popup

Report - The%20Foundry.exe

Generic Malware Malicious Library Malicious Packer UPX PE File DllRegisterServer dll PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.01.13 16:06 Machine s1_win7_x6401
Filename The%20Foundry.exe
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
AI Score
3
 Behavior Score
5.0
ZERO API
VT API (file) 34 detected (AIDetectMalware, ClipBanker, tscz, Malicious, score, Ghanarava, Unsafe, confidence, 100%, Attribute, HighConfidence, high confidence, a variant of WinGo, FileRepMalware, Misc, bzro, LUMMASTEALER, YXFALZ, Static AI, Suspicious PE, Detected, Wacatac, U4C0EE, ABRisk, SAZR, Artemis, BScope, TrojanPSW, WinGo, susgen, B9nj)
md5 65d24fbde2ce4007a7ff42c831a96702
sha256 5ef7c2444825d6fe6161fe927a9bd02c1e9a37f4a2f76c8330a53a960d8c9c3d
ssdeep 49152:VqUXp2k/AcGB1/qPzeQPk2wNo/MAx5Sh1kP47v9yAH+8VsCRMRI05gbVytJkwCrW:VtX9/Ge3fwNo0aEh+c+WgtVCrGOkS8q
imphash 9cbefe68f395e67356e2a5d8d1b285c0
impfuzzy 24:UbVjhNwO+VuT2oLtXOr6kwmDruMztxdEr6tP:KwO+VAXOmGx0oP
  Network IP location

Signature (8cnts)

Level Description
danger Executed a process and injected code into it
danger File has been identified by 34 AntiVirus engines on VirusTotal as malicious
watch Allocates execute permission to another process indicative of possible code injection
watch Detects the presence of Wine emulator
watch Manipulates memory of a non-child process indicative of process injection
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice One or more potentially interesting buffers were extracted
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (8cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x89a7c0 WriteFile
 0x89a7c4 WriteConsoleW
 0x89a7c8 WaitForMultipleObjects
 0x89a7cc WaitForSingleObject
 0x89a7d0 VirtualQuery
 0x89a7d4 VirtualFree
 0x89a7d8 VirtualAlloc
 0x89a7dc SwitchToThread
 0x89a7e0 SuspendThread
 0x89a7e4 SetWaitableTimer
 0x89a7e8 SetUnhandledExceptionFilter
 0x89a7ec SetProcessPriorityBoost
 0x89a7f0 SetEvent
 0x89a7f4 SetErrorMode
 0x89a7f8 SetConsoleCtrlHandler
 0x89a7fc ResumeThread
 0x89a800 PostQueuedCompletionStatus
 0x89a804 LoadLibraryA
 0x89a808 LoadLibraryW
 0x89a80c SetThreadContext
 0x89a810 GetThreadContext
 0x89a814 GetSystemInfo
 0x89a818 GetSystemDirectoryA
 0x89a81c GetStdHandle
 0x89a820 GetQueuedCompletionStatusEx
 0x89a824 GetProcessAffinityMask
 0x89a828 GetProcAddress
 0x89a82c GetEnvironmentStringsW
 0x89a830 GetConsoleMode
 0x89a834 FreeEnvironmentStringsW
 0x89a838 ExitProcess
 0x89a83c DuplicateHandle
 0x89a840 CreateWaitableTimerExW
 0x89a844 CreateThread
 0x89a848 CreateIoCompletionPort
 0x89a84c CreateFileA
 0x89a850 CreateEventA
 0x89a854 CloseHandle
 0x89a858 AddVectoredExceptionHandler

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure