Report - nb.exe

Generic Malware Malicious Library Malicious Packer UPX Anti_VM PE File PE32 OS Processor Check
ScreenShot
Created 2024.11.13 14:20 Machine s1_win7_x6403
Filename nb.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
2.2
ZERO API file : clean
VT API (file) 3 detected (Hupigon, Zpevdo)
md5 ccee0912e79d434f0d2c1e11274f23c0
sha256 679b9af0def4dbbe2e179ac05f9a7ab4c2ffc28a71964a9e9edf2986bdc1b1a2
ssdeep 24576:GvbBARGCfE5TVUUCql3jpomr6RTmBfOKpf37Q+zAV9/NaCWxI7IPBRiAY:WARGEvqlzpomr6RTmBfOKpf37Q+zAV92
imphash caf305b68aad926d2599f8ceb251d421
impfuzzy 192:J3LCE48YPOZ0TG9f4drWFsYUKkcnc2c6GsjPRANOPxoI:xh4LPOZUSkaX7uNOPxoI
  Network IP location

Signature (7cnts)

Level Description
notice Executes one or more WMI queries
notice Executes one or more WMI queries which can be used to identify virtual machines
notice File has been identified by 3 AntiVirus engines on VirusTotal as malicious
notice Foreign language identified in PE resource
info Collects information to fingerprint the system (MachineGuid
info Queries for the computername
info This executable has a PDB path

Rules (8cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
notice anti_vm_detect Possibly employs anti-virtualization techniques binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x465124 LCMapStringW
 0x465128 QueryPerformanceCounter
 0x46512c GetCurrentProcessId
 0x465130 GetStringTypeA
 0x465134 GetStringTypeW
 0x465138 HeapDestroy
 0x46513c HeapCreate
 0x465140 VirtualFree
 0x465144 IsBadWritePtr
 0x465148 GetStdHandle
 0x46514c UnhandledExceptionFilter
 0x465150 FreeEnvironmentStringsA
 0x465154 GetEnvironmentStrings
 0x465158 FreeEnvironmentStringsW
 0x46515c LCMapStringA
 0x465160 SetHandleCount
 0x465164 SetUnhandledExceptionFilter
 0x465168 IsBadReadPtr
 0x46516c IsBadCodePtr
 0x465170 SetEnvironmentVariableA
 0x465174 HeapSize
 0x465178 TerminateProcess
 0x46517c GetFileType
 0x465180 SetStdHandle
 0x465184 HeapReAlloc
 0x465188 InterlockedExchange
 0x46518c GetCommandLineA
 0x465190 GetStartupInfoA
 0x465194 VirtualQuery
 0x465198 GetSystemInfo
 0x46519c VirtualAlloc
 0x4651a0 VirtualProtect
 0x4651a4 RtlUnwind
 0x4651a8 GetSystemTimeAsFileTime
 0x4651ac ExitProcess
 0x4651b0 GetTickCount
 0x4651b4 SetErrorMode
 0x4651b8 GetFileTime
 0x4651bc GetOEMCP
 0x4651c0 GetCPInfo
 0x4651c4 InterlockedIncrement
 0x4651c8 TlsFree
 0x4651cc LocalReAlloc
 0x4651d0 TlsSetValue
 0x4651d4 TlsAlloc
 0x4651d8 TlsGetValue
 0x4651dc EnterCriticalSection
 0x4651e0 GlobalHandle
 0x4651e4 GlobalReAlloc
 0x4651e8 LeaveCriticalSection
 0x4651ec LocalAlloc
 0x4651f0 GlobalFlags
 0x4651f4 WritePrivateProfileStringA
 0x4651f8 GetFullPathNameA
 0x4651fc DuplicateHandle
 0x465200 SetEndOfFile
 0x465204 UnlockFile
 0x465208 LockFile
 0x46520c FlushFileBuffers
 0x465210 GetCurrentThread
 0x465214 lstrcmpA
 0x465218 ConvertDefaultLocale
 0x46521c EnumResourceLanguagesA
 0x465220 lstrcpyA
 0x465224 SetLastError
 0x465228 MulDiv
 0x46522c GlobalAlloc
 0x465230 LocalFree
 0x465234 GetCurrentThreadId
 0x465238 GlobalGetAtomNameA
 0x46523c GlobalAddAtomA
 0x465240 GlobalFindAtomA
 0x465244 GlobalDeleteAtom
 0x465248 lstrcatA
 0x46524c lstrcmpW
 0x465250 lstrcpynA
 0x465254 GetModuleHandleA
 0x465258 GlobalLock
 0x46525c GlobalUnlock
 0x465260 GlobalFree
 0x465264 FreeResource
 0x465268 GetModuleFileNameA
 0x46526c GetTimeZoneInformation
 0x465270 SetTimeZoneInformation
 0x465274 CompareStringW
 0x465278 CompareStringA
 0x46527c lstrlenA
 0x465280 lstrcmpiA
 0x465284 DeleteCriticalSection
 0x465288 InitializeCriticalSection
 0x46528c RaiseException
 0x465290 CopyFileA
 0x465294 LoadLibraryA
 0x465298 GetProcAddress
 0x46529c FreeLibrary
 0x4652a0 GetVersion
 0x4652a4 DeviceIoControl
 0x4652a8 GetDriveTypeA
 0x4652ac ReadFile
 0x4652b0 GetLogicalDrives
 0x4652b4 GetVolumeInformationA
 0x4652b8 FormatMessageA
 0x4652bc InterlockedDecrement
 0x4652c0 MultiByteToWideChar
 0x4652c4 GetWindowsDirectoryA
 0x4652c8 GetTempPathA
 0x4652cc FindFirstFileA
 0x4652d0 GetFileAttributesA
 0x4652d4 SetFileAttributesA
 0x4652d8 RemoveDirectoryA
 0x4652dc DeleteFileA
 0x4652e0 FindNextFileA
 0x4652e4 FindClose
 0x4652e8 CreateFileA
 0x4652ec GetFileSize
 0x4652f0 SetFilePointer
 0x4652f4 WriteFile
 0x4652f8 CloseHandle
 0x4652fc WideCharToMultiByte
 0x465300 FileTimeToLocalFileTime
 0x465304 FileTimeToSystemTime
 0x465308 GetCurrentProcess
 0x46530c GetLastError
 0x465310 GetProcessHeap
 0x465314 HeapAlloc
 0x465318 HeapFree
 0x46531c FindResourceA
 0x465320 LoadResource
 0x465324 LockResource
 0x465328 SizeofResource
 0x46532c GetVersionExA
 0x465330 GetThreadLocale
 0x465334 GetLocaleInfoA
 0x465338 GetACP
 0x46533c GetEnvironmentStringsW
USER32.dll
 0x4653b0 MessageBeep
 0x4653b4 GetNextDlgGroupItem
 0x4653b8 InvalidateRgn
 0x4653bc CopyAcceleratorTableA
 0x4653c0 SetRect
 0x4653c4 IsRectEmpty
 0x4653c8 CharNextA
 0x4653cc GetSysColorBrush
 0x4653d0 DestroyMenu
 0x4653d4 SetWindowContextHelpId
 0x4653d8 MapDialogRect
 0x4653dc GetMessageA
 0x4653e0 TranslateMessage
 0x4653e4 GetCursorPos
 0x4653e8 ValidateRect
 0x4653ec SetCursor
 0x4653f0 PostQuitMessage
 0x4653f4 EndPaint
 0x4653f8 GetWindowDC
 0x4653fc ClientToScreen
 0x465400 GrayStringA
 0x465404 DrawTextExA
 0x465408 DrawTextA
 0x46540c TabbedTextOutA
 0x465410 wsprintfA
 0x465414 SetMenuItemBitmaps
 0x465418 ModifyMenuA
 0x46541c EnableMenuItem
 0x465420 CheckMenuItem
 0x465424 GetMenuCheckMarkDimensions
 0x465428 LoadBitmapA
 0x46542c ShowWindow
 0x465430 MoveWindow
 0x465434 SetWindowTextA
 0x465438 IsDialogMessageA
 0x46543c GetMenuState
 0x465440 RegisterWindowMessageA
 0x465444 WinHelpA
 0x465448 CreateWindowExA
 0x46544c SetWindowsHookExA
 0x465450 CallNextHookEx
 0x465454 GetClassLongA
 0x465458 GetClassInfoExA
 0x46545c GetClassNameA
 0x465460 SetPropA
 0x465464 GetPropA
 0x465468 SendDlgItemMessageA
 0x46546c SetFocus
 0x465470 IsChild
 0x465474 GetWindowTextLengthA
 0x465478 GetWindowTextA
 0x46547c GetForegroundWindow
 0x465480 GetLastActivePopup
 0x465484 GetParent
 0x465488 EnableWindow
 0x46548c SendMessageA
 0x465490 GetFocus
 0x465494 SetTimer
 0x465498 KillTimer
 0x46549c GetWindowRect
 0x4654a0 InvalidateRect
 0x4654a4 UnregisterClassA
 0x4654a8 DispatchMessageA
 0x4654ac GetTopWindow
 0x4654b0 UnhookWindowsHookEx
 0x4654b4 GetMessageTime
 0x4654b8 GetMessagePos
 0x4654bc PeekMessageA
 0x4654c0 MapWindowPoints
 0x4654c4 GetKeyState
 0x4654c8 SetForegroundWindow
 0x4654cc UpdateWindow
 0x4654d0 GetMenu
 0x4654d4 PostMessageA
 0x4654d8 GetSubMenu
 0x4654dc GetMenuItemID
 0x4654e0 GetMenuItemCount
 0x4654e4 AdjustWindowRectEx
 0x4654e8 EqualRect
 0x4654ec GetClassInfoA
 0x4654f0 RegisterClassA
 0x4654f4 GetDlgCtrlID
 0x4654f8 DefWindowProcA
 0x4654fc SetWindowPos
 0x465500 OffsetRect
 0x465504 IntersectRect
 0x465508 GetWindowPlacement
 0x46550c GetWindow
 0x465510 GetDesktopWindow
 0x465514 GetActiveWindow
 0x465518 SetActiveWindow
 0x46551c CreateDialogIndirectParamA
 0x465520 DestroyWindow
 0x465524 GetWindowLongA
 0x465528 GetDlgItem
 0x46552c IsWindowEnabled
 0x465530 RegisterClipboardFormatA
 0x465534 PostThreadMessageA
 0x465538 RemovePropA
 0x46553c CharUpperA
 0x465540 ExitWindowsEx
 0x465544 DrawIcon
 0x465548 AppendMenuA
 0x46554c GetSystemMenu
 0x465550 IsIconic
 0x465554 GetClientRect
 0x465558 LoadIconA
 0x46555c GetSystemMetrics
 0x465560 MessageBoxA
 0x465564 IsWindow
 0x465568 PtInRect
 0x46556c InflateRect
 0x465570 CopyRect
 0x465574 FillRect
 0x465578 FrameRect
 0x46557c GetDC
 0x465580 IsWindowVisible
 0x465584 GetCapture
 0x465588 SetCapture
 0x46558c LoadCursorA
 0x465590 ReleaseCapture
 0x465594 ReleaseDC
 0x465598 GetSysColor
 0x46559c CallWindowProcA
 0x4655a0 SetWindowLongA
 0x4655a4 GetComboBoxInfo
 0x4655a8 SystemParametersInfoA
 0x4655ac EndDialog
 0x4655b0 GetNextDlgTabItem
 0x4655b4 BeginPaint
GDI32.dll
 0x465094 GetRgnBox
 0x465098 GetMapMode
 0x46509c CreateSolidBrush
 0x4650a0 GetStockObject
 0x4650a4 DeleteDC
 0x4650a8 ExtSelectClipRgn
 0x4650ac ScaleWindowExtEx
 0x4650b0 SetWindowExtEx
 0x4650b4 ScaleViewportExtEx
 0x4650b8 SetViewportExtEx
 0x4650bc OffsetViewportOrgEx
 0x4650c0 SetViewportOrgEx
 0x4650c4 SelectObject
 0x4650c8 Escape
 0x4650cc ExtTextOutA
 0x4650d0 TextOutA
 0x4650d4 RectVisible
 0x4650d8 GetObjectA
 0x4650dc GetWindowExtEx
 0x4650e0 GetViewportExtEx
 0x4650e4 DeleteObject
 0x4650e8 SetMapMode
 0x4650ec SetBkMode
 0x4650f0 RestoreDC
 0x4650f4 SaveDC
 0x4650f8 CreateRectRgnIndirect
 0x4650fc CreateBitmap
 0x465100 GetDeviceCaps
 0x465104 SetBkColor
 0x465108 SetTextColor
 0x46510c GetClipBox
 0x465110 GetTextColor
 0x465114 GetBkColor
 0x465118 CreateFontIndirectA
 0x46511c PtVisible
comdlg32.dll
 0x4655e0 GetFileTitleA
WINSPOOL.DRV
 0x4655d0 ClosePrinter
 0x4655d4 DocumentPropertiesA
 0x4655d8 OpenPrinterA
ADVAPI32.dll
 0x465000 GetUserNameA
 0x465004 GetLengthSid
 0x465008 GetTokenInformation
 0x46500c OpenProcessToken
 0x465010 GetSidSubAuthority
 0x465014 GetSidSubAuthorityCount
 0x465018 GetSidIdentifierAuthority
 0x46501c RegCloseKey
 0x465020 RegGetKeySecurity
 0x465024 RegOpenKeyExA
 0x465028 FreeSid
 0x46502c SetSecurityDescriptorDacl
 0x465030 RegQueryValueA
 0x465034 RegOpenKeyA
 0x465038 LookupPrivilegeValueA
 0x46503c AdjustTokenPrivileges
 0x465040 InitiateSystemShutdownA
 0x465044 RegDeleteKeyA
 0x465048 RegCreateKeyExA
 0x46504c RegEnumKeyExA
 0x465050 CopySid
 0x465054 RegCreateKeyA
 0x465058 RegDeleteValueA
 0x46505c RegSetValueExA
 0x465060 RegQueryValueExA
 0x465064 RegSetKeySecurity
 0x465068 RegQueryInfoKeyA
 0x46506c RegEnumKeyA
 0x465070 AllocateAndInitializeSid
 0x465074 InitializeAcl
 0x465078 AddAce
 0x46507c InitializeSecurityDescriptor
SHELL32.dll
 0x465384 SHEmptyRecycleBinA
 0x465388 SHGetSpecialFolderPathA
 0x46538c ShellExecuteA
COMCTL32.dll
 0x465084 None
 0x465088 _TrackMouseEvent
 0x46508c ImageList_Destroy
SHLWAPI.dll
 0x465394 SHDeleteValueA
 0x465398 PathFindExtensionA
 0x46539c PathStripToRootA
 0x4653a0 PathIsUNCA
 0x4653a4 SHDeleteKeyA
 0x4653a8 PathFindFileNameA
oledlg.dll
 0x465644 None
ole32.dll
 0x4655f0 CreateILockBytesOnHGlobal
 0x4655f4 CoTaskMemFree
 0x4655f8 CoInitialize
 0x4655fc CoInitializeEx
 0x465600 CoUninitialize
 0x465604 CoCreateInstance
 0x465608 OleUninitialize
 0x46560c CoFreeUnusedLibraries
 0x465610 CLSIDFromString
 0x465614 CoGetClassObject
 0x465618 StgOpenStorageOnILockBytes
 0x46561c CoRegisterMessageFilter
 0x465620 OleFlushClipboard
 0x465624 OleIsCurrentClipboard
 0x465628 CoRevokeClassObject
 0x46562c CLSIDFromProgID
 0x465630 CoTaskMemAlloc
 0x465634 CoInitializeSecurity
 0x465638 StgCreateDocfileOnILockBytes
 0x46563c OleInitialize
OLEAUT32.dll
 0x465344 SysAllocString
 0x465348 SysStringLen
 0x46534c SysFreeString
 0x465350 VariantInit
 0x465354 VariantCopy
 0x465358 VariantChangeType
 0x46535c VariantClear
 0x465360 SysAllocStringLen
 0x465364 VariantTimeToSystemTime
 0x465368 SystemTimeToVariantTime
 0x46536c SysAllocStringByteLen
 0x465370 SafeArrayDestroy
 0x465374 OleCreateFontIndirect
WININET.dll
 0x4655bc DeleteUrlCacheEntry
 0x4655c0 FindCloseUrlCache
 0x4655c4 FindFirstUrlCacheEntryA
 0x4655c8 FindNextUrlCacheEntryA
iphlpapi.dll
 0x4655e8 GetAdaptersInfo
RPCRT4.dll
 0x46537c UuidFromStringW

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure