Report - ghc7.exe

Malicious Library UPX PE File PE64 OS Processor Check
ScreenShot
Created 2024.09.13 17:07 Machine s1_win7_x6401
Filename ghc7.exe
Type PE32+ executable (console) x86-64, for MS Windows
AI Score
5
Behavior Score
0.6
ZERO API file : clean
VT API (file)
md5 8f0f4ac2337ac290e4cd09dde03664ce
sha256 8d89bc9e20d0ef06258026fce8c5538c1e4e82ac4c643a207bb135321b44e2e9
ssdeep 24576:tIx9zs2z0/ppLj3YSL0hvSO8yQJOt7SN5MhVk/l4sNt9w:8z0/3j3YSwGyQJOt7YKV+l4sNt9w
imphash 77e7e46c6e31b8fa8f0d7c011e3a7610
impfuzzy 96:V6Kdxy/E+4mSDHme7WrXKx6CxuJGOoAdKaa1kgrOP63qgCiK5Zoh:VFacwSD72eOrd4drOSagCiK0h
  Network IP location

Signature (3cnts)

Level Description
info Checks amount of memory in system
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

ADVAPI32.dll
 0x50ed08 GetFileSecurityW
 0x50ed10 RegCloseKey
 0x50ed18 RegConnectRegistryW
 0x50ed20 RegCreateKeyExW
 0x50ed28 RegCreateKeyW
 0x50ed30 RegDeleteKeyW
 0x50ed38 RegDeleteValueW
 0x50ed40 RegEnumKeyW
 0x50ed48 RegEnumValueW
 0x50ed50 RegFlushKey
 0x50ed58 RegLoadKeyW
 0x50ed60 RegNotifyChangeKeyValue
 0x50ed68 RegOpenKeyExW
 0x50ed70 RegOpenKeyW
 0x50ed78 RegQueryInfoKeyW
 0x50ed80 RegQueryValueExW
 0x50ed88 RegQueryValueW
 0x50ed90 RegReplaceKeyW
 0x50ed98 RegRestoreKeyW
 0x50eda0 RegSaveKeyW
 0x50eda8 RegSetValueExW
 0x50edb0 RegSetValueW
 0x50edb8 RegUnLoadKeyW
GDI32.dll
 0x50edc8 AngleArc
 0x50edd0 Arc
 0x50edd8 ArcTo
 0x50ede0 BeginPath
 0x50ede8 BitBlt
 0x50edf0 CancelDC
 0x50edf8 Chord
 0x50ee00 CloseFigure
 0x50ee08 CombineRgn
 0x50ee10 CreateBitmap
 0x50ee18 CreateBitmapIndirect
 0x50ee20 CreateCompatibleBitmap
 0x50ee28 CreateCompatibleDC
 0x50ee30 CreateDIBPatternBrushPt
 0x50ee38 CreateDIBitmap
 0x50ee40 CreateEllipticRgn
 0x50ee48 CreateEllipticRgnIndirect
 0x50ee50 CreateFontW
 0x50ee58 CreateHatchBrush
 0x50ee60 CreatePatternBrush
 0x50ee68 CreatePen
 0x50ee70 CreatePolygonRgn
 0x50ee78 CreateRectRgn
 0x50ee80 CreateRectRgnIndirect
 0x50ee88 CreateRoundRectRgn
 0x50ee90 CreateSolidBrush
 0x50ee98 DeleteDC
 0x50eea0 DeleteObject
 0x50eea8 Ellipse
 0x50eeb0 EndPath
 0x50eeb8 EqualRgn
 0x50eec0 ExtSelectClipRgn
 0x50eec8 FillPath
 0x50eed0 FillRgn
 0x50eed8 FlattenPath
 0x50eee0 FrameRgn
 0x50eee8 GetArcDirection
 0x50eef0 GetBitmapDimensionEx
 0x50eef8 GetBkColor
 0x50ef00 GetBkMode
 0x50ef08 GetBrushOrgEx
 0x50ef10 GetCurrentObject
 0x50ef18 GetDCOrgEx
 0x50ef20 GetDIBits
