ScreenShot
| Created | 2021.04.07 17:41 | Machine | s1_win7_x6402 |
| Filename | resk8.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 15 detected (malicious, high confidence, score, Save, confidence, FileRepMalware, Artemis, Unsafe, Static AI, Suspicious PE, H8oAarMA) | ||
| md5 | ac9e6b5f93ae7560c74176cd4ec2d129 | ||
| sha256 | 9eefae4b7a4bd95ddd0f411fee8bf9b7e3c4a521064d2c14c77612b5f5e68707 | ||
| ssdeep | 3072:/be9ljOMYM/NgDZO+jD9qMFGE3TUfK0lK0dc6ek09b+sivDkNZv8Mm0MuCtbnifp:ElqJYNZwD9Ljcz5MyQNZv84wtbnif1Y | ||
| imphash | 32856986f7eacdd11a6f4fcbafab0a87 | ||
| impfuzzy | 6:9OO5XlAUABZ/Oa9KgQTNrOLEOAFwyRzwDDJagDyQ1agDyQ+2:9OOJyZGuKrdOoveUwDDAxQExQz | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | File has been identified by 15 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | One or more processes crashed |
Rules (16cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_files_operation | Affect private profile | memory |
Network (3cnts) ?
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14002e000 DeleteFileA
0x14002e008 GetLastError
0x14002e010 CreateFileA
0x14002e018 WriteFile
0x14002e020 CloseHandle
0x14002e028 ExitProcess
0x14002e030 GetSystemTime
0x14002e038 GlobalAlloc
0x14002e040 GetTimeFormatA
0x14002e048 GetCommandLineA
0x14002e050 VirtualAlloc
0x14002e058 VirtualProtect
USER32.dll
0x14002e068 MessageBoxA
0x14002e070 SetWindowTextA
0x14002e078 GetWindowTextA
0x14002e080 OpenClipboard
EAT(Export Address Table) is none
KERNEL32.dll
0x14002e000 DeleteFileA
0x14002e008 GetLastError
0x14002e010 CreateFileA
0x14002e018 WriteFile
0x14002e020 CloseHandle
0x14002e028 ExitProcess
0x14002e030 GetSystemTime
0x14002e038 GlobalAlloc
0x14002e040 GetTimeFormatA
0x14002e048 GetCommandLineA
0x14002e050 VirtualAlloc
0x14002e058 VirtualProtect
USER32.dll
0x14002e068 MessageBoxA
0x14002e070 SetWindowTextA
0x14002e078 GetWindowTextA
0x14002e080 OpenClipboard
EAT(Export Address Table) is none