processes potentially to identify processes for sandbox evasion
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Tries to locate where the browsers are installed

Rules (13cnts)

Level Name Description Collection
danger Win32_Trojan_Gen_1_0904B0_Zero Win32 Trojan Emotet binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch UPX_Zero UPX packed file binaries (download)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (9cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://85.28.47.4/69934896f997d5bb/freebl3.dll Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/nss3.dll Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/vcruntime140.dll Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/mozglue.dll Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/softokn3.dll Unknown 85.28.47.4 clean
http://85.28.47.4/920475a59bac849d.php Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/msvcp140.dll Unknown 85.28.47.4 clean
http://85.28.47.4/69934896f997d5bb/sqlite3.dll Unknown 85.28.47.4 clean
85.28.47.4 Unknown 85.28.47.4 clean

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x63c074 GetModuleHandleA
msvcrt.dll
 0x63c07c strncpy

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure