Report - msedge.exe

Generic Malware Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check
ScreenShot
Created 2024.08.18 10:17 Machine s1_win7_x6401
Filename msedge.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
3
Behavior Score
0.6
ZERO API file : clean
VT API (file)
md5 30e74327b4f7bc2e556ac0a6d8e02dd2
sha256 a63d7069ce90cd5d1341fa24585edbdcf7f559621159d6a4b84c402d1af9c19f
ssdeep 49152:f55DVDLwizDjSHLLn/G040/IBDsxVfZmsdTZCFbTah46V2av2y/Bu:dfcL5/IDpVG4so
imphash 8e72b0e81711028c9c16f77a62ce2245
impfuzzy 96:kWvehZXLJgHIS5BncYbvRGt7OkrxHSpxPGU/xNqEi9Gyc/iUXTXzX19X1KtogN4Y:kWva+oS5JbU7VlUiEWgjDF9Fa4Y
  Network IP location

Signature (3cnts)

Level Description
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (7cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

msedge_elf.dll
 0x1402db050 GetElfCommandLine
 0x1402db058 GetInstallDetailsPayload
 0x1402db060 IsBrowserProcess
 0x1402db068 IsExtensionPointDisableSet
 0x1402db070 SignalChromeElf
 0x1402db078 SignalInitializeCrashReporting
KERNEL32.dll
 0x1402db088 AcquireSRWLockExclusive
 0x1402db090 AddVectoredExceptionHandler
 0x1402db098 AssignProcessToJobObject
 0x1402db0a0 CloseHandle
 0x1402db0a8 CompareStringW
 0x1402db0b0 ConnectNamedPipe
 0x1402db0b8 CopyFileW
 0x1402db0c0 CreateDirectoryW
 0x1402db0c8 CreateEventW
 0x1402db0d0 CreateFileA
 0x1402db0d8 CreateFileMappingW
 0x1402db0e0 CreateFileW
 0x1402db0e8 CreateHardLinkW
 0x1402db0f0 CreateIoCompletionPort
 0x1402db0f8 CreateJobObjectW
 0x1402db100 CreateMutexW
 0x1402db108 CreateNamedPipeW
 0x1402db110 CreateProcessW
 0x1402db118 CreateRemoteThread
 0x1402db120 CreateSemaphoreW
 0x1402db128 CreateThread
 0x1402db130 CreateToolhelp32Snapshot
 0x1402db138 DebugBreak
 0x1402db140 DeleteCriticalSection
 0x1402db148 DeleteFileW
 0x1402db150 DeleteProcThreadAttributeList
 0x1402db158 DisconnectNamedPipe
 0x1402db160 DuplicateHandle
 0x1402db168 EncodePointer
 0x1402db170 EnterCriticalSection
 0x1402db178 EnumSystemLocalesEx
 0x1402db180 EnumSystemLocalesW
 0x1402db188 ExitProcess
 0x1402db190 ExitThread
 0x1402db198 ExpandEnvironmentStringsW
 0x1402db1a0 FileTimeToSystemTime
 0x1402db1a8 FindClose
 0x1402db1b0 FindFirstFileExW
 0x1402db1b8 FindNextFileW
 0x1402db1c0 FindResourceW
 0x1402db1c8 FlsAlloc
 0x1402db1d0 FlsFree
 0x1402db1d8 FlsGetValue
 0x1402db1e0 FlsSetValue
 0x1402db1e8 FlushFileBuffers
 0x1402db1f0 FlushViewOfFile
 0x1402db1f8 FormatMessageA
 0x1402db200 FormatMessageW
 0x1402db208 FreeEnvironmentStringsW
 0x1402db210 FreeLibrary
 0x1402db218 FreeLibraryAndExitThread
 0x1402db220 GetACP
 0x1402db228 GetCPInfo
 0x1402db230 GetCommandLineA
 0x1402db238 GetCommandLineW
 0x1402db240 GetComputerNameExW
 0x1402db248 GetConsoleMode
 0x1402db250 GetConsoleOutputCP
 0x1402db258 GetCurrentDirectoryW
 0x1402db260 GetCurrentProcess
 0x1402db268 GetCurrentProcessId
 0x1402db270 GetCurrentProcessorNumber
 0x1402db278 GetCurrentThread
 0x1402db280 GetCurrentThreadId
 0x1402db288 GetDateFormatW
 0x1402db290 GetDiskFreeSpaceExW
 0x1402db298 GetDriveTypeW
 0x1402db2a0 GetEnvironmentStringsW
 0x1402db2a8 GetEnvironmentVariableW
 0x1402db2b0 GetExitCodeProcess
 0x1402db2b8 GetFileAttributesExW
 0x1402db2c0 GetFileAttributesW
 0x1402db2c8 GetFileInformationByHandle
 0x1402db2d0 GetFileInformationByHandleEx
 0x1402db2d8 GetFileSizeEx
 0x1402db2e0 GetFileTime
 0x1402db2e8 GetFileType
 0x1402db2f0 GetFullPathNameW
 0x1402db2f8 GetLastError
 0x1402db300 GetLocalTime
 0x1402db308 GetLocaleInfoW
 0x1402db310 GetLogicalProcessorInformation
 0x1402db318 GetLongPathNameW
 0x1402db320 GetModuleFileNameW
 0x1402db328 GetModuleHandleA
 0x1402db330 GetModuleHandleExW
 0x1402db338 GetModuleHandleW
 0x1402db340 GetNativeSystemInfo
 0x1402db348 GetOEMCP
 0x1402db350 GetProcAddress
 0x1402db358 GetProcessHandleCount
 0x1402db360 GetProcessHeap
 0x1402db368 GetProcessHeaps
 0x1402db370 GetProcessId
 0x1402db378 GetProcessMitigationPolicy
 0x1402db380 GetProcessTimes
 0x1402db388 GetProductInfo
 0x1402db390 GetQueuedCompletionStatus
 0x1402db398 GetStartupInfoW
 0x1402db3a0 GetStdHandle
 0x1402db3a8 GetStringTypeW
 0x1402db3b0 GetSystemDefaultLCID
 0x1402db3b8 GetSystemDirectoryW
 0x1402db3c0 GetSystemInfo
 0x1402db3c8 GetSystemTimeAsFileTime
 0x1402db3d0 GetTempPathW
 0x1402db3d8 GetThreadContext
 0x1402db3e0 GetThreadId
 0x1402db3e8 GetThreadLocale
 0x1402db3f0 GetThreadPriority
 0x1402db3f8 GetThreadPriorityBoost
 0x1402db400 GetTickCount
 0x1402db408 GetTimeFormatW
 0x1402db410 GetTimeZoneInformation
 0x1402db418 GetUserDefaultLCID
 0x1402db420 GetUserDefaultLangID
 0x1402db428 GetUserDefaultLocaleName
 0x1402db430 GetUserDefaultUILanguage
 0x1402db438 GetUserGeoID
 0x1402db440 GetVersionExW
 0x1402db448 GetWindowsDirectoryW
 0x1402db450 HeapDestroy
 0x1402db458 HeapSetInformation
 0x1402db460 InitOnceExecuteOnce
 0x1402db468 InitializeConditionVariable
 0x1402db470 InitializeCriticalSection
 0x1402db478 InitializeCriticalSectionAndSpinCount
 0x1402db480 InitializeProcThreadAttributeList
 0x1402db488 InitializeSListHead
 0x1402db490 IsDebuggerPresent
 0x1402db498 IsProcessorFeaturePresent
 0x1402db4a0 IsValidCodePage
 0x1402db4a8 IsValidLocale
 0x1402db4b0 IsWow64Process
 0x1402db4b8 K32GetModuleInformation
 0x1402db4c0 K32GetPerformanceInfo
 0x1402db4c8 K32GetProcessMemoryInfo
 0x1402db4d0 LCMapStringW
 0x1402db4d8 LeaveCriticalSection
 0x1402db4e0 LoadLibraryExA
 0x1402db4e8 LoadLibraryExW
 0x1402db4f0 LoadLibraryW
 0x1402db4f8 LoadResource
 0x1402db500 LocalFree
 0x1402db508 LockFileEx
 0x1402db510 LockResource
 0x1402db518 MapViewOfFile
 0x1402db520 MoveFileExW
 0x1402db528 MoveFileW
 0x1402db530 MultiByteToWideChar
 0x1402db538 OpenProcess
 0x1402db540 OpenThread
 0x1402db548 OutputDebugStringA
 0x1402db550 PeekNamedPipe
 0x1402db558 PostQueuedCompletionStatus
 0x1402db560 PrefetchVirtualMemory
 0x1402db568 Process32FirstW
 0x1402db570 Process32NextW
 0x1402db578 QueryInformationJobObject
 0x1402db580 QueryPerformanceCounter
 0x1402db588 QueryPerformanceFrequency
 0x1402db590 QueryThreadCycleTime
 0x1402db598 RaiseException
 0x1402db5a0 ReadConsoleW
 0x1402db5a8 ReadFile
 0x1402db5b0 ReadProcessMemory
 0x1402db5b8 RegisterWaitForSingleObject
 0x1402db5c0 ReleaseSRWLockExclusive
 0x1402db5c8 ReleaseSemaphore
 0x1402db5d0 RemoveDirectoryW
 0x1402db5d8 RemoveVectoredExceptionHandler
 0x1402db5e0 ReplaceFileW
 0x1402db5e8 ResetEvent
 0x1402db5f0 ResumeThread
 0x1402db5f8 RtlCaptureContext
 0x1402db600 RtlCaptureStackBackTrace
 0x1402db608 RtlLookupFunctionEntry
 0x1402db610 RtlPcToFileHeader
 0x1402db618 RtlUnwind
 0x1402db620 RtlUnwindEx
 0x1402db628 RtlVirtualUnwind
 0x1402db630 SetConsoleCtrlHandler
 0x1402db638 SetCurrentDirectoryW
 0x1402db640 SetDefaultDllDirectories
 0x1402db648 SetEndOfFile
 0x1402db650 SetEnvironmentVariableW
 0x1402db658 SetEvent
 0x1402db660 SetFileAttributesW
 0x1402db668 SetFilePointer
 0x1402db670 SetFilePointerEx
 0x1402db678 SetHandleInformation
 0x1402db680 SetInformationJobObject
 0x1402db688 SetLastError
 0x1402db690 SetNamedPipeHandleState
 0x1402db698 SetProcessMitigationPolicy
 0x1402db6a0 SetProcessShutdownParameters
 0x1402db6a8 SetStdHandle
 0x1402db6b0 SetThreadAffinityMask
 0x1402db6b8 SetThreadInformation
 0x1402db6c0 SetThreadPriority
 0x1402db6c8 SetThreadPriorityBoost
 0x1402db6d0 SetUnhandledExceptionFilter
 0x1402db6d8 SizeofResource
 0x1402db6e0 Sleep
 0x1402db6e8 SleepConditionVariableSRW
 0x1402db6f0 SleepEx
 0x1402db6f8 SuspendThread
 0x1402db700 SwitchToThread
 0x1402db708 SystemTimeToTzSpecificLocalTime
 0x1402db710 TerminateJobObject
 0x1402db718 TerminateProcess
 0x1402db720 TlsAlloc
 0x1402db728 TlsFree
 0x1402db730 TlsGetValue
 0x1402db738 TlsSetValue
 0x1402db740 TransactNamedPipe
 0x1402db748 TryAcquireSRWLockExclusive
 0x1402db750 UnhandledExceptionFilter
 0x1402db758 UnlockFileEx
 0x1402db760 UnmapViewOfFile
 0x1402db768 UnregisterWait
 0x1402db770 UnregisterWaitEx
 0x1402db778 UpdateProcThreadAttribute
 0x1402db780 VerSetConditionMask
 0x1402db788 VerifyVersionInfoW
 0x1402db790 VirtualAlloc
 0x1402db798 VirtualAllocEx
 0x1402db7a0 VirtualFree
 0x1402db7a8 VirtualFreeEx
 0x1402db7b0 VirtualProtect
 0x1402db7b8 VirtualProtectEx
 0x1402db7c0 VirtualQuery
 0x1402db7c8 VirtualQueryEx
 0x1402db7d0 WaitForMultipleObjects
 0x1402db7d8 WaitForSingleObject
 0x1402db7e0 WaitNamedPipeW
 0x1402db7e8 WakeAllConditionVariable
 0x1402db7f0 WakeConditionVariable
 0x1402db7f8 WideCharToMultiByte
 0x1402db800 Wow64GetThreadContext
 0x1402db808 WriteConsoleW
 0x1402db810 WriteFile
 0x1402db818 WriteProcessMemory
 0x1402db820 lstrlenA
ntdll.dll
 0x1402db830 RtlInitUnicodeString

EAT(Export Address Table) Library

0x14007c3b0 GetHandleVerifier
0x14018ae80 GetPakFileHashes
0x14007e380 IsSandboxedProcess
0x14018dd20 OQS_CPU_has_extension
0x140194010 OQS_KEM_alg_count
0x140193ff0 OQS_KEM_alg_identifier
0x140194020 OQS_KEM_alg_is_enabled
0x140194500 OQS_KEM_decaps
0x1401944d0 OQS_KEM_encaps
0x140194530 OQS_KEM_free
0x1401944b0 OQS_KEM_keypair
0x1401945c0 OQS_KEM_kyber_768_decaps
0x1401945b0 OQS_KEM_kyber_768_encaps
0x1401945a0 OQS_KEM_kyber_768_keypair
0x140194270 OQS_KEM_new
0x14018ded0 OQS_MEM_cleanse
0x14018df10 OQS_MEM_insecure_free
0x14018dea0 OQS_MEM_secure_bcmp
0x14018dee0 OQS_MEM_secure_free
0x1401945f0 OQS_SIG_alg_count
0x1401945d0 OQS_SIG_alg_identifier
0x140194600 OQS_SIG_alg_is_enabled
0x140194530 OQS_SIG_free
0x140194770 OQS_SIG_keypair
0x140194600 OQS_SIG_new
0x1401947a0 OQS_SIG_sign
0x1401947f0 OQS_SIG_verify
0x1401712a0 OQS_destroy
0x14018de80 OQS_init
0x14018e0a0 OQS_randombytes
0x14018e090 OQS_randombytes_custom_algorithm
0x14018e0c0 OQS_randombytes_nist_kat_init_256bit
0x14018df90 OQS_randombytes_switch_algorithm
0x14018de90 OQS_version


Similarity measure (PE file only) - Checking for service failure