ScreenShot
| Created | 2024.11.11 10:08 | Machine | s1_win7_x6403 |
| Filename | sgupdate.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | |||
| VT API (file) | 48 detected (Common, NewHeur, GenericKD, GenericRXQV, Unsafe, malicious, confidence, 100%, VBGenus, Attribute, HighConfidence, moderate confidence, Graftor, frxije, btj6KuYloQC, DownLoader28, R002C0PK224, cahw, Detected, Malware@#1bn7ev4h9d53z, R647606, BScope, VBKrypt, GdSda, Small, XAAMSV) | ||
| md5 | f60e2ff775cfbf5c3656d3a7a96fff3f | ||
| sha256 | bec799df3b1adecc61780ac2517fb0c74f3db7fcebc6c0ebad85c9eb59bb5a0f | ||
| ssdeep | 192:A9IrI0TjJfWrNxDbJMydLLl3uLvqUo3gXIRrEZCOpml5kPYTP2DyuzPO0BxtxD7v:A9oI2xCP9RdNuTqp36Iil4ECU/76BOx | ||
| imphash | 62ca9a6dab47fd20a56d0302c98ef2ac | ||
| impfuzzy | 48:nmE/wzQwgmlBTRgzkR937rs5TytiFNmeW4zplw+7pIkSakqJTSwpw8:nmE/GQfmlBTRgzkR9LrsxytiFNmeW4zh | ||
Network IP location
Signature (13cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 48 AntiVirus engines on VirusTotal as malicious |
| watch | Deletes executed files from disk |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Creates a suspicious process |
| notice | Drops an executable to the user AppData folder |
| notice | Foreign language identified in PE resource |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | One or more processes crashed |
Rules (20cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | Microsoft_Office_File_Zero | Microsoft Office File | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
PE API
IAT(Import Address Table) Library
MSVBVM60.DLL
0x401000 __vbaVarSub
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaStrVarMove
0x401018 __vbaFreeVarList
0x40101c __vbaEnd
0x401020 _adj_fdiv_m64
0x401024 __vbaLineInputVar
0x401028 _adj_fprem1
0x40102c __vbaRecAnsiToUni
0x401030 __vbaStrCat
0x401034 __vbaRecDestruct
0x401038 __vbaSetSystemError
0x40103c __vbaHresultCheckObj
0x401040 _adj_fdiv_m32
0x401044 __vbaOnError
0x401048 _adj_fdiv_m16i
0x40104c __vbaObjSetAddref
0x401050 _adj_fdivr_m16i
0x401054 None
0x401058 _CIsin
0x40105c __vbaChkstk
0x401060 __vbaFileClose
0x401064 EVENT_SINK_AddRef
0x401068 None
0x40106c DllFunctionCall
0x401070 _adj_fpatan
0x401074 __vbaRecUniToAnsi
0x401078 EVENT_SINK_Release
0x40107c None
0x401080 _CIsqrt
0x401084 EVENT_SINK_QueryInterface
0x401088 __vbaExceptHandler
0x40108c __vbaStrToUnicode
0x401090 _adj_fprem
0x401094 _adj_fdivr_m64
0x401098 None
0x40109c None
0x4010a0 None
0x4010a4 __vbaFPException
0x4010a8 __vbaInStrVar
0x4010ac __vbaStrVarVal
0x4010b0 __vbaVarCat
0x4010b4 _CIlog
0x4010b8 __vbaErrorOverflow
0x4010bc __vbaFileOpen
0x4010c0 __vbaNew2
0x4010c4 _adj_fdiv_m32i
0x4010c8 _adj_fdivr_m32i
0x4010cc __vbaFreeStrList
0x4010d0 _adj_fdivr_m32
0x4010d4 _adj_fdiv_r
0x4010d8 None
0x4010dc __vbaVarSetVar
0x4010e0 __vbaI4Var
0x4010e4 __vbaStrToAnsi
0x4010e8 __vbaVarDup
0x4010ec __vbaVarLateMemCallLd
0x4010f0 None
0x4010f4 __vbaRecDestructAnsi
0x4010f8 _CIatan
0x4010fc __vbaStrMove
0x401100 _allmul
0x401104 _CItan
0x401108 _CIexp
0x40110c __vbaFreeStr
0x401110 __vbaFreeObj
EAT(Export Address Table) is none
MSVBVM60.DLL
0x401000 __vbaVarSub
0x401004 _CIcos
0x401008 _adj_fptan
0x40100c __vbaVarMove
0x401010 __vbaFreeVar
0x401014 __vbaStrVarMove
0x401018 __vbaFreeVarList
0x40101c __vbaEnd
0x401020 _adj_fdiv_m64
0x401024 __vbaLineInputVar
0x401028 _adj_fprem1
0x40102c __vbaRecAnsiToUni
0x401030 __vbaStrCat
0x401034 __vbaRecDestruct
0x401038 __vbaSetSystemError
0x40103c __vbaHresultCheckObj
0x401040 _adj_fdiv_m32
0x401044 __vbaOnError
0x401048 _adj_fdiv_m16i
0x40104c __vbaObjSetAddref
0x401050 _adj_fdivr_m16i
0x401054 None
0x401058 _CIsin
0x40105c __vbaChkstk
0x401060 __vbaFileClose
0x401064 EVENT_SINK_AddRef
0x401068 None
0x40106c DllFunctionCall
0x401070 _adj_fpatan
0x401074 __vbaRecUniToAnsi
0x401078 EVENT_SINK_Release
0x40107c None
0x401080 _CIsqrt
0x401084 EVENT_SINK_QueryInterface
0x401088 __vbaExceptHandler
0x40108c __vbaStrToUnicode
0x401090 _adj_fprem
0x401094 _adj_fdivr_m64
0x401098 None
0x40109c None
0x4010a0 None
0x4010a4 __vbaFPException
0x4010a8 __vbaInStrVar
0x4010ac __vbaStrVarVal
0x4010b0 __vbaVarCat
0x4010b4 _CIlog
0x4010b8 __vbaErrorOverflow
0x4010bc __vbaFileOpen
0x4010c0 __vbaNew2
0x4010c4 _adj_fdiv_m32i
0x4010c8 _adj_fdivr_m32i
0x4010cc __vbaFreeStrList
0x4010d0 _adj_fdivr_m32
0x4010d4 _adj_fdiv_r
0x4010d8 None
0x4010dc __vbaVarSetVar
0x4010e0 __vbaI4Var
0x4010e4 __vbaStrToAnsi
0x4010e8 __vbaVarDup
0x4010ec __vbaVarLateMemCallLd
0x4010f0 None
0x4010f4 __vbaRecDestructAnsi
0x4010f8 _CIatan
0x4010fc __vbaStrMove
0x401100 _allmul
0x401104 _CItan
0x401108 _CIexp
0x40110c __vbaFreeStr
0x401110 __vbaFreeObj
EAT(Export Address Table) is none