ScreenShot
| Created | 2021.06.03 11:10 | Machine | s1_win7_x6401 |
| Filename | 3IR10ztB.php | ||
| Type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 19 detected (malicious, high confidence, Unsafe, confidence, ZedlaF, ku8@a4SuFZli, Attribute, HighConfidence, Kryptik, HLEA, TrojanX, Sdum, ccmw, Dridex, Wacatac, score, GenericRXOS, Generic@ML, RDML, CyXGXt7N6W7SYpzVdZ8V6A, Static AI, Suspicious PE) | ||
| md5 | a9a3fd9fd53605ef2bebef23dc595750 | ||
| sha256 | 13caa7d8c9ae601d630407101e6de2d1fac21fe68e64ba572bc5a983c9d0b2f9 | ||
| ssdeep | 3072:7AqZ5wNFg3ok/8G4gtz31zVqfD//eoc5WLjopfsW8BhI283o4qQEf03lN2szzjLA:7ATNC4k/p4gtFVSDCwLjoxsW0hf83pqb | ||
| imphash | 9a40879e2292731aa06c02cb463a4dec | ||
| impfuzzy | 6:6XWvQaMLkQML1vXBApJWXuDEBm1XYBVBqKDNKXKWvWx/xKXxHXyUAFhAwnGvX6n:LXBMPom1XY3B7DNKXLvE/xMZc/GvX6 | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 19 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
ole32.dll
0x1000704c OleSave
SETUPAPI.dll
0x10007028 SetupDiDrawMiniIcon
0x1000702c SetupDiClassGuidsFromNameW
OPENGL32.dll
0x10007020 glNormal3f
ADVAPI32.dll
0x10007000 RegOverridePredefKey
USER32.dll
0x10007034 OpenWindowStationA
0x10007038 TranslateMessage
WS2_32.dll
0x10007040 WSASetLastError
0x10007044 accept
KERNEL32.dll
0x10007008 DefineDosDeviceA
0x1000700c CloseHandle
0x10007010 WaitNamedPipeW
0x10007014 GetModuleFileNameA
0x10007018 OutputDebugStringA
EAT(Export Address Table) is none
ole32.dll
0x1000704c OleSave
SETUPAPI.dll
0x10007028 SetupDiDrawMiniIcon
0x1000702c SetupDiClassGuidsFromNameW
OPENGL32.dll
0x10007020 glNormal3f
ADVAPI32.dll
0x10007000 RegOverridePredefKey
USER32.dll
0x10007034 OpenWindowStationA
0x10007038 TranslateMessage
WS2_32.dll
0x10007040 WSASetLastError
0x10007044 accept
KERNEL32.dll
0x10007008 DefineDosDeviceA
0x1000700c CloseHandle
0x10007010 WaitNamedPipeW
0x10007014 GetModuleFileNameA
0x10007018 OutputDebugStringA
EAT(Export Address Table) is none