Report - MKY.exe

Malicious Packer Generic Malware
ScreenShot
Created 2021.03.17 09:16 Machine s1_win7_x6402
Filename MKY.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
10
Behavior Score
2.2
ZERO API file : malware
VT API (file) 22 detected (AIDetect, malware2, Artemis, Save, ali2000008, malicious, Fareit, Static AI, Suspicious PE, Wacatac, GuLoader, V90Z90, score, ZevbaF, jm0@aqatxDmi, Kryptik, CLOUD, EOVV, confidence, HwMA7fsA)
md5 50779df624494704e7e2d1c2b821a127
sha256 c169a50f79367c282348c93d99790a6493d0b585030ddcafe770a9cb8eeced87
ssdeep 3072:UsBTX38jRuY4OW+G5gnsodMQ+IpxMgToXQBg:PURuY4/+G5gnsodMQ+IpxMgf
imphash 82f3154e4b314b6810b189c7a61b6a27
impfuzzy 24:n9d/MSwzxwgOSwOVyq2xRN3u/39flCx1Sd3jblS4T/ESFNX+lh5HGs5mGSkEdFw9:nv/lwzxwgPweYxRN3u/399Cx1Sd3jbgN
  Network IP location

Signature (4cnts)

Level Description
warning File has been identified by 22 AntiVirus engines on VirusTotal as malicious
watch Enumerates services
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Packer_Zero Malicious Packer binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info HasRichSignature Rich Signature Check binaries (upload)
info IsWindowsGUI (no description) binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

MSVBVM60.DLL
 0x401000 _CIcos
 0x401004 _adj_fptan
 0x401008 None
 0x40100c __vbaVarMove
 0x401010 __vbaStrI4
 0x401014 __vbaFreeVar
 0x401018 __vbaStrVarMove
 0x40101c None
 0x401020 __vbaFreeVarList
 0x401024 _adj_fdiv_m64
 0x401028 __vbaFreeObjList
 0x40102c _adj_fprem1
 0x401030 __vbaHresultCheckObj
 0x401034 None
 0x401038 _adj_fdiv_m32
 0x40103c __vbaAryDestruct
 0x401040 __vbaLateMemSt
 0x401044 __vbaObjSet
 0x401048 __vbaOnError
 0x40104c None
 0x401050 _adj_fdiv_m16i
 0x401054 __vbaObjSetAddref
 0x401058 _adj_fdivr_m16i
 0x40105c __vbaVarTstLt
 0x401060 _CIsin
 0x401064 __vbaErase
 0x401068 None
 0x40106c __vbaChkstk
 0x401070 EVENT_SINK_AddRef
 0x401074 __vbaStrCmp
 0x401078 __vbaVarTstEq
 0x40107c __vbaObjVar
 0x401080 _adj_fpatan
 0x401084 __vbaLateIdCallLd
 0x401088 __vbaRedim
 0x40108c EVENT_SINK_Release
 0x401090 _CIsqrt
 0x401094 EVENT_SINK_QueryInterface
 0x401098 __vbaExceptHandler
 0x40109c _adj_fprem
 0x4010a0 _adj_fdivr_m64
 0x4010a4 None
 0x4010a8 __vbaFPException
 0x4010ac None
 0x4010b0 None
 0x4010b4 None
 0x4010b8 _CIlog
 0x4010bc __vbaNew2
 0x4010c0 _adj_fdiv_m32i
 0x4010c4 _adj_fdivr_m32i
 0x4010c8 __vbaStrCopy
 0x4010cc __vbaI4Str
 0x4010d0 _adj_fdivr_m32
 0x4010d4 _adj_fdiv_r
 0x4010d8 None
 0x4010dc __vbaVarTstNe
 0x4010e0 __vbaI4Var
 0x4010e4 None
 0x4010e8 __vbaVarAdd
 0x4010ec __vbaVarDup
 0x4010f0 None
 0x4010f4 __vbaLateMemCallLd
 0x4010f8 None
 0x4010fc _CIatan
 0x401100 __vbaStrMove
 0x401104 __vbaCastObj
 0x401108 _allmul
 0x40110c _CItan
 0x401110 _CIexp
 0x401114 __vbaFreeObj
 0x401118 __vbaFreeStr

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure