Report - Coodesker-x64_1.0.7.0.exe

Generic Malware Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check
ScreenShot
Created 2024.10.26 06:06 Machine s1_win7_x6401
Filename Coodesker-x64_1.0.7.0.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
2
Behavior Score
2.2
ZERO API file : clean
VT API (file) 13 detected (Tedy, malicious, many, ai score=80, susgen, PossibleThreat)
md5 e58e97726528ec439d868e27e1bcec52
sha256 37badafd505204b3481023d8b82081420a07cdb7e7fac5260b6c297c9bab0916
ssdeep 98304:333PtEnxG/KzaiR1A+Q585/fSgVPibCysmLCGO+gBNS4Y:31ukimN+QoHSkibAW/Gm
imphash edf648b5b5a1f70a447894f3e677e7f8
impfuzzy 96:dKKbR5zgf8ApRLL3t5BWwRsJJh2ADudKxQ:3kWcsJz2ADuAxQ
  Network IP location

Signature (6cnts)

Level Description
watch File has been identified by 13 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (7cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

COMCTL32.dll
 0x1400a6050 InitCommonControlsEx
 0x1400a6058 None
 0x1400a6060 _TrackMouseEvent
KERNEL32.dll
 0x1400a6150 MultiByteToWideChar
 0x1400a6158 GetCommandLineW
 0x1400a6160 GetSystemTime
 0x1400a6168 GetCurrentProcessId
 0x1400a6170 FindResourceW
 0x1400a6178 LoadResource
 0x1400a6180 CloseHandle
 0x1400a6188 Sleep
 0x1400a6190 OpenProcess
 0x1400a6198 FindClose
 0x1400a61a0 GetModuleFileNameW
 0x1400a61a8 TerminateProcess
 0x1400a61b0 GetCurrentProcess
 0x1400a61b8 FindNextFileW
 0x1400a61c0 FindFirstFileW
 0x1400a61c8 SizeofResource
 0x1400a61d0 DeleteCriticalSection
 0x1400a61d8 DecodePointer
 0x1400a61e0 RaiseException
 0x1400a61e8 GetCurrentThreadId
 0x1400a61f0 InitializeCriticalSectionEx
 0x1400a61f8 LoadLibraryExA
 0x1400a6200 VirtualProtect
 0x1400a6208 WriteConsoleW
 0x1400a6210 SetEndOfFile
 0x1400a6218 FlushFileBuffers
 0x1400a6220 GetConsoleCP
 0x1400a6228 SetStdHandle
 0x1400a6230 GetProcessHeap
 0x1400a6238 SetEnvironmentVariableW
 0x1400a6240 FreeEnvironmentStringsW
 0x1400a6248 GetEnvironmentStringsW
 0x1400a6250 LeaveCriticalSection
 0x1400a6258 EnterCriticalSection
 0x1400a6260 GetProcAddress
 0x1400a6268 LocalFree
 0x1400a6270 GetModuleHandleW
 0x1400a6278 FreeLibrary
 0x1400a6280 GetCommandLineA
 0x1400a6288 GetOEMCP
 0x1400a6290 lstrcmpiW
 0x1400a6298 GetACP
 0x1400a62a0 IsValidCodePage
 0x1400a62a8 FindFirstFileExW
 0x1400a62b0 LoadLibraryExW
 0x1400a62b8 GetLastError
 0x1400a62c0 SetLastError
 0x1400a62c8 GetStdHandle
 0x1400a62d0 SetErrorMode
 0x1400a62d8 CreateFileW
 0x1400a62e0 GetVersionExW
 0x1400a62e8 UnmapViewOfFile
 0x1400a62f0 GetVersion
 0x1400a62f8 CreateToolhelp32Snapshot
 0x1400a6300 Process32NextW
 0x1400a6308 OutputDebugStringW
 0x1400a6310 LockResource
 0x1400a6318 GlobalAlloc
 0x1400a6320 Process32FirstW
 0x1400a6328 GlobalFree
 0x1400a6330 GetSystemInfo
 0x1400a6338 LoadLibraryW
 0x1400a6340 WideCharToMultiByte
 0x1400a6348 CreateFileMappingW
 0x1400a6350 MapViewOfFile
 0x1400a6358 VirtualQuery
 0x1400a6360 VerifyVersionInfoW
 0x1400a6368 VerSetConditionMask
 0x1400a6370 GetTickCount
 0x1400a6378 SetFilePointer
 0x1400a6380 ReadFile
 0x1400a6388 SystemTimeToFileTime
 0x1400a6390 GetCurrentDirectoryW
 0x1400a6398 LocalFileTimeToFileTime
 0x1400a63a0 GetFileAttributesW
 0x1400a63a8 CreateDirectoryW
 0x1400a63b0 WriteFile
 0x1400a63b8 SetFileTime
 0x1400a63c0 GlobalSize
 0x1400a63c8 GlobalLock
 0x1400a63d0 GlobalUnlock
 0x1400a63d8 GetSystemDirectoryW
 0x1400a63e0 MulDiv
 0x1400a63e8 QueryPerformanceFrequency
 0x1400a63f0 QueryPerformanceCounter
 0x1400a63f8 GetModuleHandleA
 0x1400a6400 GetFileSize
 0x1400a6408 GetFileSizeEx
 0x1400a6410 GetEnvironmentVariableW
 0x1400a6418 GetStringTypeW
 0x1400a6420 EncodePointer
 0x1400a6428 GetCPInfo
 0x1400a6430 CompareStringW
 0x1400a6438 LCMapStringW
 0x1400a6440 InitializeCriticalSectionAndSpinCount
 0x1400a6448 CreateEventW
 0x1400a6450 TlsAlloc
 0x1400a6458 TlsGetValue
 0x1400a6460 TlsSetValue
 0x1400a6468 TlsFree
 0x1400a6470 GetSystemTimeAsFileTime
 0x1400a6478 IsDebuggerPresent
 0x1400a6480 RtlCaptureContext
 0x1400a6488 RtlLookupFunctionEntry
 0x1400a6490 RtlVirtualUnwind
 0x1400a6498 UnhandledExceptionFilter
 0x1400a64a0 SetUnhandledExceptionFilter
 0x1400a64a8 IsProcessorFeaturePresent
 0x1400a64b0 SetEvent
 0x1400a64b8 ResetEvent
 0x1400a64c0 WaitForSingleObjectEx
 0x1400a64c8 GetStartupInfoW
 0x1400a64d0 InitializeSListHead
 0x1400a64d8 RtlUnwindEx
 0x1400a64e0 RtlPcToFileHeader
 0x1400a64e8 CreateThread
 0x1400a64f0 ExitThread
 0x1400a64f8 FreeLibraryAndExitThread
 0x1400a6500 GetModuleHandleExW
 0x1400a6508 ExitProcess
 0x1400a6510 HeapFree
 0x1400a6518 HeapAlloc
 0x1400a6520 HeapSize
 0x1400a6528 HeapReAlloc
 0x1400a6530 GetFileType
 0x1400a6538 SetFilePointerEx
 0x1400a6540 GetConsoleMode
 0x1400a6548 ReadConsoleW
 0x1400a6550 RtlUnwind
USER32.dll
 0x1400a65c8 SystemParametersInfoW
 0x1400a65d0 GetDesktopWindow
 0x1400a65d8 GetMonitorInfoW
 0x1400a65e0 IsWindow
 0x1400a65e8 ShowWindow
 0x1400a65f0 GetSystemMetrics
 0x1400a65f8 MonitorFromWindow
 0x1400a6600 InflateRect
 0x1400a6608 GetWindowRect
 0x1400a6610 MonitorFromPoint
 0x1400a6618 ReleaseDC
 0x1400a6620 LoadCursorW
 0x1400a6628 RegisterClassW
 0x1400a6630 GetClassInfoExW
 0x1400a6638 RegisterClassExW
 0x1400a6640 SetWindowLongPtrW
 0x1400a6648 CreateWindowExW
 0x1400a6650 GetWindowLongW
 0x1400a6658 SetWindowLongW
 0x1400a6660 IsIconic
 0x1400a6668 SetWindowPos
 0x1400a6670 LoadImageW
 0x1400a6678 SendMessageW
 0x1400a6680 CallWindowProcW
 0x1400a6688 SetPropW
 0x1400a6690 GetPropW
 0x1400a6698 GetDC
 0x1400a66a0 SetWindowTextW
 0x1400a66a8 InvalidateRect
 0x1400a66b0 ScreenToClient
 0x1400a66b8 GetKeyState
 0x1400a66c0 GetCursorPos
 0x1400a66c8 GetFocus
 0x1400a66d0 SetCapture
 0x1400a66d8 ReleaseCapture
 0x1400a66e0 BeginPaint
 0x1400a66e8 EndPaint
 0x1400a66f0 MoveWindow
 0x1400a66f8 GetUpdateRect
 0x1400a6700 GetClientRect
 0x1400a6708 IsRectEmpty
 0x1400a6710 IntersectRect
 0x1400a6718 UpdateLayeredWindow
 0x1400a6720 PtInRect
 0x1400a6728 wsprintfW
 0x1400a6730 OffsetRect
 0x1400a6738 UnionRect
 0x1400a6740 SetCursor
 0x1400a6748 IsZoomed
 0x1400a6750 SetWindowRgn
 0x1400a6758 MessageBoxW
 0x1400a6760 IsWindowVisible
 0x1400a6768 ClientToScreen
 0x1400a6770 GetSysColor
 0x1400a6778 GetAsyncKeyState
 0x1400a6780 OpenClipboard
 0x1400a6788 IsClipboardFormatAvailable
 0x1400a6790 GetClipboardData
 0x1400a6798 CloseClipboard
 0x1400a67a0 EmptyClipboard
 0x1400a67a8 SetClipboardData
 0x1400a67b0 MapWindowPoints
 0x1400a67b8 GetParent
 0x1400a67c0 DrawTextW
 0x1400a67c8 PostMessageW
 0x1400a67d0 GetWindowThreadProcessId
 0x1400a67d8 SetForegroundWindow
 0x1400a67e0 FindWindowW
 0x1400a67e8 DefWindowProcW
 0x1400a67f0 DestroyWindow
 0x1400a67f8 GetWindowLongPtrW
 0x1400a6800 TranslateMessage
 0x1400a6808 GetWindow
 0x1400a6810 SetFocus
 0x1400a6818 PostQuitMessage
 0x1400a6820 EnableWindow
 0x1400a6828 GetMessageW
 0x1400a6830 DispatchMessageW
 0x1400a6838 PeekMessageW
 0x1400a6840 CharNextW
ADVAPI32.dll
 0x1400a6000 RegDeleteValueW
 0x1400a6008 RegOpenKeyExW
 0x1400a6010 RegCloseKey
 0x1400a6018 RegQueryValueExW
 0x1400a6020 RegSetValueExW
 0x1400a6028 RegEnumKeyExW
 0x1400a6030 RegCreateKeyExW
 0x1400a6038 RegDeleteKeyW
 0x1400a6040 RegQueryInfoKeyW
SHELL32.dll
 0x1400a6580 SHGetPathFromIDListW
 0x1400a6588 SHBrowseForFolderW
 0x1400a6590 SHCreateShellItem
 0x1400a6598 SHGetSpecialFolderLocation
 0x1400a65a0 SHGetFolderPathW
 0x1400a65a8 None
 0x1400a65b0 CommandLineToArgvW
 0x1400a65b8 ShellExecuteW
ole32.dll
 0x1400a6868 CoTaskMemFree
 0x1400a6870 OleInitialize
 0x1400a6878 CoTaskMemAlloc
 0x1400a6880 CoInitialize
 0x1400a6888 OleUninitialize
 0x1400a6890 CoInitializeEx
 0x1400a6898 CoCreateInstance
 0x1400a68a0 CreateStreamOnHGlobal
 0x1400a68a8 CoUninitialize
 0x1400a68b0 CoTaskMemRealloc
OLEAUT32.dll
 0x1400a6560 SysAllocString
 0x1400a6568 SysFreeString
 0x1400a6570 VarUI4FromStr
IMM32.dll
 0x1400a6130 ImmSetCompositionWindow
 0x1400a6138 ImmReleaseContext
 0x1400a6140 ImmGetContext
WINMM.dll
 0x1400a6850 timeSetEvent
 0x1400a6858 timeKillEvent
GDI32.dll
 0x1400a6070 CreateFontIndirectW
 0x1400a6078 GetStockObject
 0x1400a6080 GetObjectW
 0x1400a6088 BitBlt
 0x1400a6090 DeleteObject
 0x1400a6098 SelectObject
 0x1400a60a0 CreateRoundRectRgn
 0x1400a60a8 CreateDIBSection
 0x1400a60b0 StretchBlt
 0x1400a60b8 CreateCompatibleDC
 0x1400a60c0 DeleteDC
 0x1400a60c8 SaveDC
 0x1400a60d0 RestoreDC
 0x1400a60d8 GetWindowOrgEx
 0x1400a60e0 SetWindowOrgEx
 0x1400a60e8 SetStretchBltMode
 0x1400a60f0 SetTextColor
 0x1400a60f8 GetDeviceCaps
 0x1400a6100 SetBkColor
 0x1400a6108 ExtSelectClipRgn
 0x1400a6110 CreateRectRgnIndirect
 0x1400a6118 GetObjectA
 0x1400a6120 SetBkMode

EAT(Export Address Table) Library

0x1400100e0 getopt_a
0x140010150 getopt_long_a
0x1400101c0 getopt_long_only_a
0x140010e40 getopt_long_only_w
0x140010dd0 getopt_long_w
0x140010d60 getopt_w
0x1400ea228 optarg_a
0x1400ea230 optarg_w
0x1400e4b58 opterr
0x1400e4b54 optind
0x1400e4b50 optopt


Similarity measure (PE file only) - Checking for service failure