ScreenShot
| Created | 2021.04.12 11:02 | Machine | s1_win7_x6401 |
| Filename | win.com | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 19 detected (AIDetect, malware2, GenericKD, Artemis, malicious, confidence, FileRepMalware, Generic ML PUA, AdwareLinkury, MxResIcn) | ||
| md5 | 73e9a221cc6f41c56c6664e9d0ca0ced | ||
| sha256 | 319e0b72717f820b8972fd543e2584072efa741cd66e594b155a939575a7ffb3 | ||
| ssdeep | 24576:rmoO8itEqfZK4cC/1rx0D3r7hSHZKhKF3cgOWndEmjVbna/7V/l:qvZrtgk5+KirWndPVMRl | ||
| imphash | 027ea80e8125c6dda271246922d4c3b0 | ||
| impfuzzy | 48:WOX8LKc1XFjsX1Pfc++6tGYgXBtDXMunCA:WJLKc1XFgX1Pfc++6jsBtDXMunX | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 19 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | This executable has a PDB path |
Rules (32cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check Signature Zero | binaries (upload) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (download) |
| info | PE_Header_Zero | PE File Signature Zero | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | escalate_priv | Escalade priviledges | binaries (upload) |
| info | HasDebugData | DebugData Check | binaries (download) |
| info | HasDebugData | DebugData Check | binaries (upload) |
| info | HasModified_DOS_Message | DOS Message Check | binaries (download) |
| info | HasOverlay | Overlay Check | binaries (upload) |
| info | HasRichSignature | Rich Signature Check | binaries (download) |
| info | HasRichSignature | Rich Signature Check | binaries (upload) |
| info | ImportTableIsBad | ImportTable Check | binaries (download) |
| info | IsConsole | (no description) | binaries (download) |
| info | IsNET_DLL | (no description) | binaries (download) |
| info | IsNET_EXE | (no description) | binaries (download) |
| info | IsPacked | Entropy Check | binaries (upload) |
| info | IsWindowsGUI | (no description) | binaries (download) |
| info | IsWindowsGUI | (no description) | binaries (upload) |
| info | screenshot | Take screenshot | binaries (upload) |
| info | Str_Win32_Wininet_Library | Match Windows Inet API library declaration | binaries (download) |
| info | Str_Win32_Winsock2_Library | Match Winsock 2 API library declaration | binaries (download) |
| info | win_files_operation | Affect private profile | binaries (upload) |
| info | win_registry | Affect system registries | binaries (upload) |
| info | win_token | Affect system token | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x430000 GetLastError
0x430004 SetLastError
0x430008 GetCurrentProcess
0x43000c DeviceIoControl
0x430010 SetFileTime
0x430014 CloseHandle
0x430018 CreateDirectoryW
0x43001c RemoveDirectoryW
0x430020 CreateFileW
0x430024 DeleteFileW
0x430028 CreateHardLinkW
0x43002c GetShortPathNameW
0x430030 GetLongPathNameW
0x430034 MoveFileW
0x430038 GetFileType
0x43003c GetStdHandle
0x430040 WriteFile
0x430044 ReadFile
0x430048 FlushFileBuffers
0x43004c SetEndOfFile
0x430050 SetFilePointer
0x430054 SetFileAttributesW
0x430058 GetFileAttributesW
0x43005c FindClose
0x430060 FindFirstFileW
0x430064 FindNextFileW
0x430068 GetVersionExW
0x43006c GetCurrentDirectoryW
0x430070 GetFullPathNameW
0x430074 FoldStringW
0x430078 GetModuleFileNameW
0x43007c GetModuleHandleW
0x430080 FindResourceW
0x430084 FreeLibrary
0x430088 GetProcAddress
0x43008c GetCurrentProcessId
0x430090 ExitProcess
0x430094 SetThreadExecutionState
0x430098 Sleep
0x43009c LoadLibraryW
0x4300a0 GetSystemDirectoryW
0x4300a4 CompareStringW
0x4300a8 AllocConsole
0x4300ac FreeConsole
0x4300b0 AttachConsole
0x4300b4 WriteConsoleW
0x4300b8 GetProcessAffinityMask
0x4300bc CreateThread
0x4300c0 SetThreadPriority
0x4300c4 InitializeCriticalSection
0x4300c8 EnterCriticalSection
0x4300cc LeaveCriticalSection
0x4300d0 DeleteCriticalSection
0x4300d4 SetEvent
0x4300d8 ResetEvent
0x4300dc ReleaseSemaphore
0x4300e0 WaitForSingleObject
0x4300e4 CreateEventW
0x4300e8 CreateSemaphoreW
0x4300ec GetSystemTime
0x4300f0 SystemTimeToTzSpecificLocalTime
0x4300f4 TzSpecificLocalTimeToSystemTime
0x4300f8 SystemTimeToFileTime
0x4300fc FileTimeToLocalFileTime
0x430100 LocalFileTimeToFileTime
0x430104 FileTimeToSystemTime
0x430108 GetCPInfo
0x43010c IsDBCSLeadByte
0x430110 MultiByteToWideChar
0x430114 WideCharToMultiByte
0x430118 GlobalAlloc
0x43011c GetTickCount
0x430120 SetCurrentDirectoryW
0x430124 GetExitCodeProcess
0x430128 GetLocalTime
0x43012c MapViewOfFile
0x430130 UnmapViewOfFile
0x430134 CreateFileMappingW
0x430138 OpenFileMappingW
0x43013c GetCommandLineW
0x430140 SetEnvironmentVariableW
0x430144 ExpandEnvironmentStringsW
0x430148 GetTempPathW
0x43014c MoveFileExW
0x430150 GetLocaleInfoW
0x430154 GetTimeFormatW
0x430158 GetDateFormatW
0x43015c GetNumberFormatW
0x430160 RaiseException
0x430164 GetSystemInfo
0x430168 VirtualProtect
0x43016c VirtualQuery
0x430170 LoadLibraryExA
0x430174 IsProcessorFeaturePresent
0x430178 IsDebuggerPresent
0x43017c UnhandledExceptionFilter
0x430180 SetUnhandledExceptionFilter
0x430184 GetStartupInfoW
0x430188 QueryPerformanceCounter
0x43018c GetCurrentThreadId
0x430190 GetSystemTimeAsFileTime
0x430194 InitializeSListHead
0x430198 TerminateProcess
0x43019c RtlUnwind
0x4301a0 EncodePointer
0x4301a4 InitializeCriticalSectionAndSpinCount
0x4301a8 TlsAlloc
0x4301ac TlsGetValue
0x4301b0 TlsSetValue
0x4301b4 TlsFree
0x4301b8 LoadLibraryExW
0x4301bc QueryPerformanceFrequency
0x4301c0 GetModuleHandleExW
0x4301c4 GetModuleFileNameA
0x4301c8 GetACP
0x4301cc HeapFree
0x4301d0 HeapAlloc
0x4301d4 HeapReAlloc
0x4301d8 GetStringTypeW
0x4301dc LCMapStringW
0x4301e0 FindFirstFileExA
0x4301e4 FindNextFileA
0x4301e8 IsValidCodePage
0x4301ec GetOEMCP
0x4301f0 GetCommandLineA
0x4301f4 GetEnvironmentStringsW
0x4301f8 FreeEnvironmentStringsW
0x4301fc GetProcessHeap
0x430200 SetStdHandle
0x430204 HeapSize
0x430208 GetConsoleCP
0x43020c GetConsoleMode
0x430210 SetFilePointerEx
0x430214 DecodePointer
EAT(Export Address Table) Library
KERNEL32.dll
0x430000 GetLastError
0x430004 SetLastError
0x430008 GetCurrentProcess
0x43000c DeviceIoControl
0x430010 SetFileTime
0x430014 CloseHandle
0x430018 CreateDirectoryW
0x43001c RemoveDirectoryW
0x430020 CreateFileW
0x430024 DeleteFileW
0x430028 CreateHardLinkW
0x43002c GetShortPathNameW
0x430030 GetLongPathNameW
0x430034 MoveFileW
0x430038 GetFileType
0x43003c GetStdHandle
0x430040 WriteFile
0x430044 ReadFile
0x430048 FlushFileBuffers
0x43004c SetEndOfFile
0x430050 SetFilePointer
0x430054 SetFileAttributesW
0x430058 GetFileAttributesW
0x43005c FindClose
0x430060 FindFirstFileW
0x430064 FindNextFileW
0x430068 GetVersionExW
0x43006c GetCurrentDirectoryW
0x430070 GetFullPathNameW
0x430074 FoldStringW
0x430078 GetModuleFileNameW
0x43007c GetModuleHandleW
0x430080 FindResourceW
0x430084 FreeLibrary
0x430088 GetProcAddress
0x43008c GetCurrentProcessId
0x430090 ExitProcess
0x430094 SetThreadExecutionState
0x430098 Sleep
0x43009c LoadLibraryW
0x4300a0 GetSystemDirectoryW
0x4300a4 CompareStringW
0x4300a8 AllocConsole
0x4300ac FreeConsole
0x4300b0 AttachConsole
0x4300b4 WriteConsoleW
0x4300b8 GetProcessAffinityMask
0x4300bc CreateThread
0x4300c0 SetThreadPriority
0x4300c4 InitializeCriticalSection
0x4300c8 EnterCriticalSection
0x4300cc LeaveCriticalSection
0x4300d0 DeleteCriticalSection
0x4300d4 SetEvent
0x4300d8 ResetEvent
0x4300dc ReleaseSemaphore
0x4300e0 WaitForSingleObject
0x4300e4 CreateEventW
0x4300e8 CreateSemaphoreW
0x4300ec GetSystemTime
0x4300f0 SystemTimeToTzSpecificLocalTime
0x4300f4 TzSpecificLocalTimeToSystemTime
0x4300f8 SystemTimeToFileTime
0x4300fc FileTimeToLocalFileTime
0x430100 LocalFileTimeToFileTime
0x430104 FileTimeToSystemTime
0x430108 GetCPInfo
0x43010c IsDBCSLeadByte
0x430110 MultiByteToWideChar
0x430114 WideCharToMultiByte
0x430118 GlobalAlloc
0x43011c GetTickCount
0x430120 SetCurrentDirectoryW
0x430124 GetExitCodeProcess
0x430128 GetLocalTime
0x43012c MapViewOfFile
0x430130 UnmapViewOfFile
0x430134 CreateFileMappingW
0x430138 OpenFileMappingW
0x43013c GetCommandLineW
0x430140 SetEnvironmentVariableW
0x430144 ExpandEnvironmentStringsW
0x430148 GetTempPathW
0x43014c MoveFileExW
0x430150 GetLocaleInfoW
0x430154 GetTimeFormatW
0x430158 GetDateFormatW
0x43015c GetNumberFormatW
0x430160 RaiseException
0x430164 GetSystemInfo
0x430168 VirtualProtect
0x43016c VirtualQuery
0x430170 LoadLibraryExA
0x430174 IsProcessorFeaturePresent
0x430178 IsDebuggerPresent
0x43017c UnhandledExceptionFilter
0x430180 SetUnhandledExceptionFilter
0x430184 GetStartupInfoW
0x430188 QueryPerformanceCounter
0x43018c GetCurrentThreadId
0x430190 GetSystemTimeAsFileTime
0x430194 InitializeSListHead
0x430198 TerminateProcess
0x43019c RtlUnwind
0x4301a0 EncodePointer
0x4301a4 InitializeCriticalSectionAndSpinCount
0x4301a8 TlsAlloc
0x4301ac TlsGetValue
0x4301b0 TlsSetValue
0x4301b4 TlsFree
0x4301b8 LoadLibraryExW
0x4301bc QueryPerformanceFrequency
0x4301c0 GetModuleHandleExW
0x4301c4 GetModuleFileNameA
0x4301c8 GetACP
0x4301cc HeapFree
0x4301d0 HeapAlloc
0x4301d4 HeapReAlloc
0x4301d8 GetStringTypeW
0x4301dc LCMapStringW
0x4301e0 FindFirstFileExA
0x4301e4 FindNextFileA
0x4301e8 IsValidCodePage
0x4301ec GetOEMCP
0x4301f0 GetCommandLineA
0x4301f4 GetEnvironmentStringsW
0x4301f8 FreeEnvironmentStringsW
0x4301fc GetProcessHeap
0x430200 SetStdHandle
0x430204 HeapSize
0x430208 GetConsoleCP
0x43020c GetConsoleMode
0x430210 SetFilePointerEx
0x430214 DecodePointer
EAT(Export Address Table) Library