Report - ua.exe

Generic Malware Malicious Library Malicious Packer UPX PE File PE32 OS Processor Check
ScreenShot
Created 2024.11.13 14:15 Machine s1_win7_x6401
Filename ua.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
Behavior Score
3.2
ZERO API file : clean
VT API (file) 3 detected (Tool, DefenderControl)
md5 9ef56e113c9c47b57c929d4b2215a904
sha256 2b25112d2ac53d695e1b5885f360711adffe93e4e9e87dc4492478f4d9b710a9
ssdeep 49152:fyiwc8phQkEa1rucCAoBpFMQy7H0Q59IVdGuhb8f:ELCarucCAofFs7H99IfGuhb8f
imphash bf4fa0877d2a24a862867855527e16f2
impfuzzy 192:D8wFU6xL2uWUDby4k4bk/Bu0QGVvGMcncYcn5jAZ1ZP4+/cZDNPUwFwpc8:o2/xL73koIVvZaBG6Z1hjcZDNPUwSpc8
  Network IP location

Signature (8cnts)

Level Description
watch Checks the version of Bios
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice File has been identified by 3 AntiVirus engines on VirusTotal as malicious
notice Foreign language identified in PE resource
notice The binary likely contains encrypted or compressed data indicative of a packer
info Collects information to fingerprint the system (MachineGuid

Rules (7cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x5321f8 GetStringTypeW
 0x5321fc GetStringTypeA
 0x532200 GetConsoleMode
 0x532204 GetConsoleCP
 0x532208 LCMapStringW
 0x53220c LCMapStringA
 0x532210 InitializeCriticalSectionAndSpinCount
 0x532214 IsValidCodePage
 0x532218 GetOEMCP
 0x53221c GetACP
 0x532220 GetCPInfo
 0x532224 GetTimeZoneInformation
 0x532228 UnhandledExceptionFilter
 0x53222c QueryPerformanceCounter
 0x532230 VirtualFree
 0x532234 HeapCreate
 0x532238 SetHandleCount
 0x53223c GetTickCount
 0x532240 GetCommandLineW
 0x532244 GetEnvironmentStringsW
 0x532248 FreeEnvironmentStringsW
 0x53224c GetModuleFileNameA
 0x532250 GetStdHandle
 0x532254 SetUnhandledExceptionFilter
 0x532258 GetFileType
 0x53225c SetStdHandle
 0x532260 VirtualQuery
 0x532264 GetSystemInfo
 0x532268 VirtualAlloc
 0x53226c GetSystemTimeAsFileTime
 0x532270 HeapSize
 0x532274 HeapReAlloc
 0x532278 CreateThread
 0x53227c ExitThread
 0x532280 RtlUnwind
 0x532284 HeapFree
 0x532288 SetEnvironmentVariableA
 0x53228c CreateFileA
 0x532290 WriteConsoleW
 0x532294 GetStartupInfoA
 0x532298 HeapAlloc
 0x53229c GetStartupInfoW
 0x5322a0 FindResourceExW
 0x5322a4 VirtualProtect
 0x5322a8 GetFileTime
 0x5322ac GetFileSizeEx
 0x5322b0 FileTimeToLocalFileTime
 0x5322b4 GetProfileIntW
 0x5322b8 SearchPathW
 0x5322bc GetTempPathW
 0x5322c0 GetTempFileNameW
 0x5322c4 SetErrorMode
 0x5322c8 FileTimeToSystemTime
 0x5322cc GlobalGetAtomNameW
 0x5322d0 GetFullPathNameW
 0x5322d4 GetVolumeInformationW
 0x5322d8 FindFirstFileW
 0x5322dc FindClose
 0x5322e0 DuplicateHandle
 0x5322e4 SetEndOfFile
 0x5322e8 UnlockFile
 0x5322ec LockFile
 0x5322f0 FlushFileBuffers
 0x5322f4 SetFilePointer
 0x5322f8 ReadFile
 0x5322fc GetThreadLocale
 0x532300 lstrlenA
 0x532304 GetConsoleOutputCP
 0x532308 WriteConsoleA
 0x53230c GetLocaleInfoA
 0x532310 GetFileAttributesW
 0x532314 InterlockedIncrement
 0x532318 TlsFree
 0x53231c DeleteCriticalSection
 0x532320 LocalReAlloc
 0x532324 TlsSetValue
 0x532328 TlsAlloc
 0x53232c InitializeCriticalSection
 0x532330 GlobalHandle
 0x532334 GlobalReAlloc
 0x532338 EnterCriticalSection
 0x53233c TlsGetValue
 0x532340 LeaveCriticalSection
 0x532344 LocalAlloc
 0x532348 GlobalFlags
 0x53234c GetModuleHandleA
 0x532350 GetCurrentDirectoryW
 0x532354 CopyFileW
 0x532358 GlobalSize
 0x53235c FormatMessageW
 0x532360 LocalFree
 0x532364 MulDiv
 0x532368 InterlockedDecrement
 0x53236c GlobalFindAtomW
 0x532370 GetVersionExW
 0x532374 CompareStringW
 0x532378 LoadLibraryA
 0x53237c GetVersionExA
 0x532380 SetLastError
 0x532384 GlobalAddAtomW
 0x532388 WaitForSingleObject
 0x53238c ResumeThread
 0x532390 SetThreadPriority
 0x532394 GlobalUnlock
 0x532398 WritePrivateProfileStringW
 0x53239c GetPrivateProfileIntW
 0x5323a0 FreeResource
 0x5323a4 GlobalFree
 0x5323a8 GlobalDeleteAtom
 0x5323ac GetCurrentThreadId
 0x5323b0 ConvertDefaultLocale
 0x5323b4 EnumResourceLanguagesW
 0x5323b8 lstrcmpA
 0x5323bc GetLocaleInfoW
 0x5323c0 CompareStringA
 0x5323c4 InterlockedExchange
 0x5323c8 GlobalLock
 0x5323cc lstrcmpW
 0x5323d0 GlobalAlloc
 0x5323d4 LoadLibraryW
 0x5323d8 GetDriveTypeW
 0x5323dc lstrcpyW
 0x5323e0 GetCurrentProcessId
 0x5323e4 CloseHandle
 0x5323e8 IsDebuggerPresent
 0x5323ec DeviceIoControl
 0x5323f0 LockResource
 0x5323f4 CreateFileMappingW
 0x5323f8 GetProcAddress
 0x5323fc GetLastError
 0x532400 RaiseException
 0x532404 lstrlenW
 0x532408 MultiByteToWideChar
 0x53240c CreateFileW
 0x532410 GetModuleFileNameW
 0x532414 TerminateProcess
 0x532418 SizeofResource
 0x53241c WideCharToMultiByte
 0x532420 WriteFile
 0x532424 GetCurrentThread
 0x532428 GetModuleHandleW
 0x53242c GetLogicalDriveStringsW
 0x532430 GetCurrentProcess
 0x532434 LoadResource
 0x532438 FreeLibrary
 0x53243c FindResourceW
 0x532440 MapViewOfFile
 0x532444 GetFileSize
 0x532448 ExitProcess
 0x53244c IsBadWritePtr
 0x532450 IsBadReadPtr
 0x532454 GetLocalTime
 0x532458 Sleep
USER32.dll
 0x5324dc MapVirtualKeyExW
 0x5324e0 GetKeyNameTextW
 0x5324e4 IsCharLowerW
 0x5324e8 GetMenuDefaultItem
 0x5324ec SetMenuDefaultItem
 0x5324f0 UpdateLayeredWindow
 0x5324f4 EnableScrollBar
 0x5324f8 UnionRect
 0x5324fc SetCursorPos
 0x532500 DrawFocusRect
 0x532504 DrawFrameControl
 0x532508 DrawEdge
 0x53250c DrawIconEx
 0x532510 UnpackDDElParam
 0x532514 ReuseDDElParam
 0x532518 InsertMenuItemW
 0x53251c TranslateAcceleratorW
 0x532520 UnregisterClassW
 0x532524 GetMenuItemInfoW
 0x532528 GetNextDlgGroupItem
 0x53252c InvalidateRgn
 0x532530 SetRect
 0x532534 CharNextW
 0x532538 EmptyClipboard
 0x53253c CloseClipboard
 0x532540 SetClipboardData
 0x532544 LoadImageW
 0x532548 DestroyIcon
 0x53254c CopyImage
 0x532550 OpenClipboard
 0x532554 DrawStateW
 0x532558 RegisterClipboardFormatW
 0x53255c EnumChildWindows
 0x532560 LockWindowUpdate
 0x532564 BringWindowToTop
 0x532568 IsRectEmpty
 0x53256c KillTimer
 0x532570 SetTimer
 0x532574 InvalidateRect
 0x532578 InflateRect
 0x53257c IsMenu
 0x532580 GetSystemMenu
 0x532584 SetClassLongW
 0x532588 SetParent
 0x53258c CreatePopupMenu
 0x532590 NotifyWinEvent
 0x532594 SetWindowRgn
 0x532598 CreateAcceleratorTableW
 0x53259c LoadAcceleratorsW
 0x5325a0 DestroyAcceleratorTable
 0x5325a4 GetAsyncKeyState
 0x5325a8 CharUpperW
 0x5325ac GetKeyboardState
 0x5325b0 GetKeyboardLayout
 0x5325b4 MapVirtualKeyW
 0x5325b8 ToUnicodeEx
 0x5325bc DestroyMenu
 0x5325c0 PostThreadMessageW
 0x5325c4 GetSysColorBrush
 0x5325c8 SetRectEmpty
 0x5325cc EndPaint
 0x5325d0 BeginPaint
 0x5325d4 GetWindowDC
 0x5325d8 ReleaseDC
 0x5325dc GetDC
 0x5325e0 GrayStringW
 0x5325e4 DrawTextExW
 0x5325e8 DrawTextW
 0x5325ec TabbedTextOutW
 0x5325f0 FillRect
 0x5325f4 DeleteMenu
 0x5325f8 WaitMessage
 0x5325fc ReleaseCapture
 0x532600 LoadCursorW
 0x532604 WindowFromPoint
 0x532608 SetCapture
 0x53260c ClientToScreen
 0x532610 GetMenuStringW
 0x532614 AppendMenuW
 0x532618 IsClipboardFormatAvailable
 0x53261c RemoveMenu
 0x532620 ShowWindow
 0x532624 MoveWindow
 0x532628 SetWindowTextW
 0x53262c IsDialogMessageW
 0x532630 CheckDlgButton
 0x532634 RegisterWindowMessageW
 0x532638 SendDlgItemMessageW
 0x53263c SendDlgItemMessageA
 0x532640 IsChild
 0x532644 GetCapture
 0x532648 GetClassLongW
 0x53264c GetClassNameW
 0x532650 SetPropW
 0x532654 GetPropW
 0x532658 RemovePropW
 0x53265c SetFocus
 0x532660 GetWindowTextLengthW
 0x532664 GetWindowTextW
 0x532668 GetForegroundWindow
 0x53266c BeginDeferWindowPos
 0x532670 EndDeferWindowPos
 0x532674 GetTopWindow
 0x532678 UnhookWindowsHookEx
 0x53267c GetMessageTime
 0x532680 GetMessagePos
 0x532684 MapWindowPoints
 0x532688 ScrollWindow
 0x53268c TrackPopupMenu
 0x532690 SetMenu
 0x532694 SetScrollRange
 0x532698 GetScrollRange
 0x53269c SetScrollPos
 0x5326a0 GetScrollPos
 0x5326a4 SetForegroundWindow
 0x5326a8 ShowScrollBar
 0x5326ac UpdateWindow
 0x5326b0 GetClientRect
 0x5326b4 GetMenuItemID
 0x5326b8 GetMenuItemCount
 0x5326bc CreateWindowExW
 0x5326c0 GetClassInfoExW
 0x5326c4 GetClassInfoW
 0x5326c8 RegisterClassW
 0x5326cc GetSysColor
 0x5326d0 AdjustWindowRectEx
 0x5326d4 ScreenToClient
 0x5326d8 EqualRect
 0x5326dc DeferWindowPos
 0x5326e0 GetScrollInfo
 0x5326e4 SetScrollInfo
 0x5326e8 SetWindowPlacement
 0x5326ec GetDlgCtrlID
 0x5326f0 DefWindowProcW
 0x5326f4 CallWindowProcW
 0x5326f8 CopyRect
 0x5326fc PtInRect
 0x532700 GetMenu
 0x532704 SetWindowLongW
 0x532708 IntersectRect
 0x53270c SystemParametersInfoA
 0x532710 GetWindowPlacement
 0x532714 DefFrameProcW
 0x532718 DefMDIChildProcW
 0x53271c DrawMenuBar
 0x532720 TranslateMDISysAccel
 0x532724 FrameRect
 0x532728 GetUpdateRect
 0x53272c CharUpperBuffW
 0x532730 CopyIcon
 0x532734 SubtractRect
 0x532738 GetIconInfo
 0x53273c GetWindowThreadProcessId
 0x532740 GetLastActivePopup
 0x532744 ShowOwnedPopups
 0x532748 SetCursor
 0x53274c SetWindowsHookExW
 0x532750 CallNextHookEx
 0x532754 GetMessageW
 0x532758 TranslateMessage
 0x53275c DispatchMessageW
 0x532760 IsWindowVisible
 0x532764 GetKeyState
 0x532768 GetDoubleClickTime
 0x53276c CreateMenu
 0x532770 GetWindowRgn
 0x532774 DestroyCursor
 0x532778 DrawIcon
 0x53277c InsertMenuW
 0x532780 PeekMessageW
 0x532784 GetCursorPos
 0x532788 ValidateRect
 0x53278c SetMenuItemBitmaps
 0x532790 GetMenuCheckMarkDimensions
 0x532794 LoadBitmapW
 0x532798 GetFocus
 0x53279c ModifyMenuW
 0x5327a0 GetMenuState
 0x5327a4 EnableMenuItem
 0x5327a8 CheckMenuItem
 0x5327ac LoadMenuW
 0x5327b0 GetSubMenu
 0x5327b4 GetDesktopWindow
 0x5327b8 GetActiveWindow
 0x5327bc SetActiveWindow
 0x5327c0 CreateDialogIndirectParamW
 0x5327c4 DestroyWindow
 0x5327c8 IsWindow
 0x5327cc GetWindowLongW
 0x5327d0 GetDlgItem
 0x5327d4 IsWindowEnabled
 0x5327d8 GetNextDlgTabItem
 0x5327dc EndDialog
 0x5327e0 SetWindowContextHelpId
 0x5327e4 MapDialogRect
 0x5327e8 WinHelpW
 0x5327ec SystemParametersInfoW
 0x5327f0 OffsetRect
 0x5327f4 MessageBeep
 0x5327f8 RedrawWindow
 0x5327fc IsZoomed
 0x532800 PostMessageW
 0x532804 MessageBoxW
 0x532808 SendMessageW
 0x53280c LoadIconW
 0x532810 EnableWindow
 0x532814 GetWindowRect
 0x532818 PostQuitMessage
 0x53281c IsIconic
 0x532820 GetParent
 0x532824 SetWindowPos
 0x532828 GetSystemMetrics
 0x53282c GetWindow
 0x532830 CopyAcceleratorTableW
GDI32.dll
 0x532050 SetDIBColorTable
 0x532054 PatBlt
 0x532058 GetDIBits
 0x53205c RealizePalette
 0x532060 CombineRgn
 0x532064 StretchBlt
 0x532068 SetPixel
 0x53206c CreateDIBSection
 0x532070 GetBkColor
 0x532074 SetRectRgn
 0x532078 GetMapMode
 0x53207c DPtoLP
 0x532080 CreateEllipticRgn
 0x532084 CreatePolygonRgn
 0x532088 Polyline
 0x53208c Ellipse
 0x532090 Polygon
 0x532094 Rectangle
 0x532098 RoundRect
 0x53209c CreatePalette
 0x5320a0 GetPaletteEntries
 0x5320a4 GetWindowOrgEx
 0x5320a8 PtInRegion
 0x5320ac FillRgn
 0x5320b0 FrameRgn
 0x5320b4 GetTextExtentPoint32W
 0x5320b8 GetViewportOrgEx
 0x5320bc LPtoDP
 0x5320c0 ExtFloodFill
 0x5320c4 SetPaletteEntries
 0x5320c8 GetNearestPaletteIndex
 0x5320cc GetSystemPaletteEntries
 0x5320d0 EnumFontFamiliesExW
 0x5320d4 GetTextFaceW
 0x5320d8 SetPixelV
 0x5320dc Escape
 0x5320e0 ExtTextOutW
 0x5320e4 TextOutW
 0x5320e8 SelectObject
 0x5320ec GetTextColor
 0x5320f0 CreateRoundRectRgn
 0x5320f4 GetTextCharsetInfo
 0x5320f8 EnumFontFamiliesW
 0x5320fc GetTextMetricsW
 0x532100 CreateCompatibleBitmap
 0x532104 CreateFontIndirectW
 0x532108 CreateDIBitmap
 0x53210c GetRgnBox
 0x532110 OffsetRgn
 0x532114 CreateRectRgnIndirect
 0x532118 CreateHatchBrush
 0x53211c CreateSolidBrush
 0x532120 CreatePen
 0x532124 GetObjectType
 0x532128 SelectPalette
 0x53212c GetStockObject
 0x532130 CreateCompatibleDC
 0x532134 CreatePatternBrush
 0x532138 DeleteDC
 0x53213c ExtSelectClipRgn
 0x532140 ScaleWindowExtEx
 0x532144 SetWindowExtEx
 0x532148 OffsetWindowOrgEx
 0x53214c SetWindowOrgEx
 0x532150 ScaleViewportExtEx
 0x532154 SetViewportExtEx
 0x532158 OffsetViewportOrgEx
 0x53215c GetBoundsRect
 0x532160 GetClipBox
 0x532164 RectVisible
 0x532168 PtVisible
 0x53216c GetPixel
 0x532170 BitBlt
 0x532174 GetWindowExtEx
 0x532178 GetViewportExtEx
 0x53217c CreateRectRgn
 0x532180 SelectClipRgn
 0x532184 DeleteObject
 0x532188 SetTextAlign
 0x53218c MoveToEx
 0x532190 LineTo
 0x532194 IntersectClipRect
 0x532198 ExcludeClipRect
 0x53219c SetMapMode
 0x5321a0 SetROP2
 0x5321a4 SetPolyFillMode
 0x5321a8 SetBkMode
 0x5321ac RestoreDC
 0x5321b0 SaveDC
 0x5321b4 CopyMetaFileW
 0x5321b8 GetDeviceCaps
 0x5321bc GetObjectW
 0x5321c0 SetBkColor
 0x5321c4 SetTextColor
 0x5321c8 CreateBitmap
 0x5321cc GetDCOrgEx
 0x5321d0 SetViewportOrgEx
MSIMG32.dll
 0x532460 AlphaBlend
 0x532464 TransparentBlt
COMDLG32.dll
 0x532048 GetFileTitleW
WINSPOOL.DRV
 0x532840 OpenPrinterW
 0x532844 ClosePrinter
 0x532848 DocumentPropertiesW
ADVAPI32.dll
 0x532000 OpenProcessToken
 0x532004 RegQueryValueExW
 0x532008 LookupPrivilegeValueW
 0x53200c RegQueryValueW
 0x532010 RegOpenKeyW
 0x532014 RegEnumKeyW
 0x532018 RegDeleteKeyW
 0x53201c RegCreateKeyExW
 0x532020 RegDeleteValueW
 0x532024 RegSetValueExW
 0x532028 RegCloseKey
 0x53202c AdjustTokenPrivileges
 0x532030 RegEnumKeyExW
 0x532034 RegOpenKeyExW
SHELL32.dll
 0x5324a0 DragQueryFileW
 0x5324a4 SHGetPathFromIDListW
 0x5324a8 SHBrowseForFolderW
 0x5324ac ShellExecuteW
 0x5324b0 SHAppBarMessage
 0x5324b4 DragFinish
 0x5324b8 SHGetFileInfoW
COMCTL32.dll
 0x53203c InitCommonControlsEx
 0x532040 ImageList_GetIconSize
SHLWAPI.dll
 0x5324c0 PathFindExtensionW
 0x5324c4 PathFindFileNameW
 0x5324c8 PathStripToRootW
 0x5324cc PathIsUNCW
 0x5324d0 SHDeleteKeyW
 0x5324d4 PathRemoveFileSpecW
oledlg.dll
 0x53293c OleUIBusyW
ole32.dll
 0x5328b4 OleGetClipboard
 0x5328b8 DoDragDrop
 0x5328bc OleFlushClipboard
 0x5328c0 OleIsCurrentClipboard
 0x5328c4 OleLockRunning
 0x5328c8 CreateILockBytesOnHGlobal
 0x5328cc OleUninitialize
 0x5328d0 StgOpenStorageOnILockBytes
 0x5328d4 CoGetClassObject
 0x5328d8 OleDuplicateData
 0x5328dc RevokeDragDrop
 0x5328e0 ReleaseStgMedium
 0x5328e4 CLSIDFromProgID
 0x5328e8 CoFreeUnusedLibraries
 0x5328ec OleInitialize
 0x5328f0 CoInitializeEx
 0x5328f4 OleCreateMenuDescriptor
 0x5328f8 OleDestroyMenuDescriptor
 0x5328fc OleTranslateAccelerator
 0x532900 IsAccelerator
 0x532904 CoRegisterMessageFilter
 0x532908 CoRevokeClassObject
 0x53290c StgCreateDocfileOnILockBytes
 0x532910 CoTaskMemFree
 0x532914 CoInitialize
 0x532918 CLSIDFromString
 0x53291c StringFromCLSID
 0x532920 CoUninitialize
 0x532924 CoCreateInstance
 0x532928 CoLockObjectExternal
 0x53292c CoTaskMemAlloc
 0x532930 RegisterDragDrop
 0x532934 CreateStreamOnHGlobal
OLEAUT32.dll
 0x53246c SysFreeString
 0x532470 VariantCopy
 0x532474 SafeArrayDestroy
 0x532478 SystemTimeToVariantTime
 0x53247c VariantTimeToSystemTime
 0x532480 OleCreateFontIndirect
 0x532484 SysAllocString
 0x532488 SysStringLen
 0x53248c VariantInit
 0x532490 VariantChangeType
 0x532494 VariantClear
 0x532498 SysAllocStringLen
gdiplus.dll
 0x532858 GdipCreateBitmapFromStream
 0x53285c GdipAlloc
 0x532860 GdipCloneImage
 0x532864 GdipDrawImageI
 0x532868 GdipGetImageGraphicsContext
 0x53286c GdiplusShutdown
 0x532870 GdiplusStartup
 0x532874 GdipBitmapUnlockBits
 0x532878 GdipBitmapLockBits
 0x53287c GdipCreateBitmapFromScan0
 0x532880 GdipCreateBitmapFromStreamICM
 0x532884 GdipFree
 0x532888 GdipGetImagePalette
 0x53288c GdipGetImagePaletteSize
 0x532890 GdipGetImagePixelFormat
 0x532894 GdipGetImageHeight
 0x532898 GdipGetImageWidth
 0x53289c GdipDisposeImage
 0x5328a0 GdipDeleteGraphics
imagehlp.dll
 0x5328a8 CheckSumMappedFile
 0x5328ac MapFileAndCheckSumW
IPHLPAPI.DLL
 0x5321e8 GetPerAdapterInfo
 0x5321ec GetAdaptersInfo
 0x5321f0 GetAdaptersAddresses
WS2_32.dll
 0x532850 inet_addr
IMM32.dll
 0x5321d8 ImmGetContext
 0x5321dc ImmGetOpenStatus
 0x5321e0 ImmReleaseContext
WINMM.dll
 0x532838 PlaySoundW

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure