Report - 6497a7b33252a782e523bebd2809712ea3b9faec34d901e0df92d3f6fb6abf83.exe

Generic Malware Malicious Library Malicious Packer UPX Anti_VM PE File DllRegisterServer dll PE32 OS Processor Check
ScreenShot
Created 2024.08.30 23:30 Machine s1_win7_x6401
Filename 6497a7b33252a782e523bebd2809712ea3b9faec34d901e0df92d3f6fb6abf83.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
1.2
ZERO API file : clean
VT API (file) 36 detected (AIDetectMalware, Lumma, GenericKD, Genus, a variant of WinGo, Artemis, CLASSIC, sgdeq, LUMMASTEALER, YXEH3Z, malicious, moderate, score, Server, Proxy, Detected, ai score=84, Wacatac, ABRisk, BCZZ, LummaC2, ZexaF, @F0@auyijZii, Antis)
md5 3b83989d2f86d143dbdbb20cf0608a1f
sha256 6497a7b33252a782e523bebd2809712ea3b9faec34d901e0df92d3f6fb6abf83
ssdeep 49152:gj1VMrpntvIdVLxxa9Kn2ZCNcFIoVIVF6P8M/o1rWNjB29VEc9Zi9Cgm+Ijhp6Q4:a1VMFiVLUK1Ao1W729fHiFo4GYTg
imphash 1aae8bf580c846f39c71c05898e57e88
impfuzzy 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6UP:AwO+VUjXOmokx0nP
  Network IP location

Signature (2cnts)

Level Description
danger File has been identified by 36 AntiVirus engines on VirusTotal as malicious
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (9cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0xeafe20 WriteFile
 0xeafe24 WriteConsoleW
 0xeafe28 WerSetFlags
 0xeafe2c WerGetFlags
 0xeafe30 WaitForMultipleObjects
 0xeafe34 WaitForSingleObject
 0xeafe38 VirtualQuery
 0xeafe3c VirtualFree
 0xeafe40 VirtualAlloc
 0xeafe44 TlsAlloc
 0xeafe48 SwitchToThread
 0xeafe4c SuspendThread
 0xeafe50 SetWaitableTimer
 0xeafe54 SetUnhandledExceptionFilter
 0xeafe58 SetProcessPriorityBoost
 0xeafe5c SetEvent
 0xeafe60 SetErrorMode
 0xeafe64 SetConsoleCtrlHandler
 0xeafe68 ResumeThread
 0xeafe6c RaiseFailFastException
 0xeafe70 PostQueuedCompletionStatus
 0xeafe74 LoadLibraryW
 0xeafe78 LoadLibraryExW
 0xeafe7c SetThreadContext
 0xeafe80 GetThreadContext
 0xeafe84 GetSystemInfo
 0xeafe88 GetSystemDirectoryA
 0xeafe8c GetStdHandle
 0xeafe90 GetQueuedCompletionStatusEx
 0xeafe94 GetProcessAffinityMask
 0xeafe98 GetProcAddress
 0xeafe9c GetErrorMode
 0xeafea0 GetEnvironmentStringsW
 0xeafea4 GetCurrentThreadId
 0xeafea8 GetConsoleMode
 0xeafeac FreeEnvironmentStringsW
 0xeafeb0 ExitProcess
 0xeafeb4 DuplicateHandle
 0xeafeb8 CreateWaitableTimerExW
 0xeafebc CreateThread
 0xeafec0 CreateIoCompletionPort
 0xeafec4 CreateEventA
 0xeafec8 CloseHandle
 0xeafecc AddVectoredExceptionHandler

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure