popup

Report - pic2.exe

UPX PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.06.25 07:55 Machine s1_win7_x6401
Filename pic2.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
6
 Behavior Score
1.6
ZERO API file : clean
VT API (file) 18 detected (AIDetectMalware, malicious, high confidence, score, Unsafe, Attribute, HighConfidence, VMProtect, BG suspicious, Sdum, Generic@AI, RDMK, cmRtazqNwNER12ofNRXvtXBxQRjY, high, Wacatac, MalPe, X2200, ZexaF, TI2@ayuRDF, BScope, LClipper, susgen)
md5 5f9be6e22310cc089a32fac1d037ced4
sha256 e03ad208cd03d80ab4c684abc5be5cc4bd492021288de2742a875c6e8f2e85fa
ssdeep 49152:95Ar0ZH/UbYLC+qsqaep9g7fjtSnXkiO08llBenVAJhv17/9EaRq1/SoCJ0k1yn:cIhJLya6IKnX8MnVGd15Eao/lA
imphash 8e037c5edb507011bc10ab16654e5d05
impfuzzy 6:oZ/KiwNbsKn6QgymvOYslJoZ/O4ErBJAEHGDW:oZCiwxrnfgQOZGJjA/DW
  Network IP location

Signature (4cnts)

Level Description
watch File has been identified by 18 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
notice The executable is likely packed with VMProtect
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (3cnts)

Level Name Description Collection
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x557000 ExitProcess
ole32.dll
 0x557008 CoCreateInstance
OLEAUT32.dll
 0x557010 SysAllocString
USER32.dll
 0x557018 CloseClipboard
GDI32.dll
 0x557020 BitBlt
KERNEL32.dll
 0x557028 HeapAlloc
 0x55702c HeapFree
 0x557030 ExitProcess
 0x557034 GetModuleHandleA
 0x557038 LoadLibraryA
 0x55703c GetProcAddress

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure