Report - 1.exe

Generic Malware Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check
ScreenShot
Created 2024.09.03 08:50 Machine s1_win7_x6401
Filename 1.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
14
Behavior Score
6.2
ZERO API file : malware
VT API (file)
md5 2978ce3b334332c2bf8e6c45652c599c
sha256 f17af5296ff826f4199381574dccb3dcb8a5deeb811e40929f95c722ab70aeb7
ssdeep 24576:eYVLN+uGOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:BTT3HPkVOBTK
imphash 729ab4da9f34412c8013b3726badf296
impfuzzy 192:Fm1xCIxBIUKK5go1/R/KtoRcRcBcxlnqPrQ3OF:EhxBGeKMEe9rQ3OF
  Network IP location

Signature (15cnts)

Level Description
watch Communicates with host for which no DNS query was performed
watch Deletes executed files from disk
watch Installs itself for autorun at Windows startup
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Creates a service
notice Creates a suspicious process
notice Drops an executable to the user AppData folder
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info The executable uses a known packer
info The file contains an unknown PE resource name possibly indicative of a packer

Rules (21cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (1cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
23.224.239.91 US CNSERVERS 23.224.239.91 clean

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x42d0f8 RtlUnwind
 0x42d0fc RaiseException
 0x42d100 GetStartupInfoA
 0x42d104 GetCommandLineA
 0x42d108 TerminateProcess
 0x42d10c HeapSize
 0x42d110 GetACP
 0x42d114 GetTimeZoneInformation
 0x42d118 SetUnhandledExceptionFilter
 0x42d11c UnhandledExceptionFilter
 0x42d120 FreeEnvironmentStringsA
 0x42d124 FreeEnvironmentStringsW
 0x42d128 GetEnvironmentStrings
 0x42d12c GetEnvironmentStringsW
 0x42d130 SetHandleCount
 0x42d134 GetStdHandle
 0x42d138 GetFileType
 0x42d13c GetVersionExA
 0x42d140 HeapDestroy
 0x42d144 HeapCreate
 0x42d148 IsBadWritePtr
 0x42d14c LCMapStringA
 0x42d150 LCMapStringW
 0x42d154 GetStringTypeA
 0x42d158 GetStringTypeW
 0x42d15c IsBadCodePtr
 0x42d160 SetStdHandle
 0x42d164 CompareStringA
 0x42d168 CompareStringW
 0x42d16c SetEnvironmentVariableA
 0x42d170 GetProfileStringA
 0x42d174 GetTickCount
 0x42d178 FileTimeToLocalFileTime
 0x42d17c FileTimeToSystemTime
 0x42d180 FormatMessageA
 0x42d184 GetOEMCP
 0x42d188 GetCPInfo
 0x42d18c GetFileTime
 0x42d190 GetFileSize
 0x42d194 GetFileAttributesA
 0x42d198 GetFullPathNameA
 0x42d19c GetVolumeInformationA
 0x42d1a0 FindFirstFileA
 0x42d1a4 FindClose
 0x42d1a8 SetEndOfFile
 0x42d1ac UnlockFile
 0x42d1b0 LockFile
 0x42d1b4 FlushFileBuffers
 0x42d1b8 SetFilePointer
 0x42d1bc WriteFile
 0x42d1c0 ReadFile
 0x42d1c4 CreateFileA
 0x42d1c8 GetCurrentProcess
 0x42d1cc DuplicateHandle
 0x42d1d0 GetThreadLocale
 0x42d1d4 GetProcessVersion
 0x42d1d8 TlsGetValue
 0x42d1dc LocalReAlloc
 0x42d1e0 TlsSetValue
 0x42d1e4 EnterCriticalSection
 0x42d1e8 GlobalReAlloc
 0x42d1ec LeaveCriticalSection
 0x42d1f0 GlobalHandle
 0x42d1f4 DeleteCriticalSection
 0x42d1f8 TlsAlloc
 0x42d1fc InitializeCriticalSection
 0x42d200 LocalFree
 0x42d204 LocalAlloc
 0x42d208 SizeofResource
 0x42d20c MultiByteToWideChar
 0x42d210 WideCharToMultiByte
 0x42d214 InterlockedIncrement
 0x42d218 GetLastError
 0x42d21c InterlockedDecrement
 0x42d220 GlobalFlags
 0x42d224 MulDiv
 0x42d228 lstrcpynA
 0x42d22c GetVersion
 0x42d230 lstrcatA
 0x42d234 GlobalGetAtomNameA
 0x42d238 GlobalAddAtomA
 0x42d23c GlobalFindAtomA
 0x42d240 lstrcpyA
 0x42d244 GetModuleHandleA
 0x42d248 SetLastError
 0x42d24c lstrlenA
 0x42d250 WritePrivateProfileStringA
 0x42d254 CloseHandle
 0x42d258 GetModuleFileNameA
 0x42d25c GlobalAlloc
 0x42d260 GlobalDeleteAtom
 0x42d264 lstrcmpA
 0x42d268 lstrcmpiA
 0x42d26c GetCurrentThread
 0x42d270 GetCurrentThreadId
 0x42d274 GlobalLock
 0x42d278 GlobalUnlock
 0x42d27c GlobalFree
 0x42d280 LockResource
 0x42d284 FindResourceA
 0x42d288 LoadResource
 0x42d28c ExitProcess
 0x42d290 IsBadReadPtr
 0x42d294 LoadLibraryA
 0x42d298 GetProcAddress
 0x42d29c VirtualProtect
 0x42d2a0 VirtualAlloc
 0x42d2a4 FreeLibrary
 0x42d2a8 VirtualFree
 0x42d2ac HeapReAlloc
 0x42d2b0 HeapAlloc
 0x42d2b4 GetProcessHeap
 0x42d2b8 GetEnvironmentVariableA
 0x42d2bc HeapFree
USER32.dll
 0x42d300 GetSysColorBrush
 0x42d304 LoadStringA
 0x42d308 CharNextA
 0x42d30c CopyAcceleratorTableA
 0x42d310 SetRect
 0x42d314 GetNextDlgGroupItem
 0x42d318 MessageBeep
 0x42d31c CharUpperA
 0x42d320 InflateRect
 0x42d324 InvertRect
 0x42d328 FillRect
 0x42d32c GetDCEx
 0x42d330 LockWindowUpdate
 0x42d334 RegisterClipboardFormatA
 0x42d338 PostThreadMessageA
 0x42d33c GetTopWindow
 0x42d340 IsChild
 0x42d344 GetCapture
 0x42d348 WinHelpA
 0x42d34c GetClassInfoA
 0x42d350 RegisterClassA
 0x42d354 GetMenu
 0x42d358 GetMenuItemCount
 0x42d35c GetSubMenu
 0x42d360 GetMenuItemID
 0x42d364 CreateWindowExA
 0x42d368 GetClassLongA
 0x42d36c SetPropA
 0x42d370 UnhookWindowsHookEx
 0x42d374 GetPropA
 0x42d378 CallWindowProcA
 0x42d37c RemovePropA
 0x42d380 DefWindowProcA
 0x42d384 GetMessageTime
 0x42d388 GetMessagePos
 0x42d38c GetForegroundWindow
 0x42d390 SetForegroundWindow
 0x42d394 RegisterWindowMessageA
 0x42d398 OffsetRect
 0x42d39c IntersectRect
 0x42d3a0 SystemParametersInfoA
 0x42d3a4 IsIconic
 0x42d3a8 GetWindowPlacement
 0x42d3ac GetWindowRect
 0x42d3b0 SetTimer
 0x42d3b4 KillTimer
 0x42d3b8 WaitMessage
 0x42d3bc MapDialogRect
 0x42d3c0 EndPaint
 0x42d3c4 wsprintfA
 0x42d3c8 SetFocus
 0x42d3cc ShowWindow
 0x42d3d0 SetWindowPos
 0x42d3d4 MoveWindow
 0x42d3d8 SetWindowLongA
 0x42d3dc GetDlgCtrlID
 0x42d3e0 GetWindowTextLengthA
 0x42d3e4 GetWindowTextA
 0x42d3e8 SetWindowTextA
 0x42d3ec IsDialogMessageA
 0x42d3f0 SendDlgItemMessageA
 0x42d3f4 GetMenuCheckMarkDimensions
 0x42d3f8 LoadBitmapA
 0x42d3fc GetMenuState
 0x42d400 ModifyMenuA
 0x42d404 SetMenuItemBitmaps
 0x42d408 CheckMenuItem
 0x42d40c EnableMenuItem
 0x42d410 GetFocus
 0x42d414 GetMessageA
 0x42d418 TranslateMessage
 0x42d41c DispatchMessageA
 0x42d420 GetKeyState
 0x42d424 CallNextHookEx
 0x42d428 ValidateRect
 0x42d42c IsWindowVisible
 0x42d430 PeekMessageA
 0x42d434 GetCursorPos
 0x42d438 SetWindowsHookExA
 0x42d43c GetLastActivePopup
 0x42d440 MessageBoxA
 0x42d444 SetCursor
 0x42d448 ShowOwnedPopups
 0x42d44c PostMessageA
 0x42d450 UpdateWindow
 0x42d454 HideCaret
 0x42d458 ShowCaret
 0x42d45c ExcludeUpdateRgn
 0x42d460 DrawFocusRect
 0x42d464 DefDlgProcA
 0x42d468 IsWindowUnicode
 0x42d46c EnableWindow
 0x42d470 PostQuitMessage
 0x42d474 GetNextDlgTabItem
 0x42d478 EndDialog
 0x42d47c GetActiveWindow
 0x42d480 SetActiveWindow
 0x42d484 IsWindow
 0x42d488 GetSystemMetrics
 0x42d48c CreateDialogIndirectParamA
 0x42d490 DestroyWindow
 0x42d494 GetParent
 0x42d498 GetWindowLongA
 0x42d49c GetDlgItem
 0x42d4a0 IsWindowEnabled
 0x42d4a4 GetClassNameA
 0x42d4a8 GrayStringA
 0x42d4ac DrawTextA
 0x42d4b0 GetWindow
 0x42d4b4 TabbedTextOutA
 0x42d4b8 SendMessageA
 0x42d4bc LoadCursorA
 0x42d4c0 BeginPaint
 0x42d4c4 GetWindowDC
 0x42d4c8 GetSystemMenu
 0x42d4cc DeleteMenu
 0x42d4d0 AppendMenuA
 0x42d4d4 IsRectEmpty
 0x42d4d8 SetParent
 0x42d4dc PtInRect
 0x42d4e0 GetDC
 0x42d4e4 ReleaseDC
 0x42d4e8 BringWindowToTop
 0x42d4ec InvalidateRect
 0x42d4f0 UnpackDDElParam
 0x42d4f4 ReuseDDElParam
 0x42d4f8 SetMenu
 0x42d4fc LoadMenuA
 0x42d500 DestroyMenu
 0x42d504 TranslateAcceleratorA
 0x42d508 LoadAcceleratorsA
 0x42d50c ClientToScreen
 0x42d510 WindowFromPoint
 0x42d514 GetWindowThreadProcessId
 0x42d518 GetDesktopWindow
 0x42d51c ReleaseCapture
 0x42d520 SetCapture
 0x42d524 LoadIconA
 0x42d528 MapWindowPoints
 0x42d52c GetSysColor
 0x42d530 AdjustWindowRectEx
 0x42d534 ScreenToClient
 0x42d538 EqualRect
 0x42d53c DeferWindowPos
 0x42d540 GetClientRect
 0x42d544 BeginDeferWindowPos
 0x42d548 CopyRect
 0x42d54c SetWindowContextHelpId
 0x42d550 EndDeferWindowPos
 0x42d554 SetRectEmpty
GDI32.dll
 0x42d01c SaveDC
 0x42d020 RestoreDC
 0x42d024 GetStockObject
 0x42d028 SetBkMode
 0x42d02c SetMapMode
 0x42d030 SetViewportOrgEx
 0x42d034 OffsetViewportOrgEx
 0x42d038 SetViewportExtEx
 0x42d03c ScaleViewportExtEx
 0x42d040 SetWindowExtEx
 0x42d044 ScaleWindowExtEx
 0x42d048 SelectClipRgn
 0x42d04c ExcludeClipRect
 0x42d050 IntersectClipRect
 0x42d054 SetTextAlign
 0x42d058 GetDeviceCaps
 0x42d05c GetViewportExtEx
 0x42d060 GetWindowExtEx
 0x42d064 CreateSolidBrush
 0x42d068 CreatePatternBrush
 0x42d06c PtVisible
 0x42d070 RectVisible
 0x42d074 TextOutA
 0x42d078 ExtTextOutA
 0x42d07c Escape
 0x42d080 GetTextExtentPoint32A
 0x42d084 GetTextMetricsA
 0x42d088 CreateFontIndirectA
 0x42d08c GetTextColor
 0x42d090 GetBkColor
 0x42d094 DPtoLP
 0x42d098 LPtoDP
 0x42d09c BitBlt
 0x42d0a0 GetMapMode
 0x42d0a4 PatBlt
 0x42d0a8 SetRectRgn
 0x42d0ac CombineRgn
 0x42d0b0 CreateRectRgnIndirect
 0x42d0b4 CreateFontA
 0x42d0b8 GetCharWidthA
 0x42d0bc DeleteObject
 0x42d0c0 CreateCompatibleBitmap
 0x42d0c4 CreateCompatibleDC
 0x42d0c8 SelectObject
 0x42d0cc StretchDIBits
 0x42d0d0 DeleteDC
 0x42d0d4 GetObjectA
 0x42d0d8 SetBkColor
 0x42d0dc SetTextColor
 0x42d0e0 GetClipBox
 0x42d0e4 CreateRectRgn
 0x42d0e8 CreateDIBitmap
 0x42d0ec GetTextExtentPointA
 0x42d0f0 CreateBitmap
comdlg32.dll
 0x42d578 GetFileTitleA
WINSPOOL.DRV
 0x42d55c OpenPrinterA
 0x42d560 ClosePrinter
 0x42d564 DocumentPropertiesA
ADVAPI32.dll
 0x42d000 RegCloseKey
 0x42d004 RegSetValueExA
 0x42d008 RegOpenKeyExA
 0x42d00c RegCreateKeyExA
SHELL32.dll
 0x42d2f4 DragQueryFileA
 0x42d2f8 DragFinish
COMCTL32.dll
 0x42d014 None
oledlg.dll
 0x42d5c0 None
ole32.dll
 0x42d580 CLSIDFromString
 0x42d584 CoGetClassObject
 0x42d588 StgOpenStorageOnILockBytes
 0x42d58c StgCreateDocfileOnILockBytes
 0x42d590 CreateILockBytesOnHGlobal
 0x42d594 CoTaskMemFree
 0x42d598 CoTaskMemAlloc
 0x42d59c OleInitialize
 0x42d5a0 OleUninitialize
 0x42d5a4 CoFreeUnusedLibraries
 0x42d5a8 CoRegisterMessageFilter
 0x42d5ac CoRevokeClassObject
 0x42d5b0 OleFlushClipboard
 0x42d5b4 OleIsCurrentClipboard
 0x42d5b8 CLSIDFromProgID
OLEPRO32.DLL
 0x42d2ec None
OLEAUT32.dll
 0x42d2c4 SysFreeString
 0x42d2c8 SysAllocStringLen
 0x42d2cc VariantClear
 0x42d2d0 VariantTimeToSystemTime
 0x42d2d4 VariantCopy
 0x42d2d8 VariantChangeType
 0x42d2dc SysAllocString
 0x42d2e0 SysAllocStringByteLen
 0x42d2e4 SysStringLen
WSOCK32.dll
 0x42d56c WSAStartup
 0x42d570 WSACleanup

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure