Report - SSD-Z.exe

Malicious Library Malicious Packer UPX PE File PE32 MZP Format
ScreenShot
Created 2024.09.24 18:49 Machine s1_win7_x6401
Filename SSD-Z.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
2
Behavior Score
2.2
ZERO API file : clean
VT API (file) 1 detected (Malicious)
md5 dc6e1b46c89572020133463ec43ca414
sha256 74a0850369ba9ffcbdeeb6bd087a4de1105055d2338378b83e79a91b3e2a5db0
ssdeep 12288:D71gfd+H6mAn3HMHQKOfmv4SBZaRtkuyQrioUaDBfLSpQOhygGyBjPVP+PVPXP04:X1gfdIAiHOfgDaRt/HeoUaDBfLoxcjy
imphash 4f1019e839ee8fedffeb11e896101ca9
impfuzzy 192:x3zebpijGx21KHmgbuuALSUvK9T0QSq4AC2hi:x3zeb81gAg9ra
  Network IP location

Signature (6cnts)

Level Description
watch Queries information on disks
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (6cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x4a0154 GetCurrentThreadId
 0x4a0158 DeleteCriticalSection
 0x4a015c LeaveCriticalSection
 0x4a0160 EnterCriticalSection
 0x4a0164 InitializeCriticalSection
 0x4a0168 VirtualFree
 0x4a016c VirtualAlloc
 0x4a0170 LocalFree
 0x4a0174 LocalAlloc
 0x4a0178 InterlockedDecrement
 0x4a017c InterlockedIncrement
 0x4a0180 VirtualQuery
 0x4a0184 WideCharToMultiByte
 0x4a0188 MultiByteToWideChar
 0x4a018c lstrlenA
 0x4a0190 lstrcpynA
 0x4a0194 lstrcpyA
 0x4a0198 LoadLibraryExA
 0x4a019c GetThreadLocale
 0x4a01a0 GetStartupInfoA
 0x4a01a4 GetProcAddress
 0x4a01a8 GetModuleHandleA
 0x4a01ac GetModuleFileNameA
 0x4a01b0 GetLocaleInfoA
 0x4a01b4 GetLastError
 0x4a01b8 GetCommandLineA
 0x4a01bc FreeLibrary
 0x4a01c0 FindFirstFileA
 0x4a01c4 FindClose
 0x4a01c8 ExitProcess
 0x4a01cc WriteFile
 0x4a01d0 UnhandledExceptionFilter
 0x4a01d4 SetFilePointer
 0x4a01d8 SetEndOfFile
 0x4a01dc RtlUnwind
 0x4a01e0 ReadFile
 0x4a01e4 RaiseException
 0x4a01e8 GetStdHandle
 0x4a01ec GetFileSize
 0x4a01f0 GetSystemTime
 0x4a01f4 GetFileType
 0x4a01f8 CreateFileA
 0x4a01fc CloseHandle
user32.dll
 0x4a0204 GetKeyboardType
 0x4a0208 LoadStringA
 0x4a020c MessageBoxA
 0x4a0210 CharNextA
advapi32.dll
 0x4a0218 RegQueryValueExA
 0x4a021c RegOpenKeyExA
 0x4a0220 RegCloseKey
oleaut32.dll
 0x4a0228 VariantChangeTypeEx
 0x4a022c VariantCopyInd
 0x4a0230 VariantClear
 0x4a0234 SysStringLen
 0x4a0238 SysFreeString
 0x4a023c SysReAllocStringLen
 0x4a0240 SysAllocStringLen
kernel32.dll
 0x4a0248 TlsSetValue
 0x4a024c TlsGetValue
 0x4a0250 LocalAlloc
 0x4a0254 GetModuleHandleA
 0x4a0258 GetModuleFileNameA
advapi32.dll
 0x4a0260 RegQueryValueExA
 0x4a0264 RegOpenKeyExA
 0x4a0268 RegCloseKey
kernel32.dll
 0x4a0270 lstrcpyA
 0x4a0274 lstrcmpA
 0x4a0278 WritePrivateProfileStringA
 0x4a027c WriteFile
 0x4a0280 WaitForSingleObject
 0x4a0284 WaitForMultipleObjects
 0x4a0288 VirtualQuery
 0x4a028c VirtualAlloc
 0x4a0290 SystemTimeToTzSpecificLocalTime
 0x4a0294 Sleep
 0x4a0298 SizeofResource
 0x4a029c SetThreadLocale
 0x4a02a0 SetFilePointer
 0x4a02a4 SetEvent
 0x4a02a8 SetErrorMode
 0x4a02ac SetEndOfFile
 0x4a02b0 ReadFile
 0x4a02b4 QueryPerformanceFrequency
 0x4a02b8 QueryPerformanceCounter
 0x4a02bc QueryDosDeviceA
 0x4a02c0 MulDiv
 0x4a02c4 LockResource
 0x4a02c8 LoadResource
 0x4a02cc LoadLibraryA
 0x4a02d0 LeaveCriticalSection
 0x4a02d4 InitializeCriticalSection
 0x4a02d8 GlobalUnlock
 0x4a02dc GlobalReAlloc
 0x4a02e0 GlobalHandle
 0x4a02e4 GlobalLock
 0x4a02e8 GlobalFree
 0x4a02ec GlobalDeleteAtom
 0x4a02f0 GlobalAlloc
 0x4a02f4 GlobalAddAtomA
 0x4a02f8 GetVolumeInformationA
 0x4a02fc GetVersionExA
 0x4a0300 GetVersion
 0x4a0304 GetTimeZoneInformation
 0x4a0308 GetTickCount
 0x4a030c GetThreadLocale
 0x4a0310 GetSystemInfo
 0x4a0314 GetProcAddress
 0x4a0318 GetPrivateProfileStringA
 0x4a031c GetModuleHandleA
 0x4a0320 GetModuleFileNameA
 0x4a0324 GetLogicalDrives
 0x4a0328 GetLogicalDriveStringsA
 0x4a032c GetLocaleInfoA
 0x4a0330 GetLocalTime
 0x4a0334 GetLastError
 0x4a0338 GetFileAttributesA
 0x4a033c GetDiskFreeSpaceA
 0x4a0340 GetDateFormatA
 0x4a0344 GetCurrentThreadId
 0x4a0348 GetCurrentProcessId
 0x4a034c GetCurrentDirectoryA
 0x4a0350 GetCommandLineA
 0x4a0354 GetCPInfo
 0x4a0358 FreeResource
 0x4a035c FreeLibrary
 0x4a0360 FormatMessageA
 0x4a0364 FlushFileBuffers
 0x4a0368 FindResourceA
 0x4a036c EnumCalendarInfoA
 0x4a0370 EnterCriticalSection
 0x4a0374 DeviceIoControl
 0x4a0378 DeleteCriticalSection
 0x4a037c CreateThread
 0x4a0380 CreateFileA
 0x4a0384 CreateEventA
 0x4a0388 CompareStringA
 0x4a038c CloseHandle
version.dll
 0x4a0394 VerQueryValueA
 0x4a0398 GetFileVersionInfoSizeA
 0x4a039c GetFileVersionInfoA
gdi32.dll
 0x4a03a4 UnrealizeObject
 0x4a03a8 TextOutA
 0x4a03ac StretchBlt
 0x4a03b0 SetWindowOrgEx
 0x4a03b4 SetWinMetaFileBits
 0x4a03b8 SetViewportOrgEx
 0x4a03bc SetTextColor
 0x4a03c0 SetTextAlign
