| File name: | PO.exe |
| Full analysis: | https://app.any.run/tasks/29494308-6f1f-49e9-b525-450a2644bb37 |
| Verdict: | Malicious activity |
| Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
| Analysis date: | December 05, 2022, 17:49:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 20417F142281716421843648D1103BA6 |
| SHA1: | 2F5F6221EFBBB1936A5DE6F31AF8B283811FCA30 |
| SHA256: | 1081715A99EAFD929AF7F2C08C1D17B90C2C81DFD08230F613E168A49DB37698 |
| SSDEEP: | 6144:TY2OsbpMOEkszHHXNDIdeQW4nlwctXLbhU:IzXN03jX3hU |
MALICIOUS
Drops the executable file immediately after the start
- PO.exe (PID: 3164)
GULOADER detected by memory dumps
- PO.exe (PID: 3164)
Loads dropped or rewritten executable
- PO.exe (PID: 3164)
SUSPICIOUS
Searches for installed software
- PO.exe (PID: 3164)
Creates a software uninstall entry
- PO.exe (PID: 3164)
Executable content was dropped or overwritten
- PO.exe (PID: 3164)
INFO
Checks supported languages
- PO.exe (PID: 3164)
Reads the computer name
- PO.exe (PID: 3164)
Creates a file in a temporary directory
- PO.exe (PID: 3164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 2016-Apr-03 20:18:47 |
| Detected languages: |
|
| Comments: | oghamist Lrredernes Cementgulv |
| CompanyName: | Grundegenskabs antick |
| FileDescription: | Warman |
| OriginalFilename: | Instigates Sortkunsts.exe |
DOS Header
| e_magic: | MZ |
|---|---|
| e_cblp: | 144 |
| e_cp: | 3 |
| e_crlc: | - |
| e_cparhdr: | 4 |
| e_minalloc: | - |
| e_maxalloc: | 65535 |
| e_ss: | - |
| e_sp: | 184 |
| e_csum: | - |
| e_ip: | - |
| e_cs: | - |
| e_ovno: | - |
| e_oemid: | - |
| e_oeminfo: | - |
| e_lfanew: | 216 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| NumberofSections: | 5 |
| TimeDateStamp: | 2016-Apr-03 20:18:47 |
| PointerToSymbolTable: | - |
| NumberOfSymbols: | - |
| SizeOfOptionalHeader: | 224 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 4096 | 23643 | 24064 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.41149 |
.rdata | 28672 | 4678 | 5120 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.00503 |
.data | 36864 | 108536 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.1084 |
.ndata | 147456 | 126976 | 0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rsrc | 274432 | 90048 | 90112 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.37574 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.18004 | 67624 | UNKNOWN | English - United States | RT_ICON |
2 | 4.50784 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 4.46634 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 4.43754 | 2440 | UNKNOWN | English - United States | RT_ICON |
5 | 4.07637 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.61782 | 324 | UNKNOWN | English - United States | RT_DIALOG |
104 | 2.6935 | 316 | UNKNOWN | English - United States | RT_DIALOG |
105 | 2.65819 | 288 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.88094 | 284 | UNKNOWN | English - United States | RT_DIALOG |
107 | 2.62276 | 196 | UNKNOWN | English - United States | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
32
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3164 | "C:\Users\admin\AppData\Local\Temp\PO.exe" | C:\Users\admin\AppData\Local\Temp\PO.exe | Explorer.EXE | ||||||||||||
User: admin Company: Grundegenskabs antick Integrity Level: MEDIUM Description: Warman Exit code: 0 Modules
| |||||||||||||||
Total events
731
Read events
726
Write events
5
Delete events
0
Modification events
| (PID) Process: | (3164) PO.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\One |
| Operation: | write | Name: | Guli |
Value: 145 | |||
| (PID) Process: | (3164) PO.exe | Key: | HKEY_CURRENT_USER\Software\Enegang\Rouleredes\Udlaanings |
| Operation: | write | Name: | Abdiceringens116 |
Value: FFE64A77 | |||
Executable files
1
Suspicious files
1
Text files
2
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3164 | PO.exe | C:\Users\admin\AppData\Local\Temp\TOBEN.lnk | lnk | |
MD5:— | SHA256:— | |||
| 3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Capilliculture\Dracaenas\applause.Als | binary | |
MD5:— | SHA256:— | |||
| 3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Stadsstuerne\weather-severe-alert-symbolic.svg | image | |
MD5:DF0A28BCF48D0D15CA617FA4969F2DA5 | SHA256:79AC7294E587565B09D8E0EB48803D508CF9A6B78F6B9977D4382782C156B482 | |||
| 3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Scripula62\battery-low-symbolic.symbolic.png | image | |
MD5:4E3FAC85D22F5D2C40F679CCDF2AE570 | SHA256:DC4FCE5176F97745929335757724D8F03D2D297F2A599DE633D5807C7A56668B | |||
| 3164 | PO.exe | C:\Users\admin\AppData\Local\Temp\nseE84F.tmp\System.dll | executable | |
MD5:B8992E497D57001DDF100F9C397FCEF5 | SHA256:98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report