popup

Report - lv.exe

Malicious Library
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.03.25 09:19 Machine s1_win7_x6401
Filename lv.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
5
 Behavior Score
9.6
ZERO API file : clean
VT API (file) 30 detected (malicious, high confidence, Ulise, Artemis, Save, ZexaF, ruW@aC8jE@mG, Eldorado, score, Scrop, Lmuf, NSIS, SProtector, Unsafe, AGEN, Caynamer, ai score=82, multiple detections, Kryptik, CLASSIC, Static AI, Suspicious PE, Coins, HyoDHrsA)
md5 a0e5955430ffd68628e6924deba5b8a1
sha256 de5518baf0b99db0b28298eea2aef803869c3a1f03e71fa6c14b2949a76b9b1e
ssdeep 49152:T1bMPTjME/jVgkbOHNiL9VHiklAO55y+kFwQQS8BoOhxVN1:5oTJ/lL73b5y+kCQQS8fN1
imphash be41bf7b8cc010b614bd36bbca606973
impfuzzy 48:RlSYTMgU/4R6OR3J5OHALxlla/7LqQEFSv8rOAl6UyeXb0Wzn7+9SPNJ4KQ/1by5:DVAgu4R6qaIj19aBKsy
  Network IP location

Signature (24cnts)

Level Description
danger File has been identified by 30 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Creates an executable file in a user folder
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Created a process named as a common system process
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Looks up the external IP address
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
notice The binary likely contains encrypted or compressed data indicative of a packer
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (82cnts)

Level Name Description Collection
warning AutoIt www.autoitscript.com/site/autoit/ binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
notice Str_Win32_Http_API Match Windows Http API call binaries (download)
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call binaries (download)
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info IsPE64 (no description) binaries (download)
info OS_Processor_Check_Zero OS Processor Check Signature Zero binaries (download)
info PE_Header_Zero PE File Signature Zero binaries (download)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory
info create_com_service Create a COM server memory
info create_service Create a windows service memory
info cred_local Steal credential memory
info escalate_priv Escalade priviledges binaries (download)
info escalate_priv Escalade priviledges binaries (upload)
info escalate_priv Escalade priviledges memory
info HasDebugData DebugData Check binaries (download)
info HasModified_DOS_Message DOS Message Check binaries (download)
info HasOverlay Overlay Check binaries (download)
info HasOverlay Overlay Check binaries (upload)
info HasRichSignature Rich Signature Check binaries (download)
info HasRichSignature Rich Signature Check binaries (upload)
info hijack_network Hijack network configuration memory
info inject_thread Code injection with CreateRemoteThread in a remote process binaries (download)
info inject_thread Code injection with CreateRemoteThread in a remote process memory
info IsPacked Entropy Check binaries (download)
info IsPacked Entropy Check binaries (upload)
info IsWindowsGUI (no description) binaries (download)
info IsWindowsGUI (no description) binaries (upload)
info keylogger Run a keylogger binaries (download)
info keylogger Run a keylogger binaries (upload)
info keylogger Run a keylogger memory
info migrate_apc APC queue tasks migration memory
info network_dga Communication using dga memory
info network_dns Communications use DNS memory
info network_dropper File downloader/dropper memory
info network_ftp Communications over FTP memory
info network_http Communications over HTTP binaries (download)
info network_http Communications over HTTP memory
info network_p2p_win Communications over P2P network memory
info network_tcp_listen Listen for incoming communication memory
info network_tcp_socket Communications over RAW socket memory
info network_toredo Communications over Toredo network memory
info network_udp_sock Communications over UDP network memory
info screenshot Take screenshot binaries (download)
info screenshot Take screenshot binaries (upload)
info screenshot Take screenshot memory
info sniff_audio Record Audio memory
info spreading_file Malware can spread east-west file memory
info spreading_share Malware can spread east-west using share drive memory
info Str_Win32_Wininet_Library Match Windows Inet API library declaration binaries (download)
info Str_Win32_Wininet_Library Match Windows Inet API library declaration memory
info Str_Win32_Winsock2_Library Match Winsock 2 API library declaration binaries (download)
info Str_Win32_Winsock2_Library Match Winsock 2 API library declaration memory
info win_files_operation Affect private profile binaries (download)
info win_files_operation Affect private profile binaries (upload)
info win_files_operation Affect private profile memory
info win_mutex Create or check mutex memory
info win_private_profile Affect private profile memory
info win_registry Affect system registries binaries (download)
info win_registry Affect system registries binaries (upload)
info win_registry Affect system registries memory
info win_token Affect system token binaries (download)
info win_token Affect system token binaries (upload)
info win_token Affect system token memory

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://ip-api.com/line
whois
US TUT-AS 208.95.112.1 clean
grcCwxjDXykM.grcCwxjDXykM
whois
Unknown clean
HtcMxJDZqUppUy.HtcMxJDZqUppUy
whois
Unknown clean
ip-api.com
whois
US TUT-AS 208.95.112.1 clean
208.95.112.1
whois
US TUT-AS 208.95.112.1 clean

Suricata ids

ET POLICY External IP Lookup ip-api.com

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x409060 SetFileTime
 0x409064 CompareFileTime
 0x409068 SearchPathW
 0x40906c GetShortPathNameW
 0x409070 GetFullPathNameW
 0x409074 MoveFileW
 0x409078 SetCurrentDirectoryW
 0x40907c GetFileAttributesW
 0x409080 GetLastError
 0x409084 CreateDirectoryW
 0x409088 SetFileAttributesW
 0x40908c Sleep
 0x409090 GetTickCount
 0x409094 GetFileSize
 0x409098 GetModuleFileNameW
 0x40909c GetCurrentProcess
 0x4090a0 CopyFileW
 0x4090a4 ExitProcess
 0x4090a8 GetWindowsDirectoryW
 0x4090ac GetTempPathW
 0x4090b0 GetCommandLineW
 0x4090b4 SetErrorMode
 0x4090b8 lstrcpynA
 0x4090bc CloseHandle
 0x4090c0 lstrcpynW
 0x4090c4 GetDiskFreeSpaceW
 0x4090c8 GlobalUnlock
 0x4090cc GlobalLock
 0x4090d0 CreateThread
 0x4090d4 LoadLibraryW
 0x4090d8 CreateProcessW
 0x4090dc lstrcmpiA
 0x4090e0 CreateFileW
 0x4090e4 GetTempFileNameW
 0x4090e8 lstrcatW
 0x4090ec GetProcAddress
 0x4090f0 LoadLibraryA
 0x4090f4 GetModuleHandleA
 0x4090f8 OpenProcess
 0x4090fc lstrcpyW
 0x409100 GetVersionExW
 0x409104 GetSystemDirectoryW
 0x409108 GetVersion
 0x40910c lstrcpyA
 0x409110 RemoveDirectoryW
 0x409114 lstrcmpA
 0x409118 lstrcmpiW
 0x40911c lstrcmpW
 0x409120 ExpandEnvironmentStringsW
 0x409124 GlobalAlloc
 0x409128 WaitForSingleObject
 0x40912c GetExitCodeProcess
 0x409130 GlobalFree
 0x409134 GetModuleHandleW
 0x409138 LoadLibraryExW
 0x40913c FreeLibrary
 0x409140 WritePrivateProfileStringW
 0x409144 GetPrivateProfileStringW
 0x409148 WideCharToMultiByte
 0x40914c lstrlenA
 0x409150 MulDiv
 0x409154 WriteFile
 0x409158 ReadFile
 0x40915c MultiByteToWideChar
 0x409160 SetFilePointer
 0x409164 FindClose
 0x409168 FindNextFileW
 0x40916c FindFirstFileW
 0x409170 DeleteFileW
 0x409174 lstrlenW
USER32.dll
 0x409198 GetAsyncKeyState
 0x40919c IsDlgButtonChecked
 0x4091a0 ScreenToClient
 0x4091a4 GetMessagePos
 0x4091a8 CallWindowProcW
 0x4091ac IsWindowVisible
 0x4091b0 LoadBitmapW
 0x4091b4 CloseClipboard
 0x4091b8 SetClipboardData
 0x4091bc EmptyClipboard
 0x4091c0 OpenClipboard
 0x4091c4 TrackPopupMenu
 0x4091c8 GetWindowRect
 0x4091cc AppendMenuW
 0x4091d0 CreatePopupMenu
 0x4091d4 GetSystemMetrics
 0x4091d8 EndDialog
 0x4091dc EnableMenuItem
 0x4091e0 GetSystemMenu
 0x4091e4 SetClassLongW
 0x4091e8 IsWindowEnabled
 0x4091ec SetWindowPos
 0x4091f0 DialogBoxParamW
 0x4091f4 CheckDlgButton
 0x4091f8 CreateWindowExW
 0x4091fc SystemParametersInfoW
 0x409200 RegisterClassW
 0x409204 SetDlgItemTextW
 0x409208 GetDlgItemTextW
 0x40920c MessageBoxIndirectW
 0x409210 CharNextA
 0x409214 CharUpperW
 0x409218 CharPrevW
 0x40921c wvsprintfW
 0x409220 DispatchMessageW
 0x409224 PeekMessageW
 0x409228 wsprintfA
 0x40922c DestroyWindow
 0x409230 CreateDialogParamW
 0x409234 SetTimer
 0x409238 SetWindowTextW
 0x40923c PostQuitMessage
 0x409240 SetForegroundWindow
 0x409244 ShowWindow
 0x409248 wsprintfW
 0x40924c SendMessageTimeoutW
 0x409250 LoadCursorW
 0x409254 SetCursor
 0x409258 GetWindowLongW
 0x40925c GetSysColor
 0x409260 CharNextW
 0x409264 GetClassInfoW
 0x409268 ExitWindowsEx
 0x40926c IsWindow
 0x409270 GetDlgItem
 0x409274 SetWindowLongW
 0x409278 LoadImageW
 0x40927c GetDC
 0x409280 EnableWindow
 0x409284 InvalidateRect
 0x409288 SendMessageW
 0x40928c DefWindowProcW
 0x409290 BeginPaint
 0x409294 GetClientRect
 0x409298 FillRect
 0x40929c DrawTextW
 0x4092a0 EndPaint
 0x4092a4 FindWindowExW
GDI32.dll
 0x40903c SetBkColor
 0x409040 GetDeviceCaps
 0x409044 DeleteObject
 0x409048 CreateBrushIndirect
 0x40904c CreateFontIndirectW
 0x409050 SetBkMode
 0x409054 SetTextColor
 0x409058 SelectObject
SHELL32.dll
 0x40917c SHBrowseForFolderW
 0x409180 SHGetPathFromIDListW
 0x409184 SHGetFileInfoW
 0x409188 ShellExecuteW
 0x40918c SHFileOperationW
 0x409190 SHGetSpecialFolderLocation
ADVAPI32.dll
 0x409000 RegEnumKeyW
 0x409004 RegOpenKeyExW
 0x409008 RegCloseKey
 0x40900c RegDeleteKeyW
 0x409010 RegDeleteValueW
 0x409014 RegCreateKeyExW
 0x409018 RegSetValueExW
 0x40901c RegQueryValueExW
 0x409020 RegEnumValueW
COMCTL32.dll
 0x409028 ImageList_AddMasked
 0x40902c ImageList_Destroy
 0x409030 None
 0x409034 ImageList_Create
ole32.dll
 0x4092bc CoTaskMemFree
 0x4092c0 OleInitialize
 0x4092c4 OleUninitialize
 0x4092c8 CoCreateInstance
VERSION.dll
 0x4092ac GetFileVersionInfoSizeW
 0x4092b0 GetFileVersionInfoW
 0x4092b4 VerQueryValueW

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure