File name: | PO.exe |
Full analysis: | https://app.any.run/tasks/29494308-6f1f-49e9-b525-450a2644bb37 |
Verdict: | Malicious activity |
Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
Analysis date: | December 05, 2022, 17:49:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | 20417F142281716421843648D1103BA6 |
SHA1: | 2F5F6221EFBBB1936A5DE6F31AF8B283811FCA30 |
SHA256: | 1081715A99EAFD929AF7F2C08C1D17B90C2C81DFD08230F613E168A49DB37698 |
SSDEEP: | 6144:TY2OsbpMOEkszHHXNDIdeQW4nlwctXLbhU:IzXN03jX3hU |
.exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (14.2) |
.exe | | | Win32 Executable (generic) (9.7) |
.exe | | | Generic Win/DOS Executable (4.3) |
.exe | | | DOS Executable Generic (4.3) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2016-Apr-03 20:18:47 |
Detected languages: |
|
Comments: | oghamist Lrredernes Cementgulv |
CompanyName: | Grundegenskabs antick |
FileDescription: | Warman |
OriginalFilename: | Instigates Sortkunsts.exe |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 216 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2016-Apr-03 20:18:47 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 23643 | 24064 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.41149 |
.rdata | 28672 | 4678 | 5120 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.00503 |
.data | 36864 | 108536 | 1024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.1084 |
.ndata | 147456 | 126976 | 0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
.rsrc | 274432 | 90048 | 90112 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.37574 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.18004 | 67624 | UNKNOWN | English - United States | RT_ICON |
2 | 4.50784 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 4.46634 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 4.43754 | 2440 | UNKNOWN | English - United States | RT_ICON |
5 | 4.07637 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.61782 | 324 | UNKNOWN | English - United States | RT_DIALOG |
104 | 2.6935 | 316 | UNKNOWN | English - United States | RT_DIALOG |
105 | 2.65819 | 288 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.88094 | 284 | UNKNOWN | English - United States | RT_DIALOG |
107 | 2.62276 | 196 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3164 | "C:\Users\admin\AppData\Local\Temp\PO.exe" | C:\Users\admin\AppData\Local\Temp\PO.exe | Explorer.EXE | ||||||||||||
User: admin Company: Grundegenskabs antick Integrity Level: MEDIUM Description: Warman Modules
|
(PID) Process: | (3164) PO.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\One |
Operation: | write | Name: | Guli |
Value: 145 | |||
(PID) Process: | (3164) PO.exe | Key: | HKEY_CURRENT_USER\Software\Enegang\Rouleredes\Udlaanings |
Operation: | write | Name: | Abdiceringens116 |
Value: FFE64A77 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3164 | PO.exe | C:\Users\admin\AppData\Local\Temp\TOBEN.lnk | lnk | |
MD5:4D09B07134595FB16F429BC0B0022260 | SHA256:6AE5EDB701376D3EDA811D30CF91A3177DF7E1DAD4665DA6632A528B8E7552A0 | |||
3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Capilliculture\Dracaenas\applause.Als | binary | |
MD5:F0497939C254EBB74D4F8B8B1B55CF7B | SHA256:986F5CB2A3F1787E3FC01E30343E22E5A1430347F7DD7AC3FD24B5D2092A4292 | |||
3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Scripula62\battery-low-symbolic.symbolic.png | image | |
MD5:4E3FAC85D22F5D2C40F679CCDF2AE570 | SHA256:DC4FCE5176F97745929335757724D8F03D2D297F2A599DE633D5807C7A56668B | |||
3164 | PO.exe | C:\Users\admin\AppData\Local\Temp\nseE84F.tmp\System.dll | executable | |
MD5:B8992E497D57001DDF100F9C397FCEF5 | SHA256:98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B | |||
3164 | PO.exe | C:\Users\admin\AppData\Local\Mtningspunkt\Liddi\Stadsstuerne\weather-severe-alert-symbolic.svg | image | |
MD5:DF0A28BCF48D0D15CA617FA4969F2DA5 | SHA256:79AC7294E587565B09D8E0EB48803D508CF9A6B78F6B9977D4382782C156B482 |