ScreenShot
| Created | 2024.11.15 13:50 | Machine | s1_win7_x6403 |
| Filename | op.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 28 detected (Common, Malicious, score, Unsafe, grayware, confidence, 100%, Adaware, UnwantedSig, xxzhus, WebCompanion, YzY0OpUS2EfpcHkV, Soft32, ApplicUnwnt@#2mzc8apw4jwaf, PUABundler, ICBundler, OTV2SQ, Eldorado, BundleInstaller, Install, susgen) | ||
| md5 | f5d20b351d56605bbb51befee989fa6e | ||
| sha256 | 1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b | ||
| ssdeep | 49152:oG5UfgTLfZ8yjQ2ggjrxNsz51khblF2OhuyFmLpEmwQE39fC2XhkhwzQejcz+:oG5QgTLxDcgjrzuDKbjuywExQElC2XhF | ||
| imphash | e00de6e48b9b06aceb12a81e7bf494c9 | ||
| impfuzzy | 48:oAUXy6Uy6U0wt8tAkSej5SU/Svn6GK/gRIAw8MeQAcj2AjJf+c9G9QOaO84OxTx6:oAwmH8Mexcj2Uf+cgSZl4OxTxMMY | ||
Network IP location
Signature (23cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 28 AntiVirus engines on VirusTotal as malicious |
| watch | Appends a new file extension or content to 83 files indicative of a ransomware file encryption process |
| watch | Attempts to identify installed AV products by registry key |
| watch | Performs 83 file moves indicative of a ransomware file encryption process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Drops an executable to the user AppData folder |
| notice | Executes one or more WMI queries |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | Expresses interest in specific running processes |
| notice | Queries for potentially installed applications |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The executable uses a known packer |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (28cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | NorthKorea_Zero | Maybe it's North Korea File | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | NSIS_Installer | Null Soft Installer | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | ftp_command | ftp command | binaries (download) |
| info | icon_file_format | icon file format | binaries (download) |
| info | Is_DotNET_DLL | (no description) | binaries (download) |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
PE API
IAT(Import Address Table) Library
OLEAUT32.dll
0x41b198 VariantClear
0x41b19c SysAllocString
USER32.dll
0x41b1ac SendMessageA
0x41b1b0 SetTimer
0x41b1b4 DialogBoxParamW
0x41b1b8 DialogBoxParamA
0x41b1bc SetWindowLongA
0x41b1c0 GetWindowLongA
0x41b1c4 SetWindowTextW
0x41b1c8 LoadIconA
0x41b1cc LoadStringW
0x41b1d0 LoadStringA
0x41b1d4 CharUpperW
0x41b1d8 CharUpperA
0x41b1dc DestroyWindow
0x41b1e0 EndDialog
0x41b1e4 PostMessageA
0x41b1e8 ShowWindow
0x41b1ec MessageBoxW
0x41b1f0 GetDlgItem
0x41b1f4 KillTimer
0x41b1f8 SetWindowTextA
SHELL32.dll
0x41b1a4 ShellExecuteExA
KERNEL32.dll
0x41b000 GetCurrentDirectoryA
0x41b004 GetStringTypeW
0x41b008 GetStringTypeA
0x41b00c LCMapStringW
0x41b010 LCMapStringA
0x41b014 InterlockedIncrement
0x41b018 InterlockedDecrement
0x41b01c GetProcAddress
0x41b020 GetOEMCP
0x41b024 GetACP
0x41b028 GetCPInfo
0x41b02c IsBadCodePtr
0x41b030 IsBadReadPtr
0x41b034 GetFileType
0x41b038 SetHandleCount
0x41b03c GetEnvironmentStringsW
0x41b040 GetEnvironmentStrings
0x41b044 FreeEnvironmentStringsW
0x41b048 FreeEnvironmentStringsA
0x41b04c UnhandledExceptionFilter
0x41b050 HeapSize
0x41b054 GetCurrentProcess
0x41b058 TerminateProcess
0x41b05c IsBadWritePtr
0x41b060 HeapCreate
0x41b064 HeapDestroy
0x41b068 GetEnvironmentVariableA
0x41b06c SetUnhandledExceptionFilter
0x41b070 TlsAlloc
0x41b074 ExitProcess
0x41b078 GetVersion
0x41b07c GetCommandLineA
0x41b080 GetStartupInfoA
0x41b084 GetModuleHandleA
0x41b088 WaitForSingleObject
0x41b08c CloseHandle
0x41b090 CreateProcessA
0x41b094 GetCommandLineW
0x41b098 GetVersionExA
0x41b09c LeaveCriticalSection
0x41b0a0 EnterCriticalSection
0x41b0a4 DeleteCriticalSection
0x41b0a8 MultiByteToWideChar
0x41b0ac WideCharToMultiByte
0x41b0b0 GetLastError
0x41b0b4 LoadLibraryA
0x41b0b8 GetModuleFileNameW
0x41b0bc GetModuleFileNameA
0x41b0c0 LocalFree
0x41b0c4 FormatMessageW
0x41b0c8 FormatMessageA
0x41b0cc SetFileTime
0x41b0d0 CreateFileW
0x41b0d4 SetLastError
0x41b0d8 SetFileAttributesW
0x41b0dc SetFileAttributesA
0x41b0e0 RemoveDirectoryW
0x41b0e4 RemoveDirectoryA
0x41b0e8 CreateDirectoryW
0x41b0ec CreateDirectoryA
0x41b0f0 DeleteFileW
0x41b0f4 DeleteFileA
0x41b0f8 GetFullPathNameW
0x41b0fc GetFullPathNameA
0x41b100 SetCurrentDirectoryW
0x41b104 SetCurrentDirectoryA
0x41b108 GetCurrentDirectoryW
0x41b10c GetTempPathW
0x41b110 GetTempPathA
0x41b114 GetCurrentProcessId
0x41b118 GetTickCount
0x41b11c GetCurrentThreadId
0x41b120 FindClose
0x41b124 FindFirstFileW
0x41b128 FindFirstFileA
0x41b12c FindNextFileW
0x41b130 FindNextFileA
0x41b134 CreateFileA
0x41b138 GetFileSize
0x41b13c SetFilePointer
0x41b140 ReadFile
0x41b144 WriteFile
0x41b148 SetEndOfFile
0x41b14c GetStdHandle
0x41b150 WaitForMultipleObjects
0x41b154 Sleep
0x41b158 VirtualAlloc
0x41b15c VirtualFree
0x41b160 CreateEventA
0x41b164 SetEvent
0x41b168 ResetEvent
0x41b16c InitializeCriticalSection
0x41b170 RtlUnwind
0x41b174 RaiseException
0x41b178 HeapAlloc
0x41b17c HeapFree
0x41b180 HeapReAlloc
0x41b184 CreateThread
0x41b188 TlsSetValue
0x41b18c TlsGetValue
0x41b190 ExitThread
EAT(Export Address Table) is none
OLEAUT32.dll
0x41b198 VariantClear
0x41b19c SysAllocString
USER32.dll
0x41b1ac SendMessageA
0x41b1b0 SetTimer
0x41b1b4 DialogBoxParamW
0x41b1b8 DialogBoxParamA
0x41b1bc SetWindowLongA
0x41b1c0 GetWindowLongA
0x41b1c4 SetWindowTextW
0x41b1c8 LoadIconA
0x41b1cc LoadStringW
0x41b1d0 LoadStringA
0x41b1d4 CharUpperW
0x41b1d8 CharUpperA
0x41b1dc DestroyWindow
0x41b1e0 EndDialog
0x41b1e4 PostMessageA
0x41b1e8 ShowWindow
0x41b1ec MessageBoxW
0x41b1f0 GetDlgItem
0x41b1f4 KillTimer
0x41b1f8 SetWindowTextA
SHELL32.dll
0x41b1a4 ShellExecuteExA
KERNEL32.dll
0x41b000 GetCurrentDirectoryA
0x41b004 GetStringTypeW
0x41b008 GetStringTypeA
0x41b00c LCMapStringW
0x41b010 LCMapStringA
0x41b014 InterlockedIncrement
0x41b018 InterlockedDecrement
0x41b01c GetProcAddress
0x41b020 GetOEMCP
0x41b024 GetACP
0x41b028 GetCPInfo
0x41b02c IsBadCodePtr
0x41b030 IsBadReadPtr
0x41b034 GetFileType
0x41b038 SetHandleCount
0x41b03c GetEnvironmentStringsW
0x41b040 GetEnvironmentStrings
0x41b044 FreeEnvironmentStringsW
0x41b048 FreeEnvironmentStringsA
0x41b04c UnhandledExceptionFilter
0x41b050 HeapSize
0x41b054 GetCurrentProcess
0x41b058 TerminateProcess
0x41b05c IsBadWritePtr
0x41b060 HeapCreate
0x41b064 HeapDestroy
0x41b068 GetEnvironmentVariableA
0x41b06c SetUnhandledExceptionFilter
0x41b070 TlsAlloc
0x41b074 ExitProcess
0x41b078 GetVersion
0x41b07c GetCommandLineA
0x41b080 GetStartupInfoA
0x41b084 GetModuleHandleA
0x41b088 WaitForSingleObject
0x41b08c CloseHandle
0x41b090 CreateProcessA
0x41b094 GetCommandLineW
0x41b098 GetVersionExA
0x41b09c LeaveCriticalSection
0x41b0a0 EnterCriticalSection
0x41b0a4 DeleteCriticalSection
0x41b0a8 MultiByteToWideChar
0x41b0ac WideCharToMultiByte
0x41b0b0 GetLastError
0x41b0b4 LoadLibraryA
0x41b0b8 GetModuleFileNameW
0x41b0bc GetModuleFileNameA
0x41b0c0 LocalFree
0x41b0c4 FormatMessageW
0x41b0c8 FormatMessageA
0x41b0cc SetFileTime
0x41b0d0 CreateFileW
0x41b0d4 SetLastError
0x41b0d8 SetFileAttributesW
0x41b0dc SetFileAttributesA
0x41b0e0 RemoveDirectoryW
0x41b0e4 RemoveDirectoryA
0x41b0e8 CreateDirectoryW
0x41b0ec CreateDirectoryA
0x41b0f0 DeleteFileW
0x41b0f4 DeleteFileA
0x41b0f8 GetFullPathNameW
0x41b0fc GetFullPathNameA
0x41b100 SetCurrentDirectoryW
0x41b104 SetCurrentDirectoryA
0x41b108 GetCurrentDirectoryW
0x41b10c GetTempPathW
0x41b110 GetTempPathA
0x41b114 GetCurrentProcessId
0x41b118 GetTickCount
0x41b11c GetCurrentThreadId
0x41b120 FindClose
0x41b124 FindFirstFileW
0x41b128 FindFirstFileA
0x41b12c FindNextFileW
0x41b130 FindNextFileA
0x41b134 CreateFileA
0x41b138 GetFileSize
0x41b13c SetFilePointer
0x41b140 ReadFile
0x41b144 WriteFile
0x41b148 SetEndOfFile
0x41b14c GetStdHandle
0x41b150 WaitForMultipleObjects
0x41b154 Sleep
0x41b158 VirtualAlloc
0x41b15c VirtualFree
0x41b160 CreateEventA
0x41b164 SetEvent
0x41b168 ResetEvent
0x41b16c InitializeCriticalSection
0x41b170 RtlUnwind
0x41b174 RaiseException
0x41b178 HeapAlloc
0x41b17c HeapFree
0x41b180 HeapReAlloc
0x41b184 CreateThread
0x41b188 TlsSetValue
0x41b18c TlsGetValue
0x41b190 ExitThread
EAT(Export Address Table) is none