popup

Report - newfour.exe

PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.04.21 13:46 Machine s1_win7_x6401
Filename newfour.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
12
 Behavior Score
1.6
ZERO API file : malware
VT API (file)
md5 b7a37c2f10d42243531a9f041c75c76f
sha256 a1d7dd8dca14593278e924b5b8d1f3201e8aa71b9e299770186f6dfda9eea0d5
ssdeep 24576:uPrk9t40j1jxXZkr1WReiDdyqM0GfxRSexq37oHq7YIgoU7gTPNetsF4I:uPrk9tFj7ZkavMTPRSexPEjo7uPNOseI
imphash 71cc5af9daad65e58c6f29c42cdf9201
impfuzzy 6:nERGDvZ/OiBJAEcXQwDLzRgSdn8BbMqtYbdowNbA:EcDvZGqA9AwDXRgKQcowxA
  No network connection information

Signature (6cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (2cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x6e20d4 GetModuleHandleA
 0x6e20d8 GetProcAddress
 0x6e20dc ExitProcess
 0x6e20e0 LoadLibraryA
user32.dll
 0x6e20e8 MessageBoxA
advapi32.dll
 0x6e20f0 RegCloseKey
oleaut32.dll
 0x6e20f8 SysFreeString
gdi32.dll
 0x6e2100 CreateFontA
shell32.dll
 0x6e2108 ShellExecuteA
version.dll
 0x6e2110 GetFileVersionInfoA
ole32.dll
 0x6e2118 CoCreateInstance

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure