ScreenShot
| Created | 2021.05.28 11:11 | Machine | s1_win7_x6401 |
| Filename | file2.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (AIDetect, malware1, malicious, high confidence, GenericKD, Unsafe, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, HLBM, FileRepMalware, Ransomware, Gandcrypt, Stop, R + Mal, Siggen2, Emotet, Static AI, Malicious PE, Score, kcloud, Azorult, SmokeLoader, R422787, ZexaF, IqW@amDn, BScope, R002H07EQ21, CLOUD, susgen, Genetic) | ||
| md5 | 8e459aae5e232ee1e29e70645cd0fa83 | ||
| sha256 | 5fd1dd59bf5bab111013850c2a213a72e70e0d8db132a8ae8cad3779b5ee7261 | ||
| ssdeep | 12288:NhjFvirdUAGA4pssxSd4nrEk0umulMqIEtbOF6H/d6rgCuE:rFvcfpCS+nrR0uFiytb2rgE | ||
| imphash | b0ea5360984cd75edf9d1528f542b372 | ||
| impfuzzy | 48:9wzpGoWcUz2aJX1cdkJAA69WPEO76Eauefc9tfSXvG54+Y:qd1KpX1so68E0yuefc9tfS/G5g | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421000 GetComputerNameA
0x421004 EnumResourceNamesW
0x421008 SetVolumeLabelA
0x42100c GetThreadIOPendingFlag
0x421010 SetPriorityClass
0x421014 WriteConsoleInputW
0x421018 SetFilePointer
0x42101c lstrlenA
0x421020 GetConsoleAliasesLengthW
0x421024 TlsGetValue
0x421028 CommConfigDialogA
0x42102c CallNamedPipeA
0x421030 LoadResource
0x421034 WritePrivateProfileSectionA
0x421038 GlobalSize
0x42103c SetHandleInformation
0x421040 WaitForSingleObject
0x421044 SignalObjectAndWait
0x421048 SetComputerNameW
0x42104c AddConsoleAliasW
0x421050 SetVolumeMountPointW
0x421054 GetProcessPriorityBoost
0x421058 GetTickCount
0x42105c GetPrivateProfileStringW
0x421060 EnumTimeFormatsA
0x421064 FindResourceExA
0x421068 GlobalAlloc
0x42106c GetVolumeInformationA
0x421070 GetConsoleMode
0x421074 TerminateThread
0x421078 ReadConsoleInputA
0x42107c GetPrivateProfileStructW
0x421080 SizeofResource
0x421084 SetVolumeMountPointA
0x421088 DnsHostnameToComputerNameW
0x42108c SetConsoleMode
0x421090 SetConsoleCursorPosition
0x421094 GetFileAttributesW
0x421098 SetTimeZoneInformation
0x42109c LocalReAlloc
0x4210a0 WriteConsoleW
0x4210a4 IsDBCSLeadByte
0x4210a8 ReadFile
0x4210ac CompareStringW
0x4210b0 SetThreadPriority
0x4210b4 DeactivateActCtx
0x4210b8 CreateJobObjectA
0x4210bc VerifyVersionInfoW
0x4210c0 InterlockedExchange
0x4210c4 GetFileSizeEx
0x4210c8 GetStdHandle
0x4210cc FillConsoleOutputCharacterW
0x4210d0 FindFirstFileExA
0x4210d4 GetLastError
0x4210d8 SetLastError
0x4210dc ReadConsoleOutputCharacterA
0x4210e0 GetProcAddress
0x4210e4 VirtualAlloc
0x4210e8 WriteProfileSectionA
0x4210ec SetStdHandle
0x4210f0 SetFileApisToOEM
0x4210f4 LoadLibraryA
0x4210f8 OpenMutexA
0x4210fc ProcessIdToSessionId
0x421100 MoveFileA
0x421104 AddAtomW
0x421108 SetCurrentDirectoryW
0x42110c SetFileApisToANSI
0x421110 WriteProfileSectionW
0x421114 GetPrivateProfileSectionNamesA
0x421118 DebugBreakProcess
0x42111c GetStringTypeW
0x421120 BuildCommDCBA
0x421124 WaitForDebugEvent
0x421128 ScrollConsoleScreenBufferA
0x42112c GetCurrentThreadId
0x421130 SetProcessShutdownParameters
0x421134 OpenSemaphoreW
0x421138 GetVersionExA
0x42113c LocalSize
0x421140 FindAtomW
0x421144 DebugBreak
0x421148 FindActCtxSectionStringW
0x42114c CloseHandle
0x421150 CreateFileW
0x421154 DeleteFileA
0x421158 InterlockedIncrement
0x42115c InterlockedDecrement
0x421160 DecodePointer
0x421164 GetModuleHandleW
0x421168 ExitProcess
0x42116c GetCommandLineA
0x421170 HeapSetInformation
0x421174 GetStartupInfoW
0x421178 EncodePointer
0x42117c IsProcessorFeaturePresent
0x421180 HeapValidate
0x421184 IsBadReadPtr
0x421188 GetModuleFileNameW
0x42118c WriteFile
0x421190 GetACP
0x421194 GetOEMCP
0x421198 GetCPInfo
0x42119c IsValidCodePage
0x4211a0 TlsAlloc
0x4211a4 TlsSetValue
0x4211a8 TlsFree
0x4211ac InitializeCriticalSectionAndSpinCount
0x4211b0 DeleteCriticalSection
0x4211b4 EnterCriticalSection
0x4211b8 LeaveCriticalSection
0x4211bc LoadLibraryW
0x4211c0 TerminateProcess
0x4211c4 GetCurrentProcess
0x4211c8 UnhandledExceptionFilter
0x4211cc SetUnhandledExceptionFilter
0x4211d0 IsDebuggerPresent
0x4211d4 QueryPerformanceCounter
0x4211d8 GetCurrentProcessId
0x4211dc GetSystemTimeAsFileTime
0x4211e0 GetModuleFileNameA
0x4211e4 FreeEnvironmentStringsW
0x4211e8 WideCharToMultiByte
0x4211ec GetEnvironmentStringsW
0x4211f0 SetHandleCount
0x4211f4 GetFileType
0x4211f8 HeapCreate
0x4211fc RaiseException
0x421200 HeapAlloc
0x421204 HeapReAlloc
0x421208 HeapSize
0x42120c HeapQueryInformation
0x421210 HeapFree
0x421214 RtlUnwind
0x421218 LCMapStringW
0x42121c MultiByteToWideChar
0x421220 OutputDebugStringA
0x421224 OutputDebugStringW
0x421228 GetConsoleCP
0x42122c FlushFileBuffers
USER32.dll
0x421234 GetComboBoxInfo
0x421238 GetMenuInfo
EAT(Export Address Table) Library
0x41fb60 _get@12
KERNEL32.dll
0x421000 GetComputerNameA
0x421004 EnumResourceNamesW
0x421008 SetVolumeLabelA
0x42100c GetThreadIOPendingFlag
0x421010 SetPriorityClass
0x421014 WriteConsoleInputW
0x421018 SetFilePointer
0x42101c lstrlenA
0x421020 GetConsoleAliasesLengthW
0x421024 TlsGetValue
0x421028 CommConfigDialogA
0x42102c CallNamedPipeA
0x421030 LoadResource
0x421034 WritePrivateProfileSectionA
0x421038 GlobalSize
0x42103c SetHandleInformation
0x421040 WaitForSingleObject
0x421044 SignalObjectAndWait
0x421048 SetComputerNameW
0x42104c AddConsoleAliasW
0x421050 SetVolumeMountPointW
0x421054 GetProcessPriorityBoost
0x421058 GetTickCount
0x42105c GetPrivateProfileStringW
0x421060 EnumTimeFormatsA
0x421064 FindResourceExA
0x421068 GlobalAlloc
0x42106c GetVolumeInformationA
0x421070 GetConsoleMode
0x421074 TerminateThread
0x421078 ReadConsoleInputA
0x42107c GetPrivateProfileStructW
0x421080 SizeofResource
0x421084 SetVolumeMountPointA
0x421088 DnsHostnameToComputerNameW
0x42108c SetConsoleMode
0x421090 SetConsoleCursorPosition
0x421094 GetFileAttributesW
0x421098 SetTimeZoneInformation
0x42109c LocalReAlloc
0x4210a0 WriteConsoleW
0x4210a4 IsDBCSLeadByte
0x4210a8 ReadFile
0x4210ac CompareStringW
0x4210b0 SetThreadPriority
0x4210b4 DeactivateActCtx
0x4210b8 CreateJobObjectA
0x4210bc VerifyVersionInfoW
0x4210c0 InterlockedExchange
0x4210c4 GetFileSizeEx
0x4210c8 GetStdHandle
0x4210cc FillConsoleOutputCharacterW
0x4210d0 FindFirstFileExA
0x4210d4 GetLastError
0x4210d8 SetLastError
0x4210dc ReadConsoleOutputCharacterA
0x4210e0 GetProcAddress
0x4210e4 VirtualAlloc
0x4210e8 WriteProfileSectionA
0x4210ec SetStdHandle
0x4210f0 SetFileApisToOEM
0x4210f4 LoadLibraryA
0x4210f8 OpenMutexA
0x4210fc ProcessIdToSessionId
0x421100 MoveFileA
0x421104 AddAtomW
0x421108 SetCurrentDirectoryW
0x42110c SetFileApisToANSI
0x421110 WriteProfileSectionW
0x421114 GetPrivateProfileSectionNamesA
0x421118 DebugBreakProcess
0x42111c GetStringTypeW
0x421120 BuildCommDCBA
0x421124 WaitForDebugEvent
0x421128 ScrollConsoleScreenBufferA
0x42112c GetCurrentThreadId
0x421130 SetProcessShutdownParameters
0x421134 OpenSemaphoreW
0x421138 GetVersionExA
0x42113c LocalSize
0x421140 FindAtomW
0x421144 DebugBreak
0x421148 FindActCtxSectionStringW
0x42114c CloseHandle
0x421150 CreateFileW
0x421154 DeleteFileA
0x421158 InterlockedIncrement
0x42115c InterlockedDecrement
0x421160 DecodePointer
0x421164 GetModuleHandleW
0x421168 ExitProcess
0x42116c GetCommandLineA
0x421170 HeapSetInformation
0x421174 GetStartupInfoW
0x421178 EncodePointer
0x42117c IsProcessorFeaturePresent
0x421180 HeapValidate
0x421184 IsBadReadPtr
0x421188 GetModuleFileNameW
0x42118c WriteFile
0x421190 GetACP
0x421194 GetOEMCP
0x421198 GetCPInfo
0x42119c IsValidCodePage
0x4211a0 TlsAlloc
0x4211a4 TlsSetValue
0x4211a8 TlsFree
0x4211ac InitializeCriticalSectionAndSpinCount
0x4211b0 DeleteCriticalSection
0x4211b4 EnterCriticalSection
0x4211b8 LeaveCriticalSection
0x4211bc LoadLibraryW
0x4211c0 TerminateProcess
0x4211c4 GetCurrentProcess
0x4211c8 UnhandledExceptionFilter
0x4211cc SetUnhandledExceptionFilter
0x4211d0 IsDebuggerPresent
0x4211d4 QueryPerformanceCounter
0x4211d8 GetCurrentProcessId
0x4211dc GetSystemTimeAsFileTime
0x4211e0 GetModuleFileNameA
0x4211e4 FreeEnvironmentStringsW
0x4211e8 WideCharToMultiByte
0x4211ec GetEnvironmentStringsW
0x4211f0 SetHandleCount
0x4211f4 GetFileType
0x4211f8 HeapCreate
0x4211fc RaiseException
0x421200 HeapAlloc
0x421204 HeapReAlloc
0x421208 HeapSize
0x42120c HeapQueryInformation
0x421210 HeapFree
0x421214 RtlUnwind
0x421218 LCMapStringW
0x42121c MultiByteToWideChar
0x421220 OutputDebugStringA
0x421224 OutputDebugStringW
0x421228 GetConsoleCP
0x42122c FlushFileBuffers
USER32.dll
0x421234 GetComboBoxInfo
0x421238 GetMenuInfo
EAT(Export Address Table) Library
0x41fb60 _get@12