popup

Report - uTorrent221_4K.exe

Generic Malware Malicious Library UPX PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.01.02 05:16 Machine s1_win7_x6401
Filename uTorrent221_4K.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score Not founds Behavior Score
1.6
ZERO API file : clean
VT API (file)
md5 36bb5b88432be7a8674a2182e3341039
sha256 e9fda42f141f3fa37244d8f5065611a9dc8914af6b7b1cbd99e191389d251cb9
ssdeep 49152:PuWifaDh9pvSGmfOwU8/N5t2KnyeSqPlzvonOpVJJ81f:PuWyaDhXvSGmfOwUc9Ie9lxpVJi
imphash b4070734502a100c8f90bbd445995533
impfuzzy 48:J9jOX8LKc1XFjsX1Pfc++6WQYgeBtDXMunCZFi:JdJLKc1XFgX1Pfc++VVnBtDXMun8Fi
  Network IP location

Signature (6cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
info Checks amount of memory in system
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x433000 GetLastError
 0x433004 SetLastError
 0x433008 FormatMessageW
 0x43300c GetCurrentProcess
 0x433010 DeviceIoControl
 0x433014 SetFileTime
 0x433018 CloseHandle
 0x43301c CreateDirectoryW
 0x433020 RemoveDirectoryW
 0x433024 CreateFileW
 0x433028 DeleteFileW
 0x43302c CreateHardLinkW
 0x433030 GetShortPathNameW
 0x433034 GetLongPathNameW
 0x433038 MoveFileW
 0x43303c GetFileType
 0x433040 GetStdHandle
 0x433044 WriteFile
 0x433048 ReadFile
 0x43304c FlushFileBuffers
 0x433050 SetEndOfFile
 0x433054 SetFilePointer
 0x433058 SetFileAttributesW
 0x43305c GetFileAttributesW
 0x433060 FindClose
 0x433064 FindFirstFileW
 0x433068 FindNextFileW
 0x43306c GetVersionExW
 0x433070 GetCurrentDirectoryW
 0x433074 GetFullPathNameW
 0x433078 FoldStringW
 0x43307c GetModuleFileNameW
 0x433080 GetModuleHandleW
 0x433084 FindResourceW
 0x433088 FreeLibrary
 0x43308c GetProcAddress
 0x433090 GetCurrentProcessId
 0x433094 ExitProcess
 0x433098 SetThreadExecutionState
 0x43309c Sleep
 0x4330a0 LoadLibraryW
 0x4330a4 GetSystemDirectoryW
 0x4330a8 CompareStringW
 0x4330ac AllocConsole
 0x4330b0 FreeConsole
 0x4330b4 AttachConsole
 0x4330b8 WriteConsoleW
 0x4330bc GetProcessAffinityMask
 0x4330c0 CreateThread
 0x4330c4 SetThreadPriority
 0x4330c8 InitializeCriticalSection
 0x4330cc EnterCriticalSection
 0x4330d0 LeaveCriticalSection
 0x4330d4 DeleteCriticalSection
 0x4330d8 SetEvent
 0x4330dc ResetEvent
 0x4330e0 ReleaseSemaphore
 0x4330e4 WaitForSingleObject
 0x4330e8 CreateEventW
 0x4330ec CreateSemaphoreW
 0x4330f0 GetSystemTime
 0x4330f4 SystemTimeToTzSpecificLocalTime
 0x4330f8 TzSpecificLocalTimeToSystemTime
 0x4330fc SystemTimeToFileTime
 0x433100 FileTimeToLocalFileTime
 0x433104 LocalFileTimeToFileTime
 0x433108 FileTimeToSystemTime
 0x43310c GetCPInfo
 0x433110 IsDBCSLeadByte
 0x433114 MultiByteToWideChar
 0x433118 WideCharToMultiByte
 0x43311c GlobalAlloc
 0x433120 LockResource
 0x433124 GlobalLock
 0x433128 GlobalUnlock
 0x43312c GlobalFree
 0x433130 LoadResource
 0x433134 SizeofResource
 0x433138 SetCurrentDirectoryW
 0x43313c GetExitCodeProcess
 0x433140 GetLocalTime
 0x433144 GetTickCount
 0x433148 MapViewOfFile
 0x43314c UnmapViewOfFile
 0x433150 CreateFileMappingW
 0x433154 OpenFileMappingW
 0x433158 GetCommandLineW
 0x43315c SetEnvironmentVariableW
 0x433160 ExpandEnvironmentStringsW
 0x433164 GetTempPathW
 0x433168 MoveFileExW
 0x43316c GetLocaleInfoW
 0x433170 GetTimeFormatW
 0x433174 GetDateFormatW
 0x433178 GetNumberFormatW
 0x43317c SetFilePointerEx
 0x433180 GetConsoleMode
 0x433184 GetConsoleCP
 0x433188 HeapSize
 0x43318c SetStdHandle
 0x433190 GetProcessHeap
 0x433194 FreeEnvironmentStringsW
 0x433198 RaiseException
 0x43319c GetSystemInfo
 0x4331a0 VirtualProtect
 0x4331a4 VirtualQuery
 0x4331a8 LoadLibraryExA
 0x4331ac IsProcessorFeaturePresent
 0x4331b0 IsDebuggerPresent
 0x4331b4 UnhandledExceptionFilter
 0x4331b8 SetUnhandledExceptionFilter
 0x4331bc GetStartupInfoW
 0x4331c0 QueryPerformanceCounter
 0x4331c4 GetCurrentThreadId
 0x4331c8 GetSystemTimeAsFileTime
 0x4331cc InitializeSListHead
 0x4331d0 TerminateProcess
 0x4331d4 RtlUnwind
 0x4331d8 EncodePointer
 0x4331dc InitializeCriticalSectionAndSpinCount
 0x4331e0 TlsAlloc
 0x4331e4 TlsGetValue
 0x4331e8 TlsSetValue
 0x4331ec TlsFree
 0x4331f0 LoadLibraryExW
 0x4331f4 QueryPerformanceFrequency
 0x4331f8 GetModuleHandleExW
 0x4331fc GetModuleFileNameA
 0x433200 GetACP
 0x433204 HeapFree
 0x433208 HeapAlloc
 0x43320c HeapReAlloc
 0x433210 GetStringTypeW
 0x433214 LCMapStringW
 0x433218 FindFirstFileExA
 0x43321c FindNextFileA
 0x433220 IsValidCodePage
 0x433224 GetOEMCP
 0x433228 GetCommandLineA
 0x43322c GetEnvironmentStringsW
 0x433230 DecodePointer
gdiplus.dll
 0x433238 GdiplusStartup
 0x43323c GdipCreateHBITMAPFromBitmap
 0x433240 GdipCreateBitmapFromStreamICM
 0x433244 GdiplusShutdown
 0x433248 GdipCreateBitmapFromStream
 0x43324c GdipDisposeImage
 0x433250 GdipCloneImage
 0x433254 GdipFree
 0x433258 GdipAlloc

EAT(Export Address Table) Library


Similarity measure (PE file only) - Checking for service failure