ScreenShot
| Created | 2021.05.25 09:35 | Machine | s1_win7_x6402 |
| Filename | app.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 26 detected (malicious, high confidence, Unsafe, Save, Attribute, HighConfidence, score, ivklid, A + Mal, GandCrypt, Lockbit, Static AI, Malicious PE, XPACK, Gen3, Glupteba, BScope, Wacatac, Obscure, CLASSIC, susgen, ZexaF, @xW@aaywnycO, confidence, 100%) | ||
| md5 | e6f2c7e2ebd7dd935bbdce6c38e50467 | ||
| sha256 | 198c007bba9ab6f106cb6d55568f4af5f1f1aa3f7c36b2f9c2196b2120fb1e09 | ||
| ssdeep | 98304:a5Yz2FzvCwAfC71Wamj0W68+i33c9kM5vjBv2YbYb8gvbzAi/C8U:oz0C7Fm4W6Li33c9kQF+YbY5vFc | ||
| imphash | 646dea3e06ebecb15c5e764c7a01072a | ||
| impfuzzy | 48:hTFxLc3miprj3TXKJX1iF5b9FMaxabhSu/K9+BcBRpSBD:hBxoDprrzoX1G5bvM5bhSu/Q+BcBRp4 | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 26 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Raccoon_Stealer_1_Zero | Raccoon Stealer | binaries (upload) |
| danger | Trojan_Win32_Glupteba_1_Zero | Trojan Win32 Glupteba | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421000 PulseEvent
0x421004 FillConsoleOutputCharacterA
0x421008 GetPrivateProfileSectionNamesW
0x42100c EnumResourceNamesW
0x421010 SetVolumeLabelA
0x421014 GetFileSize
0x421018 lstrlenA
0x42101c TlsGetValue
0x421020 CommConfigDialogA
0x421024 SetEndOfFile
0x421028 FindResourceExW
0x42102c FreeLibrary
0x421030 LoadResource
0x421034 ScrollConsoleScreenBufferW
0x421038 GlobalSize
0x42103c CreateJobObjectW
0x421040 GetProfileStringW
0x421044 WaitForSingleObject
0x421048 WriteConsoleInputA
0x42104c SignalObjectAndWait
0x421050 OpenSemaphoreA
0x421054 CallNamedPipeW
0x421058 GetTickCount
0x42105c GetConsoleAliasesLengthA
0x421060 EnumTimeFormatsW
0x421064 GetUserDefaultLangID
0x421068 SetProcessPriorityBoost
0x42106c GetDriveTypeA
0x421070 GlobalAlloc
0x421074 GetVolumeInformationA
0x421078 LoadLibraryW
0x42107c GetConsoleMode
0x421080 TerminateThread
0x421084 SetVolumeMountPointA
0x421088 GetVersionExW
0x42108c SetConsoleCursorPosition
0x421090 GetFileAttributesW
0x421094 SetTimeZoneInformation
0x421098 VerifyVersionInfoA
0x42109c SetSystemPowerState
0x4210a0 WritePrivateProfileSectionW
0x4210a4 IsDBCSLeadByte
0x4210a8 ReadFile
0x4210ac CompareStringW
0x4210b0 SetThreadPriority
0x4210b4 DeactivateActCtx
0x4210b8 ReleaseActCtx
0x4210bc GetStdHandle
0x4210c0 OpenMutexW
0x4210c4 FindFirstFileExA
0x4210c8 GetLastError
0x4210cc SetLastError
0x4210d0 ReadConsoleOutputCharacterA
0x4210d4 GetProcAddress
0x4210d8 VirtualAlloc
0x4210dc SetStdHandle
0x4210e0 SetComputerNameA
0x4210e4 GetPrivateProfileStringA
0x4210e8 WriteConsoleA
0x4210ec OpenWaitableTimerW
0x4210f0 LocalAlloc
0x4210f4 DeleteTimerQueue
0x4210f8 MoveFileA
0x4210fc IsSystemResumeAutomatic
0x421100 WriteProfileSectionW
0x421104 AddAtomA
0x421108 FindAtomA
0x42110c GetPrivateProfileStructA
0x421110 WaitForMultipleObjects
0x421114 WTSGetActiveConsoleSessionId
