popup

Report - credit.exe

  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.03.10 15:26 Machine s1_win7_x6401
Filename credit.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
1
 Behavior Score
1.8
ZERO API file : clean
VT API (file) 12 detected (AIDetect, malware1, malicious, high confidence, Save, score, EOUX, Wacapew, GuLoader, K49GJ0, confidence)
md5 0b493749b855ed259723bab93f9745a2
sha256 d4bec2bc2f7e7080663dedcdabec23ed917b8618ffdde5327ce5a3efa1342d36
ssdeep 768:g/kkV1GowXJ+3y8we953TpPGZwEUIrNGl:Xk+oiSy2Dp+ZwENQ
imphash efe67876eb5f9d9445fcdb777cf92f3b
impfuzzy 24:n9w/wzQwgOSwOVyl3uGPrWeTSx1iblmT/EWFNwj5fhwfGs5XGSk+gbSTSwMSwC:nq/wzQwgPwew3uGPCemx1ibUTNFNwjZ6
  Network IP location

Signature (4cnts)

Level Description
watch File has been identified by 12 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Yara rule detected in process memory

Rules (48cnts)

Level Name Description Collection
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info SEH__vba (no description) memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory
info create_com_service Create a COM server memory
info create_service Create a windows service memory
info cred_local Steal credential memory
info escalate_priv Escalade priviledges memory
info HasRichSignature Rich Signature Check binaries (upload)
info inject_thread Code injection with CreateRemoteThread in a remote process memory
info IsWindowsGUI (no description) binaries (upload)
info keylogger Run a keylogger memory
info migrate_apc APC queue tasks migration memory
info network_dga Communication using dga memory
info network_dns Communications use DNS memory
info network_dropper File downloader/dropper memory
info network_ftp Communications over FTP memory
info network_http Communications over HTTP memory
info network_p2p_win Communications over P2P network memory
info network_tcp_listen Listen for incoming communication memory
info network_tcp_socket Communications over RAW socket memory
info network_udp_sock Communications over UDP network memory
info screenshot Take screenshot memory
info sniff_audio Record Audio memory
info spreading_file Malware can spread east-west file memory
info spreading_share Malware can spread east-west using share drive memory
info Str_Win32_Wininet_Library Match Windows Inet API library declaration memory
info Str_Win32_Winsock2_Library Match Winsock 2 API library declaration memory
info win_files_operation Affect private profile memory
info win_mutex Create or check mutex memory
info win_private_profile Affect private profile memory
info win_registry Affect system registries memory
info win_token Affect system token memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 _CIcos
 0x401004 _adj_fptan
 0x401008 __vbaVarMove
 0x40100c __vbaFreeVar
 0x401010 __vbaStrVarMove
 0x401014 __vbaFreeVarList
 0x401018 _adj_fdiv_m64
 0x40101c __vbaFreeObjList
 0x401020 _adj_fprem1
 0x401024 __vbaHresultCheckObj
 0x401028 _adj_fdiv_m32
 0x40102c None
 0x401030 None
 0x401034 __vbaObjSet
 0x401038 __vbaOnError
 0x40103c None
 0x401040 _adj_fdiv_m16i
 0x401044 _adj_fdivr_m16i
 0x401048 __vbaVarTstLt
 0x40104c __vbaFpR8
 0x401050 _CIsin
 0x401054 None
 0x401058 __vbaChkstk
 0x40105c EVENT_SINK_AddRef
 0x401060 __vbaStrCmp
 0x401064 _adj_fpatan
 0x401068 __vbaLateIdCallLd
 0x40106c EVENT_SINK_Release
 0x401070 _CIsqrt
 0x401074 EVENT_SINK_QueryInterface
 0x401078 __vbaExceptHandler
 0x40107c _adj_fprem
 0x401080 _adj_fdivr_m64
 0x401084 None
 0x401088 __vbaFPException
 0x40108c _CIlog
 0x401090 __vbaNew2
 0x401094 __vbaInStr
 0x401098 None
 0x40109c _adj_fdiv_m32i
 0x4010a0 _adj_fdivr_m32i
 0x4010a4 __vbaStrCopy
 0x4010a8 __vbaFreeStrList
 0x4010ac _adj_fdivr_m32
 0x4010b0 _adj_fdiv_r
 0x4010b4 None
 0x4010b8 __vbaVarTstNe
 0x4010bc __vbaI4Var
 0x4010c0 __vbaVarAdd
 0x4010c4 __vbaVarDup
 0x4010c8 _CIatan
 0x4010cc __vbaStrMove
 0x4010d0 _allmul
 0x4010d4 __vbaLateIdSt
 0x4010d8 _CItan
 0x4010dc _CIexp
 0x4010e0 __vbaFreeObj
 0x4010e4 __vbaFreeStr

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure