ScreenShot
| Created | 2021.04.02 10:20 | Machine | s1_win7_x6401 |
| Filename | r104.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 6 detected (Malicious, FileRepMetagen, kcloud) | ||
| md5 | d2749c21fa8671e75cd147380ff110e0 | ||
| sha256 | 3dbab512123a36954684474e9a9f5502aa9edf0228a4df8f0cb33e328890d33b | ||
| ssdeep | 6144:BABatTx4LuLbY0xtTZrLRcBDrh15kk5XvI9eNtlhzQKOR64sWkxfkEW5sX2Lg:qc4utt95cBX8ejWT9kvW5s | ||
| imphash | 2de0725e4eedc6f70b07cc6f3c2e3b4e | ||
| impfuzzy | 24:bS1o0qtSmlJnc+pl3eDoTs2EOovbOuXhZHuDvB3jM6:bS1YtSkc+pp/sS3bBB | ||
Network IP location
Signature (1cnts)
| Level | Description |
|---|---|
| notice | File has been identified by 6 AntiVirus engines on VirusTotal as malicious |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | IsConsole | (no description) | binaries (upload) |
| info | win_files_operation | Affect private profile | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14000f000 QueryPerformanceCounter
0x14000f008 GetCurrentProcessId
0x14000f010 GetCurrentThreadId
0x14000f018 GetSystemTimeAsFileTime
0x14000f020 InitializeSListHead
0x14000f028 RtlCaptureContext
0x14000f030 RtlLookupFunctionEntry
0x14000f038 RtlVirtualUnwind
0x14000f040 IsDebuggerPresent
0x14000f048 UnhandledExceptionFilter
0x14000f050 SetUnhandledExceptionFilter
0x14000f058 GetStartupInfoW
0x14000f060 IsProcessorFeaturePresent
0x14000f068 GetModuleHandleW
0x14000f070 RtlUnwindEx
0x14000f078 GetLastError
0x14000f080 SetLastError
0x14000f088 EnterCriticalSection
0x14000f090 LeaveCriticalSection
0x14000f098 DeleteCriticalSection
0x14000f0a0 InitializeCriticalSectionAndSpinCount
0x14000f0a8 TlsAlloc
0x14000f0b0 TlsGetValue
0x14000f0b8 TlsSetValue
0x14000f0c0 TlsFree
0x14000f0c8 FreeLibrary
0x14000f0d0 GetProcAddress
0x14000f0d8 LoadLibraryExW
0x14000f0e0 RaiseException
0x14000f0e8 GetStdHandle
0x14000f0f0 WriteFile
0x14000f0f8 GetModuleFileNameA
0x14000f100 MultiByteToWideChar
0x14000f108 WideCharToMultiByte
0x14000f110 GetCurrentProcess
0x14000f118 ExitProcess
0x14000f120 TerminateProcess
0x14000f128 GetModuleHandleExW
0x14000f130 GetCommandLineA
0x14000f138 GetCommandLineW
0x14000f140 GetACP
0x14000f148 HeapFree
0x14000f150 HeapAlloc
0x14000f158 FindClose
0x14000f160 FindFirstFileExA
0x14000f168 FindNextFileA
0x14000f170 IsValidCodePage
0x14000f178 GetOEMCP
0x14000f180 GetCPInfo
0x14000f188 GetEnvironmentStringsW
0x14000f190 FreeEnvironmentStringsW
0x14000f198 SetEnvironmentVariableA
0x14000f1a0 SetStdHandle
0x14000f1a8 GetFileType
0x14000f1b0 GetStringTypeW
0x14000f1b8 CompareStringW
0x14000f1c0 LCMapStringW
0x14000f1c8 GetProcessHeap
0x14000f1d0 HeapSize
0x14000f1d8 HeapReAlloc
0x14000f1e0 FlushFileBuffers
0x14000f1e8 GetConsoleCP
0x14000f1f0 GetConsoleMode
0x14000f1f8 SetFilePointerEx
0x14000f200 CreateFileW
0x14000f208 CloseHandle
0x14000f210 WriteConsoleW
EAT(Export Address Table) is none
KERNEL32.dll
0x14000f000 QueryPerformanceCounter
0x14000f008 GetCurrentProcessId
0x14000f010 GetCurrentThreadId
0x14000f018 GetSystemTimeAsFileTime
0x14000f020 InitializeSListHead
0x14000f028 RtlCaptureContext
0x14000f030 RtlLookupFunctionEntry
0x14000f038 RtlVirtualUnwind
0x14000f040 IsDebuggerPresent
0x14000f048 UnhandledExceptionFilter
0x14000f050 SetUnhandledExceptionFilter
0x14000f058 GetStartupInfoW
0x14000f060 IsProcessorFeaturePresent
0x14000f068 GetModuleHandleW
0x14000f070 RtlUnwindEx
0x14000f078 GetLastError
0x14000f080 SetLastError
0x14000f088 EnterCriticalSection
0x14000f090 LeaveCriticalSection
0x14000f098 DeleteCriticalSection
0x14000f0a0 InitializeCriticalSectionAndSpinCount
0x14000f0a8 TlsAlloc
0x14000f0b0 TlsGetValue
0x14000f0b8 TlsSetValue
0x14000f0c0 TlsFree
0x14000f0c8 FreeLibrary
0x14000f0d0 GetProcAddress
0x14000f0d8 LoadLibraryExW
0x14000f0e0 RaiseException
0x14000f0e8 GetStdHandle
0x14000f0f0 WriteFile
0x14000f0f8 GetModuleFileNameA
0x14000f100 MultiByteToWideChar
0x14000f108 WideCharToMultiByte
0x14000f110 GetCurrentProcess
0x14000f118 ExitProcess
0x14000f120 TerminateProcess
0x14000f128 GetModuleHandleExW
0x14000f130 GetCommandLineA
0x14000f138 GetCommandLineW
0x14000f140 GetACP
0x14000f148 HeapFree
0x14000f150 HeapAlloc
0x14000f158 FindClose
0x14000f160 FindFirstFileExA
0x14000f168 FindNextFileA
0x14000f170 IsValidCodePage
0x14000f178 GetOEMCP
0x14000f180 GetCPInfo
0x14000f188 GetEnvironmentStringsW
0x14000f190 FreeEnvironmentStringsW
0x14000f198 SetEnvironmentVariableA
0x14000f1a0 SetStdHandle
0x14000f1a8 GetFileType
0x14000f1b0 GetStringTypeW
0x14000f1b8 CompareStringW
0x14000f1c0 LCMapStringW
0x14000f1c8 GetProcessHeap
0x14000f1d0 HeapSize
0x14000f1d8 HeapReAlloc
0x14000f1e0 FlushFileBuffers
0x14000f1e8 GetConsoleCP
0x14000f1f0 GetConsoleMode
0x14000f1f8 SetFilePointerEx
0x14000f200 CreateFileW
0x14000f208 CloseHandle
0x14000f210 WriteConsoleW
EAT(Export Address Table) is none