0x421118 GetThreadPriority
0x42111c DebugSetProcessKillOnExit
0x421120 GetModuleHandleA
0x421124 WaitForDebugEvent
0x421128 GetCurrentThreadId
0x42112c DuplicateHandle
0x421130 SetProcessShutdownParameters
0x421134 LocalSize
0x421138 AddConsoleAliasA
0x42113c DebugBreak
0x421140 FindActCtxSectionStringW
0x421144 GetProfileSectionW
0x421148 CloseHandle
0x42114c CreateFileW
0x421150 GetCommandLineA
0x421154 HeapSetInformation
0x421158 GetStartupInfoW
0x42115c EncodePointer
0x421160 DecodePointer
0x421164 IsProcessorFeaturePresent
0x421168 HeapValidate
0x42116c IsBadReadPtr
0x421170 SetUnhandledExceptionFilter
0x421174 QueryPerformanceCounter
0x421178 GetCurrentProcessId
0x42117c GetSystemTimeAsFileTime
0x421180 InterlockedIncrement
0x421184 InterlockedDecrement
0x421188 GetModuleHandleW
0x42118c ExitProcess
0x421190 GetModuleFileNameA
0x421194 FreeEnvironmentStringsW
0x421198 WideCharToMultiByte
0x42119c GetEnvironmentStringsW
0x4211a0 SetHandleCount
0x4211a4 InitializeCriticalSectionAndSpinCount
0x4211a8 GetFileType
0x4211ac DeleteCriticalSection
0x4211b0 TlsAlloc
0x4211b4 TlsSetValue
0x4211b8 TlsFree
0x4211bc HeapCreate
0x4211c0 GetModuleFileNameW
0x4211c4 WriteFile
0x4211c8 RaiseException
0x4211cc EnterCriticalSection
0x4211d0 LeaveCriticalSection
0x4211d4 HeapAlloc
0x4211d8 HeapReAlloc
0x4211dc HeapSize
0x4211e0 HeapQueryInformation
0x4211e4 TerminateProcess
0x4211e8 GetCurrentProcess
0x4211ec UnhandledExceptionFilter
0x4211f0 IsDebuggerPresent
0x4211f4 HeapFree
0x4211f8 GetACP
0x4211fc GetOEMCP
0x421200 GetCPInfo
0x421204 IsValidCodePage
0x421208 RtlUnwind
0x42120c OutputDebugStringA
0x421210 WriteConsoleW
0x421214 OutputDebugStringW
0x421218 LCMapStringW
0x42121c MultiByteToWideChar
0x421220 GetStringTypeW
0x421224 SetFilePointer
0x421228 GetConsoleCP
0x42122c FlushFileBuffers
USER32.dll
0x421234 GetMessageTime
0x421238 GetCursorInfo
EAT(Export Address Table) Library
0x41fc30 _go@4
0x41fc10 _hockey@4
0x41fc20 _regulmoto@4
KERNEL32.dll
0x421000 PulseEvent
0x421004 FillConsoleOutputCharacterA
0x421008 GetPrivateProfileSectionNamesW
0x42100c EnumResourceNamesW
0x421010 SetVolumeLabelA
0x421014 GetFileSize
0x421018 lstrlenA
0x42101c TlsGetValue
0x421020 CommConfigDialogA
0x421024 SetEndOfFile
0x421028 FindResourceExW
0x42102c FreeLibrary
0x421030 LoadResource
0x421034 ScrollConsoleScreenBufferW
0x421038 GlobalSize
0x42103c CreateJobObjectW
0x421040 GetProfileStringW
0x421044 WaitForSingleObject
0x421048 WriteConsoleInputA
0x42104c SignalObjectAndWait
0x421050 OpenSemaphoreA
0x421054 CallNamedPipeW
0x421058 GetTickCount
0x42105c GetConsoleAliasesLengthA
0x421060 EnumTimeFormatsW
0x421064 GetUserDefaultLangID
0x421068 SetProcessPriorityBoost
0x42106c GetDriveTypeA
0x421070 GlobalAlloc
0x421074 GetVolumeInformationA
0x421078 LoadLibraryW
0x42107c GetConsoleMode
0x421080 TerminateThread
0x421084 SetVolumeMountPointA
0x421088 GetVersionExW
0x42108c SetConsoleCursorPosition
0x421090 GetFileAttributesW
0x421094 SetTimeZoneInformation
0x421098 VerifyVersionInfoA
0x42109c SetSystemPowerState
0x4210a0 WritePrivateProfileSectionW
0x4210a4 IsDBCSLeadByte
0x4210a8 ReadFile
0x4210ac CompareStringW
0x4210b0 SetThreadPriority
0x4210b4 DeactivateActCtx
0x4210b8 ReleaseActCtx
0x4210bc GetStdHandle
0x4210c0 OpenMutexW
0x4210c4 FindFirstFileExA
0x4210c8 GetLastError
0x4210cc SetLastError
0x4210d0 ReadConsoleOutputCharacterA
0x4210d4 GetProcAddress
0x4210d8 VirtualAlloc
0x4210dc SetStdHandle
0x4210e0 SetComputerNameA
0x4210e4 GetPrivateProfileStringA
0x4210e8 WriteConsoleA
0x4210ec OpenWaitableTimerW
0x4210f0 LocalAlloc
0x4210f4 DeleteTimerQueue
0x4210f8 MoveFileA
0x4210fc IsSystemResumeAutomatic
0x421100 WriteProfileSectionW
0x421104 AddAtomA
0x421108 FindAtomA
0x42110c GetPrivateProfileStructA
0x421110 WaitForMultipleObjects
0x421114 WTSGetActiveConsoleSessionId
0x421118 GetThreadPriority
0x42111c DebugSetProcessKillOnExit
0x421120 GetModuleHandleA
0x421124 WaitForDebugEvent
0x421128 GetCurrentThreadId
0x42112c DuplicateHandle
0x421130 SetProcessShutdownParameters
0x421134 LocalSize
0x421138 AddConsoleAliasA
0x42113c DebugBreak
0x421140 FindActCtxSectionStringW
0x421144 GetProfileSectionW
0x421148 CloseHandle
0x42114c CreateFileW
0x421150 GetCommandLineA
0x421154 HeapSetInformation
0x421158 GetStartupInfoW
0x42115c EncodePointer
0x421160 DecodePointer
0x421164 IsProcessorFeaturePresent
0x421168 HeapValidate
0x42116c IsBadReadPtr
0x421170 SetUnhandledExceptionFilter
0x421174 QueryPerformanceCounter
0x421178 GetCurrentProcessId
0x42117c GetSystemTimeAsFileTime
0x421180 InterlockedIncrement
0x421184 InterlockedDecrement
0x421188 GetModuleHandleW
0x42118c ExitProcess
0x421190 GetModuleFileNameA
0x421194 FreeEnvironmentStringsW
0x421198 WideCharToMultiByte
0x42119c GetEnvironmentStringsW
0x4211a0 SetHandleCount
0x4211a4 InitializeCriticalSectionAndSpinCount
0x4211a8 GetFileType
0x4211ac DeleteCriticalSection
0x4211b0 TlsAlloc
0x4211b4 TlsSetValue
0x4211b8 TlsFree
0x4211bc HeapCreate
0x4211c0 GetModuleFileNameW
0x4211c4 WriteFile
0x4211c8 RaiseException
0x4211cc EnterCriticalSection
0x4211d0 LeaveCriticalSection
0x4211d4 HeapAlloc
0x4211d8 HeapReAlloc
0x4211dc HeapSize
0x4211e0 HeapQueryInformation
0x4211e4 TerminateProcess
0x4211e8 GetCurrentProcess
0x4211ec UnhandledExceptionFilter
0x4211f0 IsDebuggerPresent
0x4211f4 HeapFree
0x4211f8 GetACP
0x4211fc GetOEMCP
0x421200 GetCPInfo
0x421204 IsValidCodePage
0x421208 RtlUnwind
0x42120c OutputDebugStringA
0x421210 WriteConsoleW
0x421214 OutputDebugStringW
0x421218 LCMapStringW
0x42121c MultiByteToWideChar
0x421220 GetStringTypeW
0x421224 SetFilePointer
0x421228 GetConsoleCP
0x42122c FlushFileBuffers
USER32.dll
0x421234 GetMessageTime
0x421238 GetCursorInfo
EAT(Export Address Table) Library
0x41fc30 _go@4
0x41fc10 _hockey@4
0x41fc20 _regulmoto@4