popup

Report - OPERATIONAL_MOAT.exe

Malicious Packer UPX PE File PE64
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.07.03 18:43 Machine s1_win7_x6401
Filename OPERATIONAL_MOAT.exe
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
AI Score Not founds Behavior Score
4.4
ZERO API file : clean
VT API (file) 45 detected (AIDetectMalware, Sliver, Malicious, score, Artemis, Unsafe, Marte, HackTool, Implant, 64bit, uwccg, Attribute, HighConfidence, a variant of WinGo, MalwareX, MalGO, SuspGolang, CLASSIC, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=88, ABTrojan, NRPK, Jmnw, Static AI, Malicious PE, susgen, confidence, 100%)
md5 fe630e60d070ead8f5421d4006872435
sha256 de36571b24c40b3f03ec6dcdd8a6270b117ba3fd938f5df504417970049d867a
ssdeep 98304:a3JwoEktISlgYhMmxmur2oNxtLUNem6TBraPCwLQ0EV3E4NLIq:aqaNxmur2oztLUNeDZmCwLkHLIq
imphash f0ea7b7844bbc5bfa9bb32efdcea957c
impfuzzy 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP
  Network IP location

Signature (6cnts)

Level Description
danger Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)
danger File has been identified by 45 AntiVirus engines on VirusTotal as malicious
watch Communicates with host for which no DNS query was performed
watch Detects the presence of Wine emulator
info Checks if process is being debugged by a debugger
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
185.208.158.176
whois
US Simple Carrier LLC 185.208.158.176 malware

Suricata ids

ET DROP Spamhaus DROP Listed Traffic Inbound group 33

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x12ac040 WriteFile
 0x12ac048 WriteConsoleW
 0x12ac050 WaitForMultipleObjects
 0x12ac058 WaitForSingleObject
 0x12ac060 VirtualQuery
 0x12ac068 VirtualFree
 0x12ac070 VirtualAlloc
 0x12ac078 TlsAlloc
 0x12ac080 SwitchToThread
 0x12ac088 SuspendThread
 0x12ac090 SetWaitableTimer
 0x12ac098 SetUnhandledExceptionFilter
 0x12ac0a0 SetProcessPriorityBoost
 0x12ac0a8 SetEvent
 0x12ac0b0 SetErrorMode
 0x12ac0b8 SetConsoleCtrlHandler
 0x12ac0c0 ResumeThread
 0x12ac0c8 PostQueuedCompletionStatus
 0x12ac0d0 LoadLibraryA
 0x12ac0d8 LoadLibraryW
 0x12ac0e0 SetThreadContext
 0x12ac0e8 GetThreadContext
 0x12ac0f0 GetSystemInfo
 0x12ac0f8 GetSystemDirectoryA
 0x12ac100 GetStdHandle
 0x12ac108 GetQueuedCompletionStatusEx
 0x12ac110 GetProcessAffinityMask
 0x12ac118 GetProcAddress
 0x12ac120 GetEnvironmentStringsW
 0x12ac128 GetConsoleMode
 0x12ac130 FreeEnvironmentStringsW
 0x12ac138 ExitProcess
 0x12ac140 DuplicateHandle
 0x12ac148 CreateWaitableTimerExW
 0x12ac150 CreateThread
 0x12ac158 CreateIoCompletionPort
 0x12ac160 CreateFileA
 0x12ac168 CreateEventA
 0x12ac170 CloseHandle
 0x12ac178 AddVectoredExceptionHandler

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure