popup

Report - Identification-1.exe

Emotet Malicious Library UPX PE File PE64 MZP Format OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.08.26 09:35 Machine s1_win7_x6401
Filename Identification-1.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
4
 Behavior Score
2.6
ZERO API file : mailcious
VT API (file) 46 detected (AIDetectMalware, SleepObf, Malicious, score, Artemis, GenericKD, Unsafe, V5ph, Attribute, HighConfidence, Delf, DropperX, CLOUD, Redcap, xxygt, Detected, ai score=89, Casdet, R662299, Chgt, AMADEY, YXEHTZ, Gencirc)
md5 c7cd553e6da67a35d029070a475da837
sha256 d123bd0ec22d7ba6449474a717613b2186d812295965044ac432983df364aa91
ssdeep 98304:PNtfmToeoe9SWeOynYe18OVHm6pmjyD+:FJmToeowYnYM8WumD
imphash 73c7e572536ce3b598c7740cf9a09ab5
impfuzzy 192:occFuuRuuNwEUh99K/osN5mLIcAVIYF9XW3U1Rm/h6POQyxxS/:SuiN+9t50dI+tWk1RNPOQyxM/
  Network IP location

Signature (5cnts)

Level Description
danger File has been identified by 46 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (7cnts)

Level Name Description Collection
danger Win32_Trojan_Emotet_2_Zero Win32 Trojan Emotet binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

oleaut32.dll
 0x905428 SysFreeString
 0x905430 SysReAllocStringLen
 0x905438 SysAllocStringLen
advapi32.dll
 0x905448 RegQueryValueExW
 0x905450 RegOpenKeyExW
 0x905458 RegCloseKey
user32.dll
 0x905468 CharNextW
 0x905470 LoadStringW
kernel32.dll
 0x905480 Sleep
 0x905488 VirtualFree
 0x905490 VirtualAlloc
 0x905498 lstrlenW
 0x9054a0 VirtualQuery
 0x9054a8 QueryPerformanceCounter
 0x9054b0 GetTickCount
 0x9054b8 GetSystemInfo
 0x9054c0 GetVersion
 0x9054c8 CompareStringW
 0x9054d0 IsValidLocale
 0x9054d8 SetThreadLocale
 0x9054e0 GetSystemDefaultUILanguage
 0x9054e8 GetUserDefaultUILanguage
 0x9054f0 GetLocaleInfoW
 0x9054f8 WideCharToMultiByte
 0x905500 MultiByteToWideChar
 0x905508 GetACP
 0x905510 LoadLibraryExW
 0x905518 GetStartupInfoW
 0x905520 GetProcAddress
 0x905528 GetModuleHandleW
 0x905530 GetModuleFileNameW
 0x905538 GetCommandLineW
 0x905540 FreeLibrary
 0x905548 GetLastError
 0x905550 UnhandledExceptionFilter
 0x905558 RtlUnwindEx
 0x905560 RtlUnwind
 0x905568 RaiseException
 0x905570 ExitProcess
 0x905578 ExitThread
 0x905580 SwitchToThread
 0x905588 GetCurrentThreadId
 0x905590 CreateThread
 0x905598 DeleteCriticalSection
 0x9055a0 LeaveCriticalSection
 0x9055a8 EnterCriticalSection
 0x9055b0 InitializeCriticalSection
 0x9055b8 FindFirstFileW
 0x9055c0 FindClose
 0x9055c8 WriteFile
 0x9055d0 GetStdHandle
 0x9055d8 CloseHandle
kernel32.dll
 0x9055e8 GetProcAddress
 0x9055f0 RaiseException
 0x9055f8 LoadLibraryA
 0x905600 GetLastError
 0x905608 TlsSetValue
 0x905610 TlsGetValue
 0x905618 LocalFree
 0x905620 LocalAlloc
 0x905628 GetModuleHandleW
 0x905630 FreeLibrary
user32.dll
 0x905640 SetClassLongPtrW
 0x905648 GetClassLongPtrW
 0x905650 SetWindowLongPtrW
 0x905658 GetWindowLongPtrW
 0x905660 CreateWindowExW
 0x905668 WindowFromPoint
 0x905670 WaitMessage
 0x905678 UpdateWindow
 0x905680 UnregisterClassW
 0x905688 UnhookWindowsHookEx
 0x905690 TranslateMessage
 0x905698 TranslateMDISysAccel
 0x9056a0 TrackPopupMenu
 0x9056a8 SystemParametersInfoW
 0x9056b0 ShowWindow
 0x9056b8 ShowScrollBar
 0x9056c0 ShowOwnedPopups
 0x9056c8 ShowCaret
 0x9056d0 SetWindowRgn
 0x9056d8 SetWindowsHookExW
 0x9056e0 SetWindowTextW
 0x9056e8 SetWindowPos
 0x9056f0 SetWindowPlacement
 0x9056f8 SetTimer
 0x905700 SetScrollRange
 0x905708 SetScrollPos
 0x905710 SetScrollInfo
 0x905718 SetRect
 0x905720 SetPropW
 0x905728 SetParent
 0x905730 SetMenuItemInfoW
 0x905738 SetMenu
 0x905740 SetForegroundWindow
 0x905748 SetFocus
 0x905750 SetCursorPos
 0x905758 SetCursor
 0x905760 SetClipboardData
 0x905768 SetCapture
 0x905770 SetActiveWindow
 0x905778 SendMessageA
 0x905780 SendMessageW
 0x905788 ScrollWindow
 0x905790 ScreenToClient
 0x905798 RemovePropW
 0x9057a0 RemoveMenu
 0x9057a8 ReleaseDC
 0x9057b0 ReleaseCapture
 0x9057b8 RegisterWindowMessageW
 0x9057c0 RegisterClipboardFormatW
 0x9057c8 RegisterClassW
 0x9057d0 RedrawWindow
 0x9057d8 PostQuitMessage
 0x9057e0 PostMessageW
 0x9057e8 PeekMessageA
 0x9057f0 PeekMessageW
 0x9057f8 OpenClipboard
 0x905800 MsgWaitForMultipleObjectsEx
 0x905808 MsgWaitForMultipleObjects
 0x905810 MessageBoxW
 0x905818 MessageBeep
 0x905820 MapWindowPoints
 0x905828 MapVirtualKeyW
 0x905830 LoadStringW
 0x905838 LoadKeyboardLayoutW
 0x905840 LoadIconW
 0x905848 LoadCursorW
 0x905850 LoadBitmapW
 0x905858 KillTimer
 0x905860 IsZoomed
 0x905868 IsWindowVisible
 0x905870 IsWindowUnicode
 0x905878 IsWindowEnabled
 0x905880 IsWindow
 0x905888 IsIconic
 0x905890 IsDialogMessageA
 0x905898 IsDialogMessageW
 0x9058a0 IsClipboardFormatAvailable
 0x9058a8 IsChild
 0x9058b0 InvalidateRect
 0x9058b8 InsertMenuItemW
 0x9058c0 InsertMenuW
 0x9058c8 InflateRect
 0x9058d0 HideCaret
 0x9058d8 GetWindowThreadProcessId
 0x9058e0 GetWindowTextW
 0x9058e8 GetWindowRect
 0x9058f0 GetWindowPlacement
 0x9058f8 GetWindowDC
 0x905900 GetTopWindow
 0x905908 GetSystemMetrics
 0x905910 GetSystemMenu
 0x905918 GetSysColorBrush
 0x905920 GetSysColor
 0x905928 GetSubMenu
 0x905930 GetScrollRange
 0x905938 GetScrollPos
 0x905940 GetScrollInfo
 0x905948 GetScrollBarInfo
 0x905950 GetPropW
 0x905958 GetParent
 0x905960 GetWindow
 0x905968 GetMessageTime
 0x905970 GetMessagePos
 0x905978 GetMessageExtraInfo
 0x905980 GetMenuStringW
 0x905988 GetMenuState
 0x905990 GetMenuItemInfoW
 0x905998 GetMenuItemID
 0x9059a0 GetMenuItemCount
 0x9059a8 GetMenu
 0x9059b0 GetLastActivePopup
 0x9059b8 GetKeyboardState
 0x9059c0 GetKeyboardLayoutNameW
 0x9059c8 GetKeyboardLayoutList
 0x9059d0 GetKeyboardLayout
 0x9059d8 GetKeyState
 0x9059e0 GetKeyNameTextW
 0x9059e8 GetIconInfo
 0x9059f0 GetForegroundWindow
 0x9059f8 GetFocus
 0x905a00 GetDlgCtrlID
 0x905a08 GetDesktopWindow
 0x905a10 GetDCEx
 0x905a18 GetDC
 0x905a20 GetCursorPos
 0x905a28 GetCursor
 0x905a30 GetClipboardData
 0x905a38 GetClientRect
 0x905a40 GetClassNameW
 0x905a48 GetClassInfoExW
 0x905a50 GetClassInfoW
 0x905a58 GetCapture
 0x905a60 GetActiveWindow
 0x905a68 FrameRect
 0x905a70 FindWindowExW
 0x905a78 FindWindowW
 0x905a80 FillRect
 0x905a88 EnumWindows
 0x905a90 EnumThreadWindows
 0x905a98 EnumClipboardFormats
 0x905aa0 EnumChildWindows
 0x905aa8 EndPaint
 0x905ab0 EndMenu
 0x905ab8 EnableWindow
 0x905ac0 EnableScrollBar
 0x905ac8 EnableMenuItem
 0x905ad0 EmptyClipboard
 0x905ad8 DrawTextExW
 0x905ae0 DrawTextW
 0x905ae8 DrawMenuBar
 0x905af0 DrawIconEx
 0x905af8 DrawIcon
 0x905b00 DrawFrameControl
 0x905b08 DrawFocusRect
 0x905b10 DrawEdge
 0x905b18 DispatchMessageA
 0x905b20 DispatchMessageW
 0x905b28 DestroyWindow
 0x905b30 DestroyMenu
 0x905b38 DestroyIcon
 0x905b40 DestroyCursor
 0x905b48 DeleteMenu
 0x905b50 DefWindowProcW
 0x905b58 DefMDIChildProcW
 0x905b60 DefFrameProcW
 0x905b68 CreatePopupMenu
 0x905b70 CreateMenu
 0x905b78 CreateIcon
 0x905b80 CreateAcceleratorTableW
 0x905b88 CountClipboardFormats
 0x905b90 CopyImage
 0x905b98 CopyIcon
 0x905ba0 CloseClipboard
 0x905ba8 ClientToScreen
 0x905bb0 CheckMenuItem
 0x905bb8 CharUpperBuffW
 0x905bc0 CharUpperW
 0x905bc8 CharNextW
 0x905bd0 CharLowerBuffW
 0x905bd8 CharLowerW
 0x905be0 CallWindowProcW
 0x905be8 CallNextHookEx
 0x905bf0 BeginPaint
 0x905bf8 AdjustWindowRectEx
 0x905c00 ActivateKeyboardLayout
gdi32.dll
 0x905c10 UnrealizeObject
 0x905c18 StretchDIBits
 0x905c20 StretchBlt
 0x905c28 StartPage
 0x905c30 StartDocW
 0x905c38 SetWindowOrgEx
 0x905c40 SetWinMetaFileBits
 0x905c48 SetViewportOrgEx
 0x905c50 SetTextColor
 0x905c58 SetStretchBltMode
 0x905c60 SetRectRgn
 0x905c68 SetROP2
 0x905c70 SetPixel
 0x905c78 SetMapMode
 0x905c80 SetEnhMetaFileBits
 0x905c88 SetDIBits
 0x905c90 SetDIBColorTable
 0x905c98 SetBrushOrgEx
 0x905ca0 SetBkMode
 0x905ca8 SetBkColor
 0x905cb0 SetAbortProc
 0x905cb8 SelectPalette
 0x905cc0 SelectObject
 0x905cc8 SaveDC
 0x905cd0 RoundRect
 0x905cd8 RestoreDC
 0x905ce0 ResizePalette
 0x905ce8 Rectangle
 0x905cf0 RectVisible
 0x905cf8 RealizePalette
 0x905d00 Polyline
 0x905d08 Polygon
 0x905d10 PolyBezierTo
 0x905d18 PolyBezier
 0x905d20 PlayEnhMetaFile
 0x905d28 Pie
 0x905d30 PatBlt
 0x905d38 MoveToEx
 0x905d40 MaskBlt
 0x905d48 LineTo
 0x905d50 LPtoDP
 0x905d58 IntersectClipRect
 0x905d60 GetWindowOrgEx
 0x905d68 GetWinMetaFileBits
 0x905d70 GetTextMetricsW
 0x905d78 GetTextExtentPointW
 0x905d80 GetTextExtentPoint32W
 0x905d88 GetTextAlign
 0x905d90 GetSystemPaletteEntries
 0x905d98 GetStockObject
 0x905da0 GetRgnBox
 0x905da8 GetPixel
 0x905db0 GetPaletteEntries
 0x905db8 GetObjectW
 0x905dc0 GetNearestPaletteIndex
 0x905dc8 GetEnhMetaFilePaletteEntries
 0x905dd0 GetEnhMetaFileHeader
 0x905dd8 GetEnhMetaFileDescriptionW
 0x905de0 GetEnhMetaFileBits
 0x905de8 GetDeviceCaps
 0x905df0 GetDIBits
 0x905df8 GetDIBColorTable
 0x905e00 GetCurrentPositionEx
 0x905e08 GetClipBox
 0x905e10 GetBrushOrgEx
 0x905e18 GetBitmapBits
 0x905e20 GdiFlush
 0x905e28 FrameRgn
 0x905e30 ExtTextOutW
 0x905e38 ExtFloodFill
 0x905e40 ExcludeClipRect
 0x905e48 EnumFontsW
 0x905e50 EnumFontFamiliesExW
 0x905e58 EndPage
 0x905e60 EndDoc
 0x905e68 Ellipse
 0x905e70 DeleteObject
 0x905e78 DeleteEnhMetaFile
 0x905e80 DeleteDC
 0x905e88 CreateSolidBrush
 0x905e90 CreateRectRgn
 0x905e98 CreatePenIndirect
 0x905ea0 CreatePalette
 0x905ea8 CreateICW
 0x905eb0 CreateHalftonePalette
 0x905eb8 CreateFontIndirectW
 0x905ec0 CreateEnhMetaFileW
 0x905ec8 CreateDIBitmap
 0x905ed0 CreateDIBSection
 0x905ed8 CreateDCW
 0x905ee0 CreateCompatibleDC
 0x905ee8 CreateCompatibleBitmap
 0x905ef0 CreateBrushIndirect
 0x905ef8 CreateBitmap
 0x905f00 CopyEnhMetaFileW
 0x905f08 CloseEnhMetaFile
 0x905f10 Chord
 0x905f18 BitBlt
 0x905f20 ArcTo
 0x905f28 Arc
 0x905f30 AngleArc
 0x905f38 AbortDoc
version.dll
 0x905f48 VerQueryValueW
 0x905f50 GetFileVersionInfoSizeW
 0x905f58 GetFileVersionInfoW
kernel32.dll
 0x905f68 WritePrivateProfileStringW
 0x905f70 WriteFile
 0x905f78 WideCharToMultiByte
 0x905f80 WaitForSingleObject
 0x905f88 WaitForMultipleObjectsEx
 0x905f90 VirtualQueryEx
 0x905f98 VirtualQuery
 0x905fa0 VirtualProtect
 0x905fa8 VirtualFree
 0x905fb0 VirtualAlloc
 0x905fb8 VerSetConditionMask
 0x905fc0 VerifyVersionInfoW
 0x905fc8 UnmapViewOfFile
 0x905fd0 TryEnterCriticalSection
 0x905fd8 SwitchToThread
 0x905fe0 SuspendThread
 0x905fe8 Sleep
 0x905ff0 SizeofResource
 0x905ff8 SetThreadPriority
 0x906000 SetThreadLocale
 0x906008 SetLastError
 0x906010 SetFilePointer
 0x906018 SetEvent
 0x906020 SetErrorMode
 0x906028 SetEndOfFile
 0x906030 ResumeThread
 0x906038 ResetEvent
 0x906040 RemoveDirectoryW
 0x906048 ReadFile
 0x906050 RaiseException
 0x906058 QueryPerformanceFrequency
 0x906060 QueryPerformanceCounter
 0x906068 QueryDosDeviceW
 0x906070 IsDebuggerPresent
 0x906078 MulDiv
 0x906080 MapViewOfFile
 0x906088 LockResource
 0x906090 LocalFree
 0x906098 LoadResource
 0x9060a0 LoadLibraryW
 0x9060a8 LeaveCriticalSection
 0x9060b0 IsValidLocale
 0x9060b8 InitializeCriticalSection
 0x9060c0 HeapSize
 0x9060c8 HeapFree
 0x9060d0 HeapDestroy
 0x9060d8 HeapCreate
 0x9060e0 HeapAlloc
 0x9060e8 GlobalUnlock
 0x9060f0 GlobalSize
 0x9060f8 GlobalHandle
 0x906100 GlobalLock
 0x906108 GlobalFree
 0x906110 GlobalFindAtomW
 0x906118 GlobalDeleteAtom
 0x906120 GlobalAlloc
 0x906128 GlobalAddAtomW
 0x906130 GetVolumeInformationW
 0x906138 GetVersionExW
 0x906140 GetVersion
 0x906148 GetUserDefaultLCID
 0x906150 GetTimeZoneInformation
 0x906158 GetTickCount
 0x906160 GetThreadPriority
 0x906168 GetThreadLocale
 0x906170 GetTempPathW
 0x906178 GetTempFileNameW
 0x906180 GetSystemDirectoryW
 0x906188 GetStdHandle
 0x906190 GetProcAddress
 0x906198 GetPrivateProfileStringW
 0x9061a0 GetModuleHandleW
 0x9061a8 GetModuleFileNameW
 0x9061b0 GetLogicalDriveStringsW
 0x9061b8 GetLocaleInfoW
 0x9061c0 GetLocalTime
 0x9061c8 GetLastError
 0x9061d0 GetFullPathNameW
 0x9061d8 GetFileSize
 0x9061e0 GetFileAttributesExW
 0x9061e8 GetFileAttributesW
 0x9061f0 GetExitCodeThread
 0x9061f8 GetDriveTypeW
 0x906200 GetDiskFreeSpaceW
 0x906208 GetDateFormatW
 0x906210 GetCurrentThreadId
 0x906218 GetCurrentThread
 0x906220 GetCurrentProcessId
 0x906228 GetCurrentProcess
 0x906230 GetComputerNameW
 0x906238 GetCPInfoExW
 0x906240 GetCPInfo
 0x906248 GetACP
 0x906250 FreeResource
 0x906258 FreeLibrary
 0x906260 FormatMessageW
 0x906268 FindResourceW
 0x906270 FindNextFileW
 0x906278 FindFirstFileW
 0x906280 FindClose
 0x906288 FileTimeToSystemTime
 0x906290 FileTimeToLocalFileTime
 0x906298 FileTimeToDosDateTime
 0x9062a0 EnumSystemLocalesW
 0x9062a8 EnumResourceNamesW
 0x9062b0 EnumCalendarInfoW
 0x9062b8 EnterCriticalSection
 0x9062c0 DeleteFileW
 0x9062c8 DeleteCriticalSection
 0x9062d0 CreateThread
 0x9062d8 CreateFileMappingW
 0x9062e0 CreateFileW
 0x9062e8 CreateEventW
 0x9062f0 CreateDirectoryW
 0x9062f8 CopyFileW
 0x906300 CompareStringA
 0x906308 CompareStringW
 0x906310 CloseHandle
advapi32.dll
 0x906320 RegUnLoadKeyW
 0x906328 RegSetValueExW
 0x906330 RegSaveKeyW
 0x906338 RegRestoreKeyW
 0x906340 RegReplaceKeyW
 0x906348 RegQueryValueExW
 0x906350 RegQueryInfoKeyW
 0x906358 RegOpenKeyExW
 0x906360 RegLoadKeyW
 0x906368 RegFlushKey
 0x906370 RegEnumValueW
 0x906378 RegEnumKeyExW
 0x906380 RegDeleteValueW
 0x906388 RegDeleteKeyW
 0x906390 RegCreateKeyExW
 0x906398 RegConnectRegistryW
 0x9063a0 RegCloseKey
kernel32.dll
 0x9063b0 Sleep
oleaut32.dll
 0x9063c0 SafeArrayPtrOfIndex
 0x9063c8 SafeArrayGetUBound
 0x9063d0 SafeArrayGetLBound
 0x9063d8 SafeArrayCreate
 0x9063e0 VariantChangeType
 0x9063e8 VariantCopy
 0x9063f0 VariantClear
 0x9063f8 VariantInit
oleaut32.dll
 0x906408 GetErrorInfo
 0x906410 GetActiveObject
 0x906418 SysFreeString
ole32.dll
 0x906428 CreateStreamOnHGlobal
 0x906430 OleRegEnumVerbs
 0x906438 IsAccelerator
 0x906440 OleDraw
 0x906448 OleSetMenuDescriptor
 0x906450 OleUninitialize
 0x906458 OleInitialize
 0x906460 CoTaskMemFree
 0x906468 CoTaskMemAlloc
 0x906470 ProgIDFromCLSID
 0x906478 StringFromCLSID
 0x906480 CoCreateInstance
 0x906488 CoGetClassObject
 0x906490 CoUninitialize
 0x906498 CoInitialize
 0x9064a0 IsEqualGUID
comctl32.dll
 0x9064b0 InitializeFlatSB
 0x9064b8 FlatSB_SetScrollProp
 0x9064c0 FlatSB_SetScrollPos
 0x9064c8 FlatSB_SetScrollInfo
 0x9064d0 FlatSB_GetScrollPos
 0x9064d8 FlatSB_GetScrollInfo
 0x9064e0 _TrackMouseEvent
 0x9064e8 ImageList_GetImageInfo
 0x9064f0 ImageList_SetIconSize
 0x9064f8 ImageList_GetIconSize
 0x906500 ImageList_Write
 0x906508 ImageList_Read
 0x906510 ImageList_GetDragImage
 0x906518 ImageList_DragShowNolock
 0x906520 ImageList_DragMove
 0x906528 ImageList_DragLeave
 0x906530 ImageList_DragEnter
 0x906538 ImageList_EndDrag
 0x906540 ImageList_BeginDrag
 0x906548 ImageList_Copy
 0x906550 ImageList_LoadImageW
 0x906558 ImageList_GetIcon
 0x906560 ImageList_Remove
 0x906568 ImageList_DrawEx
 0x906570 ImageList_Replace
 0x906578 ImageList_Draw
 0x906580 ImageList_SetOverlayImage
 0x906588 ImageList_GetBkColor
 0x906590 ImageList_SetBkColor
 0x906598 ImageList_ReplaceIcon
 0x9065a0 ImageList_Add
 0x9065a8 ImageList_SetImageCount
 0x9065b0 ImageList_GetImageCount
 0x9065b8 ImageList_Destroy
 0x9065c0 ImageList_Create
user32.dll
 0x9065d0 EnumDisplayMonitors
 0x9065d8 GetMonitorInfoW
 0x9065e0 MonitorFromPoint
 0x9065e8 MonitorFromRect
 0x9065f0 MonitorFromWindow
msvcrt.dll
 0x906600 memset
 0x906608 memcpy
shell32.dll
 0x906618 Shell_NotifyIconW
shell32.dll
 0x906628 SHGetSpecialFolderPathW
winspool.drv
 0x906638 OpenPrinterW
 0x906640 EnumPrintersW
 0x906648 DocumentPropertiesW
 0x906650 ClosePrinter
winspool.drv
 0x906660 GetDefaultPrinterW
winmm.dll
 0x906670 timeGetTime

EAT(Export Address Table) Library

0x4985c0 TMethodImplementationIntercept
0x416d30 __dbk_fcall_wrapper
0x8fcf58 dbkFCallWrapperAddr

Similarity measure (PE file only) - Checking for service failure