 0x50ef28 GetGraphicsMode
 0x50ef30 GetMiterLimit
 0x50ef38 GetObjectW
 0x50ef40 GetPolyFillMode
 0x50ef48 GetRgnBox
 0x50ef50 GetStockObject
 0x50ef58 GetStretchBltMode
 0x50ef60 GetTextAlign
 0x50ef68 GetTextCharacterExtra
 0x50ef70 GetTextColor
 0x50ef78 GetTextExtentPoint32W
 0x50ef80 InvertRgn
 0x50ef88 LineTo
 0x50ef90 MaskBlt
 0x50ef98 MoveToEx
 0x50efa0 OffsetRgn
 0x50efa8 PaintRgn
 0x50efb0 PathToRegion
 0x50efb8 Pie
 0x50efc0 PlgBlt
 0x50efc8 PolyBezier
 0x50efd0 PolyBezierTo
 0x50efd8 Polygon
 0x50efe0 Polyline
 0x50efe8 PolylineTo
 0x50eff0 PtInRegion
 0x50eff8 RectInRegion
 0x50f000 Rectangle
 0x50f008 RestoreDC
 0x50f010 RoundRect
 0x50f018 SaveDC
 0x50f020 SelectClipPath
 0x50f028 SelectClipRgn
 0x50f030 SelectObject
 0x50f038 SelectPalette
 0x50f040 SetArcDirection
 0x50f048 SetBitmapDimensionEx
 0x50f050 SetBkColor
 0x50f058 SetBkMode
 0x50f060 SetBrushOrgEx
 0x50f068 SetDIBits
 0x50f070 SetGraphicsMode
 0x50f078 SetMiterLimit
 0x50f080 SetPolyFillMode
 0x50f088 SetStretchBltMode
 0x50f090 SetTextAlign
 0x50f098 SetTextCharacterExtra
 0x50f0a0 SetTextColor
 0x50f0a8 StretchBlt
 0x50f0b0 StrokeAndFillPath
 0x50f0b8 StrokePath
 0x50f0c0 TextOutW
 0x50f0c8 WidenPath
KERNEL32.dll
 0x50f0d8 CloseHandle
 0x50f0e0 CreateEventA
 0x50f0e8 CreateFileW
 0x50f0f0 CreatePipe
 0x50f0f8 CreateProcessW
 0x50f100 CreateSemaphoreA
 0x50f108 CreateThread
 0x50f110 CreateTimerQueue
 0x50f118 CreateTimerQueueTimer
 0x50f120 DeleteCriticalSection
 0x50f128 DeleteTimerQueueEx
 0x50f130 DeleteTimerQueueTimer
 0x50f138 DuplicateHandle
 0x50f140 EnterCriticalSection
 0x50f148 FindFirstVolumeW
 0x50f150 FindNextVolumeW
 0x50f158 FindVolumeClose
 0x50f160 FlushConsoleInputBuffer
 0x50f168 FormatMessageA
 0x50f170 FormatMessageW
 0x50f178 FreeEnvironmentStringsA
 0x50f180 FreeLibrary
 0x50f188 GetACP
 0x50f190 GetCPInfo
 0x50f198 GetConsoleCP
 0x50f1a0 GetConsoleMode
 0x50f1a8 GetCurrentProcess
 0x50f1b0 GetCurrentProcessId
 0x50f1b8 GetCurrentThread
 0x50f1c0 GetCurrentThreadId
 0x50f1c8 GetDiskFreeSpaceExW
 0x50f1d0 GetEnvironmentStrings
 0x50f1d8 GetExitCodeProcess
 0x50f1e0 GetFileAttributesA
 0x50f1e8 GetFileInformationByHandle
 0x50f1f0 GetFileSizeEx
 0x50f1f8 GetFileType
 0x50f200 GetLastError
 0x50f208 GetModuleFileNameA
 0x50f210 GetModuleHandleA
 0x50f218 GetProcAddress
 0x50f220 GetProcessTimes
 0x50f228 GetStartupInfoA
 0x50f230 GetStdHandle
 0x50f238 GetSystemInfo
