ScreenShot
| Created | 2021.06.04 11:43 | Machine | s1_win7_x6401 |
| Filename | lv.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 34 detected (AIDetect, malware1, malicious, high confidence, Artemis, Unsafe, Save, Attribute, HighConfidence, Kryptik, HLEJ, score, PWSX, Ransomware, susgen, A + Troj, Kovter, Glupteba, 14FJAB1, Obscure, CLASSIC, Static AI, Malicious PE, ZexaF, wqW@aqA80mdc, confidence, 100%) | ||
| md5 | 227da511d6e03d33bb9e1cbf18f957c8 | ||
| sha256 | 7e41bf3313b1f633bebccfcbc0440b35d84b154eb4d1462385aaa82e0093de73 | ||
| ssdeep | 6144:zFlTIYr7JWTVUh72MR0XxhkvuOU8wGNIR2F4yMiLv7GYBhat:zFBIM4TVUh7cxhOp+eIQdLDm | ||
| imphash | 54bdb0f44e9d5628a234fe66c31a1617 | ||
| impfuzzy | 48:yXypX8Omg7JX1VX6p8dRGbPu8+fcXOVWxtjtavV809RBo:yXuf/X1VX6yRQ+fcXqWxtjUvV8094 | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 34 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x43a008 FillConsoleOutputCharacterA
0x43a00c GetPrivateProfileSectionNamesW
0x43a010 GlobalFix
0x43a014 lstrlenA
0x43a018 CopyFileExW
0x43a01c GetModuleHandleExA
0x43a020 SetHandleInformation
0x43a024 SetComputerNameW
0x43a028 SetVolumeMountPointW
0x43a02c GetComputerNameW
0x43a030 OpenSemaphoreA
0x43a034 CallNamedPipeW
0x43a038 FreeEnvironmentStringsA
0x43a03c GetCurrentThread
0x43a040 GetConsoleAliasesLengthA
0x43a044 GetWindowsDirectoryA
0x43a048 EnumTimeFormatsA
0x43a04c WriteFile
0x43a050 SetCommState
0x43a054 TlsSetValue
0x43a058 GetPriorityClass
0x43a05c GetVolumeInformationA
0x43a060 LoadLibraryW
0x43a064 ReadConsoleInputA
0x43a068 CopyFileW
0x43a06c GetVersionExW
0x43a070 DnsHostnameToComputerNameW
0x43a074 SetConsoleMode
0x43a078 VerifyVersionInfoA
0x43a07c WriteConsoleW
0x43a080 WritePrivateProfileSectionW
0x43a084 CreateFileW
0x43a088 PulseEvent
0x43a08c SetThreadPriority
0x43a090 CreateDirectoryA
0x43a094 SetThreadLocale
0x43a098 GetStdHandle
0x43a09c FindFirstFileA
0x43a0a0 GetLastError
0x43a0a4 GetCurrentDirectoryW
0x43a0a8 ReadConsoleOutputCharacterA
0x43a0ac GetProcAddress
0x43a0b0 VirtualAlloc
0x43a0b4 LoadLibraryA
0x43a0b8 OpenMutexA
0x43a0bc WriteConsoleA
0x43a0c0 InterlockedExchangeAdd
0x43a0c4 OpenWaitableTimerW
0x43a0c8 LocalAlloc
0x43a0cc GetFileType
0x43a0d0 AddAtomW
0x43a0d4 WriteProfileSectionW
0x43a0d8 SetConsoleWindowInfo
0x43a0dc FindAtomA
0x43a0e0 SetEnvironmentVariableA
0x43a0e4 WaitCommEvent
0x43a0e8 ContinueDebugEvent
0x43a0ec OpenFileMappingW
0x43a0f0 BuildCommDCBA
0x43a0f4 SetProcessShutdownParameters
0x43a0f8 GetVersionExA
0x43a0fc LocalSize
0x43a100 CompareStringW
0x43a104 GetCommandLineW
0x43a108 InterlockedIncrement
0x43a10c InterlockedDecrement
0x43a110 InitializeCriticalSection
0x43a114 DeleteCriticalSection
0x43a118 EnterCriticalSection
0x43a11c LeaveCriticalSection
0x43a120 DeleteFileA
0x43a124 HeapSetInformation
0x43a128 GetStartupInfoW
0x43a12c GetModuleFileNameW
0x43a130 RaiseException
0x43a134 EncodePointer
0x43a138 DecodePointer
0x43a13c IsProcessorFeaturePresent
0x43a140 GetModuleHandleW
0x43a144 ExitProcess
0x43a148 TerminateProcess
0x43a14c GetCurrentProcess
0x43a150 UnhandledExceptionFilter
0x43a154 SetUnhandledExceptionFilter
0x43a158 IsDebuggerPresent
0x43a15c InitializeCriticalSectionAndSpinCount
0x43a160 SetStdHandle
0x43a164 WideCharToMultiByte
0x43a168 GetConsoleCP
0x43a16c GetConsoleMode
0x43a170 HeapValidate
0x43a174 IsBadReadPtr
0x43a178 QueryPerformanceCounter
0x43a17c GetTickCount
0x43a180 GetCurrentThreadId
0x43a184 GetCurrentProcessId
0x43a188 GetSystemTimeAsFileTime
0x43a18c FreeEnvironmentStringsW
0x43a190 GetEnvironmentStringsW
0x43a194 SetHandleCount
0x43a198 TlsAlloc
0x43a19c TlsGetValue
0x43a1a0 TlsFree
0x43a1a4 SetLastError
0x43a1a8 HeapCreate
0x43a1ac OutputDebugStringA
0x43a1b0 OutputDebugStringW
0x43a1b4 GetACP
0x43a1b8 GetOEMCP
0x43a1bc GetCPInfo
0x43a1c0 IsValidCodePage
0x43a1c4 MultiByteToWideChar
0x43a1c8 SetFilePointer
0x43a1cc RtlUnwind
0x43a1d0 HeapAlloc
0x43a1d4 GetModuleFileNameA
0x43a1d8 HeapReAlloc
0x43a1dc HeapSize
0x43a1e0 HeapQueryInformation
0x43a1e4 HeapFree
0x43a1e8 LCMapStringW
0x43a1ec GetStringTypeW
0x43a1f0 CloseHandle
0x43a1f4 FlushFileBuffers
USER32.dll
0x43a1fc GetMessageTime
0x43a200 GetMenuBarInfo
ADVAPI32.dll
0x43a000 ImpersonateSelf
EAT(Export Address Table) is none
KERNEL32.dll
0x43a008 FillConsoleOutputCharacterA
0x43a00c GetPrivateProfileSectionNamesW
0x43a010 GlobalFix
0x43a014 lstrlenA
0x43a018 CopyFileExW
0x43a01c GetModuleHandleExA
0x43a020 SetHandleInformation
0x43a024 SetComputerNameW
0x43a028 SetVolumeMountPointW
0x43a02c GetComputerNameW
0x43a030 OpenSemaphoreA
0x43a034 CallNamedPipeW
0x43a038 FreeEnvironmentStringsA
0x43a03c GetCurrentThread
0x43a040 GetConsoleAliasesLengthA
0x43a044 GetWindowsDirectoryA
0x43a048 EnumTimeFormatsA
0x43a04c WriteFile
0x43a050 SetCommState
0x43a054 TlsSetValue
0x43a058 GetPriorityClass
0x43a05c GetVolumeInformationA
0x43a060 LoadLibraryW
0x43a064 ReadConsoleInputA
0x43a068 CopyFileW
0x43a06c GetVersionExW
0x43a070 DnsHostnameToComputerNameW
0x43a074 SetConsoleMode
0x43a078 VerifyVersionInfoA
0x43a07c WriteConsoleW
0x43a080 WritePrivateProfileSectionW
0x43a084 CreateFileW
0x43a088 PulseEvent
0x43a08c SetThreadPriority
0x43a090 CreateDirectoryA
0x43a094 SetThreadLocale
0x43a098 GetStdHandle
0x43a09c FindFirstFileA
0x43a0a0 GetLastError
0x43a0a4 GetCurrentDirectoryW
0x43a0a8 ReadConsoleOutputCharacterA
0x43a0ac GetProcAddress
0x43a0b0 VirtualAlloc
0x43a0b4 LoadLibraryA
0x43a0b8 OpenMutexA
0x43a0bc WriteConsoleA
0x43a0c0 InterlockedExchangeAdd
0x43a0c4 OpenWaitableTimerW
0x43a0c8 LocalAlloc
0x43a0cc GetFileType
0x43a0d0 AddAtomW
0x43a0d4 WriteProfileSectionW
0x43a0d8 SetConsoleWindowInfo
0x43a0dc FindAtomA
0x43a0e0 SetEnvironmentVariableA
0x43a0e4 WaitCommEvent
0x43a0e8 ContinueDebugEvent
0x43a0ec OpenFileMappingW
0x43a0f0 BuildCommDCBA
0x43a0f4 SetProcessShutdownParameters
0x43a0f8 GetVersionExA
0x43a0fc LocalSize
0x43a100 CompareStringW
0x43a104 GetCommandLineW
0x43a108 InterlockedIncrement
0x43a10c InterlockedDecrement
0x43a110 InitializeCriticalSection
0x43a114 DeleteCriticalSection
0x43a118 EnterCriticalSection
0x43a11c LeaveCriticalSection
0x43a120 DeleteFileA
0x43a124 HeapSetInformation
0x43a128 GetStartupInfoW
0x43a12c GetModuleFileNameW
0x43a130 RaiseException
0x43a134 EncodePointer
0x43a138 DecodePointer
0x43a13c IsProcessorFeaturePresent
0x43a140 GetModuleHandleW
0x43a144 ExitProcess
0x43a148 TerminateProcess
0x43a14c GetCurrentProcess
0x43a150 UnhandledExceptionFilter
0x43a154 SetUnhandledExceptionFilter
0x43a158 IsDebuggerPresent
0x43a15c InitializeCriticalSectionAndSpinCount
0x43a160 SetStdHandle
0x43a164 WideCharToMultiByte
0x43a168 GetConsoleCP
0x43a16c GetConsoleMode
0x43a170 HeapValidate
0x43a174 IsBadReadPtr
0x43a178 QueryPerformanceCounter
0x43a17c GetTickCount
0x43a180 GetCurrentThreadId
0x43a184 GetCurrentProcessId
0x43a188 GetSystemTimeAsFileTime
0x43a18c FreeEnvironmentStringsW
0x43a190 GetEnvironmentStringsW
0x43a194 SetHandleCount
0x43a198 TlsAlloc
0x43a19c TlsGetValue
0x43a1a0 TlsFree
0x43a1a4 SetLastError
0x43a1a8 HeapCreate
0x43a1ac OutputDebugStringA
0x43a1b0 OutputDebugStringW
0x43a1b4 GetACP
0x43a1b8 GetOEMCP
0x43a1bc GetCPInfo
0x43a1c0 IsValidCodePage
0x43a1c4 MultiByteToWideChar
0x43a1c8 SetFilePointer
0x43a1cc RtlUnwind
0x43a1d0 HeapAlloc
0x43a1d4 GetModuleFileNameA
0x43a1d8 HeapReAlloc
0x43a1dc HeapSize
0x43a1e0 HeapQueryInformation
0x43a1e4 HeapFree
0x43a1e8 LCMapStringW
0x43a1ec GetStringTypeW
0x43a1f0 CloseHandle
0x43a1f4 FlushFileBuffers
USER32.dll
0x43a1fc GetMessageTime
0x43a200 GetMenuBarInfo
ADVAPI32.dll
0x43a000 ImpersonateSelf
EAT(Export Address Table) is none