popup

Report - autoplay.exe

Malicious Library UPX PE File PE32 OS Processor Check
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.01.16 17:33 Machine s1_win7_x6401
Filename autoplay.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
 Behavior Score
0.8
ZERO API file : clean
VT API (file) 1 detected (hetyo)
md5 76ef16e94f77454aaffdfa4c700be85f
sha256 3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82
ssdeep 3072:fNCpBPbYsMn1mx6nWGdN6YROBxQo6PfSPgHvUJjX1qINSxT3OIpkApPxn:fNiGC6nWGdN6YO6Pf9vAjX1qINGLdRz
imphash ec7603dfc11290c5ea59ede1b41eac50
impfuzzy 48:d45tAudUl1lMeiRB7Up9gZ0rrmbjYJ6FvEwwnoCG53zS5AiQ4oQKnBHBP4cX2:d4wSC1lMeiDm9A0rybjYUs
  Network IP location

Signature (3cnts)

Level Description
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
info Checks amount of memory in system
info One or more processes crashed

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

COMCTL32.dll
 0x41e00c _TrackMouseEvent
 0x41e010 None
MSVFW32.dll
 0x41e188 MCIWndCreateW
 0x41e18c MCIWndCreateA
WINMM.dll
 0x41e208 waveOutSetVolume
 0x41e20c waveOutGetVolume
 0x41e210 PlaySoundA
 0x41e214 waveOutGetNumDevs
SHLWAPI.dll
 0x41e194 PathRemoveFileSpecW
KERNEL32.dll
 0x41e064 InterlockedExchange
 0x41e068 GetModuleHandleA
 0x41e06c GetModuleFileNameA
 0x41e070 GetWindowsDirectoryA
 0x41e074 GetSystemDirectoryA
 0x41e078 LoadLibraryA
 0x41e07c SetLastError
 0x41e080 GetOEMCP
 0x41e084 GetACP
 0x41e088 SetEndOfFile
 0x41e08c CreateFileA
 0x41e090 FlushFileBuffers
 0x41e094 SetStdHandle
 0x41e098 GetTimeZoneInformation
 0x41e09c GetSystemTimeAsFileTime
 0x41e0a0 GetCurrentProcessId
 0x41e0a4 GetCurrentThreadId
 0x41e0a8 GetTickCount
 0x41e0ac QueryPerformanceCounter
 0x41e0b0 VirtualQuery
 0x41e0b4 GetSystemInfo
 0x41e0b8 VirtualProtect
 0x41e0bc GetLocaleInfoA
 0x41e0c0 IsBadCodePtr
 0x41e0c4 IsBadReadPtr
 0x41e0c8 SetFilePointer
 0x41e0cc GetStringTypeA
 0x41e0d0 IsBadWritePtr
 0x41e0d4 VirtualAlloc
 0x41e0d8 VirtualFree
 0x41e0dc HeapCreate
 0x41e0e0 HeapDestroy
 0x41e0e4 GetCommandLineW
 0x41e0e8 GetCommandLineA
 0x41e0ec GetEnvironmentStrings
 0x41e0f0 FreeEnvironmentStringsA
 0x41e0f4 UnhandledExceptionFilter
 0x41e0f8 CompareStringA
 0x41e0fc WaitForSingleObject
 0x41e100 CloseHandle
 0x41e104 DeviceIoControl
 0x41e108 MulDiv
 0x41e10c FreeLibrary
 0x41e110 Sleep
 0x41e114 ReleaseMutex
 0x41e118 GetLastError
 0x41e11c GetUserDefaultLCID
 0x41e120 GetUserDefaultUILanguage
 0x41e124 GetSystemDefaultLangID
 0x41e128 WriteFile
 0x41e12c ReadFile
 0x41e130 GetStartupInfoA
 0x41e134 GetFileType
 0x41e138 GetStdHandle
 0x41e13c SetHandleCount
 0x41e140 SetUnhandledExceptionFilter
 0x41e144 SetEnvironmentVariableA
 0x41e148 HeapSize
 0x41e14c HeapReAlloc
 0x41e150 RtlUnwind
 0x41e154 FindClose
 0x41e158 FileTimeToSystemTime
 0x41e15c FileTimeToLocalFileTime
 0x41e160 FindFirstFileA
 0x41e164 RaiseException
 0x41e168 ExitProcess
 0x41e16c TerminateProcess
 0x41e170 GetCurrentProcess
 0x41e174 GetVersionExA
 0x41e178 HeapAlloc
 0x41e17c HeapFree
 0x41e180 LCMapStringA
USER32.dll
 0x41e19c DestroyIcon
 0x41e1a0 GetSystemMetrics
 0x41e1a4 SetFocus
 0x41e1a8 BeginPaint
 0x41e1ac FillRect
 0x41e1b0 DrawEdge
 0x41e1b4 keybd_event
 0x41e1b8 SetForegroundWindow
 0x41e1bc UpdateWindow
 0x41e1c0 TranslateMessage
 0x41e1c4 ReleaseDC
 0x41e1c8 GetAsyncKeyState
 0x41e1cc SetCursor
 0x41e1d0 EndPaint
 0x41e1d4 RedrawWindow
 0x41e1d8 MoveWindow
 0x41e1dc GetIconInfo
 0x41e1e0 CreateIconIndirect
 0x41e1e4 GetClientRect
 0x41e1e8 InvalidateRect
 0x41e1ec ShowWindow
 0x41e1f0 PostQuitMessage
 0x41e1f4 DrawIconEx
 0x41e1f8 SetRect
 0x41e1fc GetDC
 0x41e200 GetWindowRect
GDI32.dll
 0x41e018 CreateSolidBrush
 0x41e01c GetStockObject
 0x41e020 PatBlt
 0x41e024 CreateCompatibleBitmap
 0x41e028 CreateCompatibleDC
 0x41e02c SetTextAlign
 0x41e030 SetLayout
 0x41e034 LineTo
 0x41e038 SetBkMode
 0x41e03c StretchBlt
 0x41e040 BitBlt
 0x41e044 SetTextColor
 0x41e048 CreatePenIndirect
 0x41e04c SelectObject
 0x41e050 MoveToEx
 0x41e054 Polyline
 0x41e058 DeleteObject
 0x41e05c DeleteDC
ADVAPI32.dll
 0x41e000 RegQueryValueA
 0x41e004 RegCloseKey

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure