ScreenShot
| Created | 2021.04.07 09:28 | Machine | s1_win7_x6402 |
| Filename | dl8v2.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 18 detected (malicious, high confidence, Unsafe, Save, FileRepMalware, Artemis, Wacapew, score, BazarLoader, ai score=80, Static AI, Malicious PE, confidence, H8oAadEA) | ||
| md5 | c781696c39f20ecd8ad8ae0862935106 | ||
| sha256 | 0404cb08ca7bce5b44670d8871e626a70d03d18a48efdaeb8bb5cde45a5beb71 | ||
| ssdeep | 3072:O1qWRypI3vqlPa6mOzpMOwCBu+uGXfWfQUghMBIBitvsg2V0HX7LweX5WehwE/wB:O17ROI3vqy6mO1MSu+hWlg2BIJg2V0rN | ||
| imphash | 560828ec1597fa6a8bf91e627ea543e3 | ||
| impfuzzy | 12:iOKJfvXyQZGuKrdOoveUwDD5k2CAxQExQz:iO43ywidOovzw3K2CACECz | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | File has been identified by 18 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | One or more processes crashed |
Rules (16cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_files_operation | Affect private profile | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14002e000 CreateFileA
0x14002e008 DeleteFileA
0x14002e010 CloseHandle
0x14002e018 GetLastError
0x14002e020 WriteFile
0x14002e028 OutputDebugStringA
0x14002e030 ExitProcess
0x14002e038 GetSystemTime
0x14002e040 GlobalAlloc
0x14002e048 GetTimeFormatA
0x14002e050 GetCommandLineA
0x14002e058 VirtualAlloc
0x14002e060 VirtualProtect
USER32.dll
0x14002e070 MessageBoxA
0x14002e078 ShowWindow
0x14002e080 FindWindowA
0x14002e088 SetWindowTextA
0x14002e090 GetWindowTextA
0x14002e098 OpenClipboard
EAT(Export Address Table) is none
KERNEL32.dll
0x14002e000 CreateFileA
0x14002e008 DeleteFileA
0x14002e010 CloseHandle
0x14002e018 GetLastError
0x14002e020 WriteFile
0x14002e028 OutputDebugStringA
0x14002e030 ExitProcess
0x14002e038 GetSystemTime
0x14002e040 GlobalAlloc
0x14002e048 GetTimeFormatA
0x14002e050 GetCommandLineA
0x14002e058 VirtualAlloc
0x14002e060 VirtualProtect
USER32.dll
0x14002e070 MessageBoxA
0x14002e078 ShowWindow
0x14002e080 FindWindowA
0x14002e088 SetWindowTextA
0x14002e090 GetWindowTextA
0x14002e098 OpenClipboard
EAT(Export Address Table) is none