ScreenShot
| Created | 2021.05.18 17:48 | Machine | s1_win7_x6401 |
| Filename | phantom.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 21 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, ZexaF, IuW@aS7dpmiG, Attribute, HighConfidence, Lockbit, Glupteba, Sabsik, score, ET#83%, RDMK, cmRtazrUlHOq4QWYTY2MWwATnJ+G, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 9b7ba71c5d9e3d1e8ccc6848333f45ae | ||
| sha256 | 8896dd2a44120202a979a9c6caa747861d0a5bb77d46ca475384c000e7f0bd57 | ||
| ssdeep | 12288:98FfMU6pgXBg/iMtP0TKFc6Z6zoCl8uj:8f0li5+FpZSl8uj | ||
| imphash | 0438b1b3eae2e210b97e0cc57b8b4723 | ||
| impfuzzy | 48:Y6UkjAhcAe59OS8cR0yXlzpnpPyYitsQfpHxKcFblRQ:YSl75sSDSm/pPxitsQfpocFblm | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_Win32_Glupteba_1_Zero | Trojan Win32 Glupteba | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421000 ExitProcess
0x421004 GetCommandLineW
0x421008 GetTempFileNameW
0x42100c GetFileSize
0x421010 WriteConsoleInputW
0x421014 SetFilePointer
0x421018 WritePrivateProfileStructA
0x42101c DebugActiveProcessStop
0x421020 GetNumberOfConsoleInputEvents
0x421024 FreeLibrary
0x421028 SystemTimeToFileTime
0x42102c SetConsoleActiveScreenBuffer
0x421030 WritePrivateProfileSectionA
0x421034 CreateJobObjectW
0x421038 GetProfileStringW
0x42103c GetProfileSectionA
0x421040 WaitForSingleObject
0x421044 SignalObjectAndWait
0x421048 SetComputerNameW
0x42104c FindFirstFileExW
0x421050 SetTapeParameters
0x421054 GetProcessPriorityBoost
0x421058 CreateNamedPipeW
0x42105c IsBadReadPtr
0x421060 EnumTimeFormatsW
0x421064 SetCommState
0x421068 GetDriveTypeA
0x42106c TlsSetValue
0x421070 FindResourceExA
0x421074 GlobalAlloc
0x421078 GetVolumeInformationA
0x42107c Sleep
0x421080 GetSystemWow64DirectoryW
0x421084 HeapDestroy
0x421088 GetFileAttributesA
0x42108c GlobalFlags
0x421090 SetConsoleMode
0x421094 Beep
0x421098 MulDiv
0x42109c VerifyVersionInfoA
0x4210a0 GetBinaryTypeA
0x4210a4 SetSystemPowerState
0x4210a8 LocalHandle
0x4210ac GetTimeZoneInformation
0x4210b0 GetACP
0x4210b4 lstrlenW
0x4210b8 RaiseException
0x4210bc DeactivateActCtx
0x4210c0 GetPrivateProfileIntW
0x4210c4 OpenMutexW
0x4210c8 GetLastError
0x4210cc IsDBCSLeadByteEx
0x4210d0 SetLastError
0x4210d4 ReadConsoleOutputCharacterA
0x4210d8 GetProcAddress
0x4210dc FindVolumeMountPointClose
0x4210e0 VirtualAlloc
0x4210e4 SearchPathA
0x4210e8 GetAtomNameA
0x4210ec LoadLibraryA
0x4210f0 OpenThread
0x4210f4 WriteConsoleA
0x4210f8 ProcessIdToSessionId
0x4210fc MoveFileA
0x421100 BuildCommDCBAndTimeoutsW
0x421104 IsSystemResumeAutomatic
0x421108 SetConsoleDisplayMode
0x42110c SetConsoleOutputCP
0x421110 GetCurrentConsoleFont
0x421114 SetCommMask
0x421118 GetPrivateProfileStructA
0x42111c GetTapeParameters
0x421120 WaitForMultipleObjects
0x421124 SetSystemTime
0x421128 GetPrivateProfileSectionNamesA
0x42112c GetCurrentDirectoryA
0x421130 GetConsoleCursorInfo
0x421134 ScrollConsoleScreenBufferA
0x421138 OpenSemaphoreW
0x42113c GetVersionExA
0x421140 AddConsoleAliasA
0x421144 GetSystemTime
0x421148 CopyFileExA
0x42114c AreFileApisANSI
0x421150 lstrcpyA
0x421154 WideCharToMultiByte
0x421158 EncodePointer
0x42115c DecodePointer
0x421160 HeapSetInformation
0x421164 GetStartupInfoW
0x421168 TerminateProcess
0x42116c GetCurrentProcess
0x421170 UnhandledExceptionFilter
0x421174 SetUnhandledExceptionFilter
0x421178 IsDebuggerPresent
0x42117c GetModuleFileNameW
0x421180 InterlockedIncrement
0x421184 InterlockedDecrement
0x421188 GetOEMCP
0x42118c GetCPInfo
0x421190 IsValidCodePage
0x421194 TlsAlloc
0x421198 TlsGetValue
0x42119c GetCurrentThreadId
0x4211a0 TlsFree
0x4211a4 GetModuleHandleW
0x4211a8 LeaveCriticalSection
0x4211ac EnterCriticalSection
0x4211b0 InitializeCriticalSectionAndSpinCount
0x4211b4 SetStdHandle
0x4211b8 GetFileType
0x4211bc WriteFile
0x4211c0 GetConsoleCP
0x4211c4 GetConsoleMode
0x4211c8 HeapValidate
0x4211cc IsProcessorFeaturePresent
0x4211d0 QueryPerformanceCounter
0x4211d4 GetTickCount
0x4211d8 GetCurrentProcessId
0x4211dc GetSystemTimeAsFileTime
0x4211e0 FreeEnvironmentStringsW
0x4211e4 GetEnvironmentStringsW
0x4211e8 SetHandleCount
0x4211ec GetStdHandle
0x4211f0 DeleteCriticalSection
0x4211f4 HeapCreate
0x4211f8 OutputDebugStringA
0x4211fc WriteConsoleW
0x421200 OutputDebugStringW
0x421204 LoadLibraryW
0x421208 RtlUnwind
0x42120c LCMapStringW
0x421210 MultiByteToWideChar
0x421214 GetStringTypeW
0x421218 HeapAlloc
0x42121c GetModuleFileNameA
0x421220 HeapReAlloc
0x421224 HeapSize
0x421228 HeapQueryInformation
0x42122c HeapFree
0x421230 CreateFileW
0x421234 CloseHandle
0x421238 FlushFileBuffers
USER32.dll
0x421240 GetComboBoxInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x421000 ExitProcess
0x421004 GetCommandLineW
0x421008 GetTempFileNameW
0x42100c GetFileSize
0x421010 WriteConsoleInputW
0x421014 SetFilePointer
0x421018 WritePrivateProfileStructA
0x42101c DebugActiveProcessStop
0x421020 GetNumberOfConsoleInputEvents
0x421024 FreeLibrary
0x421028 SystemTimeToFileTime
0x42102c SetConsoleActiveScreenBuffer
0x421030 WritePrivateProfileSectionA
0x421034 CreateJobObjectW
0x421038 GetProfileStringW
0x42103c GetProfileSectionA
0x421040 WaitForSingleObject
0x421044 SignalObjectAndWait
0x421048 SetComputerNameW
0x42104c FindFirstFileExW
0x421050 SetTapeParameters
0x421054 GetProcessPriorityBoost
0x421058 CreateNamedPipeW
0x42105c IsBadReadPtr
0x421060 EnumTimeFormatsW
0x421064 SetCommState
0x421068 GetDriveTypeA
0x42106c TlsSetValue
0x421070 FindResourceExA
0x421074 GlobalAlloc
0x421078 GetVolumeInformationA
0x42107c Sleep
0x421080 GetSystemWow64DirectoryW
0x421084 HeapDestroy
0x421088 GetFileAttributesA
0x42108c GlobalFlags
0x421090 SetConsoleMode
0x421094 Beep
0x421098 MulDiv
0x42109c VerifyVersionInfoA
0x4210a0 GetBinaryTypeA
0x4210a4 SetSystemPowerState
0x4210a8 LocalHandle
0x4210ac GetTimeZoneInformation
0x4210b0 GetACP
0x4210b4 lstrlenW
0x4210b8 RaiseException
0x4210bc DeactivateActCtx
0x4210c0 GetPrivateProfileIntW
0x4210c4 OpenMutexW
0x4210c8 GetLastError
0x4210cc IsDBCSLeadByteEx
0x4210d0 SetLastError
0x4210d4 ReadConsoleOutputCharacterA
0x4210d8 GetProcAddress
0x4210dc FindVolumeMountPointClose
0x4210e0 VirtualAlloc
0x4210e4 SearchPathA
0x4210e8 GetAtomNameA
0x4210ec LoadLibraryA
0x4210f0 OpenThread
0x4210f4 WriteConsoleA
0x4210f8 ProcessIdToSessionId
0x4210fc MoveFileA
0x421100 BuildCommDCBAndTimeoutsW
0x421104 IsSystemResumeAutomatic
0x421108 SetConsoleDisplayMode
0x42110c SetConsoleOutputCP
0x421110 GetCurrentConsoleFont
0x421114 SetCommMask
0x421118 GetPrivateProfileStructA
0x42111c GetTapeParameters
0x421120 WaitForMultipleObjects
0x421124 SetSystemTime
0x421128 GetPrivateProfileSectionNamesA
0x42112c GetCurrentDirectoryA
0x421130 GetConsoleCursorInfo
0x421134 ScrollConsoleScreenBufferA
0x421138 OpenSemaphoreW
0x42113c GetVersionExA
0x421140 AddConsoleAliasA
0x421144 GetSystemTime
0x421148 CopyFileExA
0x42114c AreFileApisANSI
0x421150 lstrcpyA
0x421154 WideCharToMultiByte
0x421158 EncodePointer
0x42115c DecodePointer
0x421160 HeapSetInformation
0x421164 GetStartupInfoW
0x421168 TerminateProcess
0x42116c GetCurrentProcess
0x421170 UnhandledExceptionFilter
0x421174 SetUnhandledExceptionFilter
0x421178 IsDebuggerPresent
0x42117c GetModuleFileNameW
0x421180 InterlockedIncrement
0x421184 InterlockedDecrement
0x421188 GetOEMCP
0x42118c GetCPInfo
0x421190 IsValidCodePage
0x421194 TlsAlloc
0x421198 TlsGetValue
0x42119c GetCurrentThreadId
0x4211a0 TlsFree
0x4211a4 GetModuleHandleW
0x4211a8 LeaveCriticalSection
0x4211ac EnterCriticalSection
0x4211b0 InitializeCriticalSectionAndSpinCount
0x4211b4 SetStdHandle
0x4211b8 GetFileType
0x4211bc WriteFile
0x4211c0 GetConsoleCP
0x4211c4 GetConsoleMode
0x4211c8 HeapValidate
0x4211cc IsProcessorFeaturePresent
0x4211d0 QueryPerformanceCounter
0x4211d4 GetTickCount
0x4211d8 GetCurrentProcessId
0x4211dc GetSystemTimeAsFileTime
0x4211e0 FreeEnvironmentStringsW
0x4211e4 GetEnvironmentStringsW
0x4211e8 SetHandleCount
0x4211ec GetStdHandle
0x4211f0 DeleteCriticalSection
0x4211f4 HeapCreate
0x4211f8 OutputDebugStringA
0x4211fc WriteConsoleW
0x421200 OutputDebugStringW
0x421204 LoadLibraryW
0x421208 RtlUnwind
0x42120c LCMapStringW
0x421210 MultiByteToWideChar
0x421214 GetStringTypeW
0x421218 HeapAlloc
0x42121c GetModuleFileNameA
0x421220 HeapReAlloc
0x421224 HeapSize
0x421228 HeapQueryInformation
0x42122c HeapFree
0x421230 CreateFileW
0x421234 CloseHandle
0x421238 FlushFileBuffers
USER32.dll
0x421240 GetComboBoxInfo
EAT(Export Address Table) is none