 0x50f240 GetSystemTime
 0x50f248 GetSystemTimeAsFileTime
 0x50f250 GetThreadTimes
 0x50f258 GetTickCount
 0x50f260 GetTimeZoneInformation
 0x50f268 GetVolumeInformationW
 0x50f270 GlobalAlloc
 0x50f278 GlobalFree
 0x50f280 GlobalMemoryStatusEx
 0x50f288 InitializeCriticalSection
 0x50f290 IsDBCSLeadByteEx
 0x50f298 LeaveCriticalSection
 0x50f2a0 LoadLibraryW
 0x50f2a8 LocalFree
 0x50f2b0 MultiByteToWideChar
 0x50f2b8 OutputDebugStringA
 0x50f2c0 PeekConsoleInputA
 0x50f2c8 PeekNamedPipe
 0x50f2d0 QueryPerformanceCounter
 0x50f2d8 QueryPerformanceFrequency
 0x50f2e0 ReadConsoleInputA
 0x50f2e8 ReleaseSemaphore
 0x50f2f0 ResetEvent
 0x50f2f8 RtlAddFunctionTable
 0x50f300 RtlCaptureContext
 0x50f308 RtlLookupFunctionEntry
 0x50f310 RtlVirtualUnwind
 0x50f318 SetConsoleCtrlHandler
 0x50f320 SetConsoleMode
 0x50f328 SetEndOfFile
 0x50f330 SetEvent
 0x50f338 SetFilePointer
 0x50f340 SetHandleInformation
 0x50f348 SetLastError
 0x50f350 SetUnhandledExceptionFilter
 0x50f358 Sleep
 0x50f360 SystemTimeToFileTime
 0x50f368 TerminateProcess
 0x50f370 TlsGetValue
 0x50f378 UnhandledExceptionFilter
 0x50f380 UnmapViewOfFile
 0x50f388 VirtualAlloc
 0x50f390 VirtualFree
 0x50f398 VirtualProtect
 0x50f3a0 VirtualQuery
 0x50f3a8 WaitForMultipleObjects
 0x50f3b0 WaitForSingleObject
 0x50f3b8 WideCharToMultiByte
 0x50f3c0 WriteFile
 0x50f3c8 __C_specific_handler
msvcrt.dll
 0x50f3d8 _access
 0x50f3e0 _chmod
 0x50f3e8 _close
 0x50f3f0 _creat
 0x50f3f8 _dup
 0x50f400 _dup2
 0x50f408 _getpid
 0x50f410 _isatty
 0x50f418 _mkdir
 0x50f420 _read
 0x50f428 _setmode
 0x50f430 _strdup
 0x50f438 _umask
 0x50f440 _unlink
 0x50f448 _wcsdup
 0x50f450 _write
msvcrt.dll
 0x50f460 __dllonexit
 0x50f468 __getmainargs
 0x50f470 __initenv
 0x50f478 __iob_func
 0x50f480 __isascii
 0x50f488 __lconv_init
 0x50f490 __mb_cur_max
 0x50f498 __set_app_type
 0x50f4a0 __setusermatherr
 0x50f4a8 _acmdln
 0x50f4b0 _amsg_exit
 0x50f4b8 _beginthreadex
 0x50f4c0 _cexit
 0x50f4c8 _ctime64
 0x50f4d0 _environ
 0x50f4d8 _errno
 0x50f4e0 _findclose
 0x50f4e8 _findfirst64
 0x50f4f0 _findnext64
 0x50f4f8 _fmode
 0x50f500 _fstat64
 0x50f508 _fullpath
 0x50f510 _get_osfhandle
 0x50f518 _getpid
 0x50f520 _gmtime64
 0x50f528 _initterm
 0x50f530 _isatty
 0x50f538 _localtime64
 0x50f540 _lock
 0x50f548 _lseeki64
 0x50f550 _mktime64
 0x50f558 _onexit
 0x50f560 _open_osfhandle
 0x50f568 _time64
 0x50f570 _timezone
 0x50f578 _tzname
 0x50f580 _unlock
 0x50f588 _vsnprintf
 0x50f590 _wchmod
 0x50f598 _wfopen
 0x50f5a0 _wsopen
 0x50f5a8 _wstat64
 0x50f5b0 abort
 0x50f5b8 acos
 0x50f5c0 asin
 0x50f5c8 atan
 0x50f5d0 atof
 0x50f5d8 atoi
 0x50f5e0 search
 0x50f5e8 calloc
 0x50f5f0 cosh
 0x50f5f8 exit
 0x50f600 fclose
 0x50f608 feof
 0x50f610 ferror
 0x50f618 fflush
 0x50f620 fopen
 0x50f628 fopen_s
 0x50f630 fprintf
 0x50f638 fputc
 0x50f640 fread
 0x50f648 free
 0x50f650 fseek
 0x50f658 ftell
 0x50f660 fwrite
 0x50f668 getc
 0x50f670 getenv
 0x50f678 isalnum
 0x50f680 isalpha
 0x50f688 iscntrl
 0x50f690 isdigit
 0x50f698 islower
 0x50f6a0 isprint
 0x50f6a8 ispunct
 0x50f6b0 isspace
 0x50f6b8 isupper
 0x50f6c0 isxdigit
 0x50f6c8 localeconv
 0x50f6d0 malloc
 0x50f6d8 memchr
 0x50f6e0 memcmp
 0x50f6e8 memcpy
 0x50f6f0 memmove
 0x50f6f8 memset
 0x50f700 printf
 0x50f708 putc
 0x50f710 putchar
 0x50f718 puts
 0x50f720 raise
 0x50f728 realloc
 0x50f730 setlocale
 0x50f738 signal
 0x50f740 sinh
 0x50f748 sprintf
 0x50f750 sscanf
 0x50f758 strchr
 0x50f760 strcmp
 0x50f768 strcpy
 0x50f770 strerror
 0x50f778 strlen
 0x50f780 strncmp
 0x50f788 strncpy
 0x50f790 strrchr
 0x50f798 strtol
 0x50f7a0 swprintf
 0x50f7a8 tan
 0x50f7b0 tanh
 0x50f7b8 ungetc
 0x50f7c0 vfprintf
 0x50f7c8 vsprintf
 0x50f7d0 wcscmp
 0x50f7d8 wcscpy
 0x50f7e0 wcslen
 0x50f7e8 wprintf
SHELL32.dll
 0x50f7f8 CommandLineToArgvW
 0x50f800 SHGetFolderPathW
USER32.dll
 0x50f810 ChildWindowFromPoint
 0x50f818 ChildWindowFromPointEx
 0x50f820 DefWindowProcW
 0x50f828 DispatchMessageW
 0x50f830 GetMessageW
 0x50f838 GetWindowLongPtrW
 0x50f840 MenuItemFromPoint
 0x50f848 MessageBoxA
 0x50f850 SetWindowLongPtrW
 0x50f858 TranslateMessage
WINMM.dll
 0x50f868 timeBeginPeriod
 0x50f870 timeEndPeriod
 0x50f878 timeGetDevCaps
 0x50f880 timeGetTime
WSOCK32.dll
 0x50f890 WSAGetLastError
 0x50f898 ind
 0x50f8a0 closesocket
 0x50f8a8 connect
 0x50f8b0 gethostbyaddr
 0x50f8b8 gethostbyname
 0x50f8c0 gethostname
 0x50f8c8 getprotobyname
 0x50f8d0 getprotobynumber
 0x50f8d8 getservbyname
 0x50f8e0 getservbyport
 0x50f8e8 htonl
 0x50f8f0 htons
 0x50f8f8 inet_addr
 0x50f900 inet_ntoa
 0x50f908 listen
 0x50f910 ntohs
 0x50f918 recv
 0x50f920 recvfrom
 0x50f928 select
 0x50f930 send
 0x50f938 shutdown

EAT(Export Address Table) Library

0x4016d0 Mac


Similarity measure (PE file only) - Checking for service failure