 0x4a03c4 SetStretchBltMode
 0x4a03c8 SetROP2
 0x4a03cc SetPixel
 0x4a03d0 SetEnhMetaFileBits
 0x4a03d4 SetDIBColorTable
 0x4a03d8 SetBrushOrgEx
 0x4a03dc SetBkMode
 0x4a03e0 SetBkColor
 0x4a03e4 SelectPalette
 0x4a03e8 SelectObject
 0x4a03ec SaveDC
 0x4a03f0 RestoreDC
 0x4a03f4 Rectangle
 0x4a03f8 RectVisible
 0x4a03fc RealizePalette
 0x4a0400 Polyline
 0x4a0404 Polygon
 0x4a0408 PlayEnhMetaFile
 0x4a040c PatBlt
 0x4a0410 MoveToEx
 0x4a0414 MaskBlt
 0x4a0418 LineTo
 0x4a041c IntersectClipRect
 0x4a0420 GetWindowOrgEx
 0x4a0424 GetWinMetaFileBits
 0x4a0428 GetTextMetricsA
 0x4a042c GetTextExtentPoint32A
 0x4a0430 GetSystemPaletteEntries
 0x4a0434 GetStockObject
 0x4a0438 GetPixel
 0x4a043c GetPaletteEntries
 0x4a0440 GetObjectA
 0x4a0444 GetEnhMetaFilePaletteEntries
 0x4a0448 GetEnhMetaFileHeader
 0x4a044c GetEnhMetaFileBits
 0x4a0450 GetDeviceCaps
 0x4a0454 GetDIBits
 0x4a0458 GetDIBColorTable
 0x4a045c GetDCOrgEx
 0x4a0460 GetCurrentPositionEx
 0x4a0464 GetCurrentObject
 0x4a0468 GetClipBox
 0x4a046c GetBrushOrgEx
 0x4a0470 GetBitmapBits
 0x4a0474 ExtTextOutA
 0x4a0478 ExcludeClipRect
 0x4a047c DeleteObject
 0x4a0480 DeleteEnhMetaFile
 0x4a0484 DeleteDC
 0x4a0488 CreateSolidBrush
 0x4a048c CreatePenIndirect
 0x4a0490 CreatePen
 0x4a0494 CreatePalette
 0x4a0498 CreateHalftonePalette
 0x4a049c CreateFontIndirectA
 0x4a04a0 CreateFontA
 0x4a04a4 CreateDIBitmap
 0x4a04a8 CreateDIBSection
 0x4a04ac CreateCompatibleDC
 0x4a04b0 CreateCompatibleBitmap
 0x4a04b4 CreateBrushIndirect
 0x4a04b8 CreateBitmap
 0x4a04bc CopyEnhMetaFileA
 0x4a04c0 BitBlt
user32.dll
 0x4a04c8 WindowFromPoint
 0x4a04cc WinHelpA
 0x4a04d0 WaitMessage
 0x4a04d4 UpdateWindow
 0x4a04d8 UnregisterClassA
 0x4a04dc UnhookWindowsHookEx
 0x4a04e0 TranslateMessage
 0x4a04e4 TranslateMDISysAccel
 0x4a04e8 TrackPopupMenu
 0x4a04ec SystemParametersInfoA
 0x4a04f0 ShowWindow
 0x4a04f4 ShowScrollBar
 0x4a04f8 ShowOwnedPopups
 0x4a04fc ShowCursor
 0x4a0500 SetWindowsHookExA
 0x4a0504 SetWindowTextA
 0x4a0508 SetWindowPos
 0x4a050c SetWindowPlacement
 0x4a0510 SetWindowLongA
 0x4a0514 SetTimer
 0x4a0518 SetScrollRange
 0x4a051c SetScrollPos
 0x4a0520 SetScrollInfo
 0x4a0524 SetRect
 0x4a0528 SetPropA
 0x4a052c SetMenuItemInfoA
 0x4a0530 SetMenu
 0x4a0534 SetForegroundWindow
 0x4a0538 SetFocus
 0x4a053c SetDlgItemTextA
 0x4a0540 SetCursor
 0x4a0544 SetClipboardData
 0x4a0548 SetClassLongA
 0x4a054c SetCapture
 0x4a0550 SetActiveWindow
 0x4a0554 SendMessageA
 0x4a0558 SendDlgItemMessageA
 0x4a055c ScrollWindow
 0x4a0560 ScreenToClient
 0x4a0564 RemovePropA
 0x4a0568 RemoveMenu
 0x4a056c ReleaseDC
 0x4a0570 ReleaseCapture
 0x4a0574 RegisterWindowMessageA
 0x4a0578 RegisterClipboardFormatA
 0x4a057c RegisterClassA
 0x4a0580 RedrawWindow
 0x4a0584 PtInRect
 0x4a0588 PostQuitMessage
 0x4a058c PostMessageA
 0x4a0590 PeekMessageA
 0x4a0594 OpenClipboard
 0x4a0598 OffsetRect
 0x4a059c OemToCharA
 0x4a05a0 MessageBoxA
 0x4a05a4 MapWindowPoints
 0x4a05a8 MapVirtualKeyA
 0x4a05ac LoadStringA
 0x4a05b0 LoadKeyboardLayoutA
 0x4a05b4 LoadImageA
 0x4a05b8 LoadIconA
 0x4a05bc LoadCursorA
 0x4a05c0 LoadBitmapA
 0x4a05c4 KillTimer
 0x4a05c8 IsZoomed
 0x4a05cc IsWindowVisible
 0x4a05d0 IsWindowEnabled
 0x4a05d4 IsWindow
 0x4a05d8 IsRectEmpty
 0x4a05dc IsIconic
 0x4a05e0 IsDialogMessageA
 0x4a05e4 IsChild
 0x4a05e8 InvalidateRect
 0x4a05ec IntersectRect
 0x4a05f0 InsertMenuItemA
 0x4a05f4 InsertMenuA
 0x4a05f8 InflateRect
 0x4a05fc GetWindowThreadProcessId
 0x4a0600 GetWindowTextLengthA
 0x4a0604 GetWindowTextA
 0x4a0608 GetWindowRect
 0x4a060c GetWindowPlacement
 0x4a0610 GetWindowLongA
 0x4a0614 GetWindowDC
 0x4a0618 GetTopWindow
 0x4a061c GetSystemMetrics
 0x4a0620 GetSystemMenu
 0x4a0624 GetSysColor
 0x4a0628 GetSubMenu
 0x4a062c GetScrollRange
 0x4a0630 GetScrollPos
 0x4a0634 GetScrollInfo
 0x4a0638 GetPropA
 0x4a063c GetPriorityClipboardFormat
 0x4a0640 GetParent
 0x4a0644 GetWindow
 0x4a0648 GetMessagePos
 0x4a064c GetMenuStringA
 0x4a0650 GetMenuState
 0x4a0654 GetMenuItemInfoA
 0x4a0658 GetMenuItemID
 0x4a065c GetMenuItemCount
 0x4a0660 GetMenu
 0x4a0664 GetLastActivePopup
 0x4a0668 GetKeyboardState
 0x4a066c GetKeyboardLayoutList
 0x4a0670 GetKeyboardLayout
 0x4a0674 GetKeyState
 0x4a0678 GetKeyNameTextA
 0x4a067c GetIconInfo
 0x4a0680 GetForegroundWindow
 0x4a0684 GetFocus
 0x4a0688 GetDoubleClickTime
 0x4a068c GetDlgItemTextA
 0x4a0690 GetDlgItem
 0x4a0694 GetDesktopWindow
 0x4a0698 GetDCEx
 0x4a069c GetDC
 0x4a06a0 GetCursorPos
 0x4a06a4 GetCursor
 0x4a06a8 GetClipboardData
 0x4a06ac GetClientRect
 0x4a06b0 GetClassNameA
 0x4a06b4 GetClassInfoA
 0x4a06b8 GetCapture
 0x4a06bc GetActiveWindow
 0x4a06c0 FrameRect
 0x4a06c4 FindWindowExA
 0x4a06c8 FindWindowA
 0x4a06cc FillRect
 0x4a06d0 EqualRect
 0x4a06d4 EnumWindows
 0x4a06d8 EnumThreadWindows
 0x4a06dc EndPaint
 0x4a06e0 EndDialog
 0x4a06e4 EnableWindow
 0x4a06e8 EnableScrollBar
 0x4a06ec EnableMenuItem
 0x4a06f0 EmptyClipboard
 0x4a06f4 DrawTextA
 0x4a06f8 DrawMenuBar
 0x4a06fc DrawIconEx
 0x4a0700 DrawIcon
 0x4a0704 DrawFrameControl
 0x4a0708 DrawFocusRect
 0x4a070c DrawEdge
 0x4a0710 DispatchMessageA
 0x4a0714 DialogBoxParamA
 0x4a0718 DestroyWindow
 0x4a071c DestroyMenu
 0x4a0720 DestroyIcon
 0x4a0724 DestroyCursor
 0x4a0728 DeleteMenu
 0x4a072c DefWindowProcA
 0x4a0730 DefMDIChildProcA
 0x4a0734 DefFrameProcA
 0x4a0738 CreateWindowExA
 0x4a073c CreatePopupMenu
 0x4a0740 CreateMenu
 0x4a0744 CreateIcon
 0x4a0748 CloseClipboard
 0x4a074c ClientToScreen
 0x4a0750 ChildWindowFromPoint
 0x4a0754 CheckMenuItem
 0x4a0758 CallWindowProcA
 0x4a075c CallNextHookEx
 0x4a0760 BeginPaint
 0x4a0764 AppendMenuA
 0x4a0768 CharLowerBuffA
 0x4a076c CharLowerA
 0x4a0770 AdjustWindowRectEx
 0x4a0774 ActivateKeyboardLayout
ole32.dll
 0x4a077c IsEqualGUID
comctl32.dll
 0x4a0784 ImageList_SetIconSize
 0x4a0788 ImageList_GetIconSize
 0x4a078c ImageList_Write
 0x4a0790 ImageList_Read
 0x4a0794 ImageList_GetDragImage
 0x4a0798 ImageList_DragShowNolock
 0x4a079c ImageList_SetDragCursorImage
 0x4a07a0 ImageList_DragMove
 0x4a07a4 ImageList_DragLeave
 0x4a07a8 ImageList_DragEnter
 0x4a07ac ImageList_EndDrag
 0x4a07b0 ImageList_BeginDrag
 0x4a07b4 ImageList_GetIcon
 0x4a07b8 ImageList_Remove
 0x4a07bc ImageList_DrawEx
 0x4a07c0 ImageList_AddMasked
 0x4a07c4 ImageList_Draw
 0x4a07c8 ImageList_GetBkColor
 0x4a07cc ImageList_SetBkColor
 0x4a07d0 ImageList_ReplaceIcon
 0x4a07d4 ImageList_Add
 0x4a07d8 ImageList_GetImageCount
 0x4a07dc ImageList_Destroy
 0x4a07e0 ImageList_Create
 0x4a07e4 InitCommonControls
shell32.dll
 0x4a07ec ShellExecuteA
 0x4a07f0 SHGetFileInfoA
 0x4a07f4 DragQueryFileA
 0x4a07f8 DragAcceptFiles
ntdll.dll
 0x4a0800 RtlGetVersion
kernel32.dll
 0x4a0808 SetFilePointerEx
 0x4a080c GetVolumeNameForVolumeMountPointA
wininet.dll
 0x4a0814 InternetReadFile
 0x4a0818 InternetOpenA
 0x4a081c InternetConnectA
 0x4a0820 InternetCloseHandle
 0x4a0824 HttpSendRequestA
 0x4a0828 HttpQueryInfoA
 0x4a082c HttpOpenRequestA

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure