Report - 64.exe

Malicious Library Malicious Packer UPX PE File .NET EXE PE32
ScreenShot
Created 2024.07.05 22:38 Machine s1_win7_x6401
Filename 64.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
3
Behavior Score
4.8
ZERO API file : malware
VT API (file) 48 detected (Common, BrowserPassView, malicious, high confidence, Artemis, Unsafe, yq0@kuOAM9nO, Save, Attribute, HighConfidence, PSWTool, WebBrowserPassView, I potentially unsafe, Tool, Exnet, PassView, kmdjkq, HackTool, CLASSIC, VSNW14E24, Browser Password Viewer, MSNPass, Detected, ai score=70, PassShow, ZemsilF, zm0@au, 1hen, Static AI, Malicious PE, susgen, confidence)
md5 3e682955546fe3b6b1296a509ff80f65
sha256 96dd5b0abe337b23d4caa746a29c196af3508fa103d16a1f180e13730cdb773b
ssdeep 6144:cDGeTb5E+Z7EAXrvPRIxK0zBL/TIDC2dL3RltnfoBglM7zMUdsvk3zhAt76zkiz4:cDGelZ7FXrPy4ix+LBltsgK7zXIqbkT
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (12cnts)

Level Description
danger File has been identified by 48 AntiVirus engines on VirusTotal as malicious
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice Searches running processes potentially to identify processes for sandbox evasion
notice Steals private information from local Internet browsers
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info This executable has a PDB path

Rules (11cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (download)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x402000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure