ScreenShot
| Created | 2021.06.24 20:18 | Machine | s1_win7_x6402 |
| Filename | shell.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 52 detected (FamVT, RorenNHc, malicious, high confidence, CryptZ, Swrort, Unsafe, Shell, Save, ZexaF, eq1@aG9ltBki, Eldorado, Rozena, SwPatch, ccnc, Elzob, A@4jwdqr, SMAL01, A + ATK, EncPk, Score, Gen2, ai score=82, Meterpreter, R1283, ET#100%, RDMK, cmRtazqkIN7MzmWs, cswq3VXl6Wr, Rosena, Static AI, Malicious PE, susgen, MalwThreat, df3bIV, confidence, 100%) | ||
| md5 | 708c8a452d02d46ed6a1c16486a7a206 | ||
| sha256 | 324608df5cf59ab5c698f0116938e4073a8fd5ea406eadbc43c890fa160bd601 | ||
| ssdeep | 1536:ILzFbDy9rarrxSuEQ9DaYy1Eg71MDMb+KR0Nc8QsJq39:Y1yFarrEuCYl9De0Nc8QsC9 | ||
| imphash | 481f47bbb2c9c21e108d65f52b04c448 | ||
| impfuzzy | 48:K+x02G0oErgsXit/qOJLawRr+pe4yVj9hYykN6tqW:K+RGpErJXw/qmRr+pYjDkN6tqW | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 52 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
MSVCRT.dll
0x40c0c8 _iob
0x40c0cc _except_handler3
0x40c0d0 __set_app_type
0x40c0d4 __p__fmode
0x40c0d8 __p__commode
0x40c0dc _adjust_fdiv
0x40c0e0 __setusermatherr
0x40c0e4 _initterm
0x40c0e8 __getmainargs
0x40c0ec __p___initenv
0x40c0f0 _XcptFilter
0x40c0f4 _exit
0x40c0f8 _onexit
0x40c0fc __dllonexit
0x40c100 strrchr
0x40c104 wcsncmp
0x40c108 _close
0x40c10c wcslen
0x40c110 wcscpy
0x40c114 strerror
0x40c118 modf
0x40c11c strspn
0x40c120 realloc
0x40c124 __p__environ
0x40c128 __p__wenviron
0x40c12c _errno
0x40c130 free
0x40c134 strncmp
0x40c138 strstr
0x40c13c strncpy
0x40c140 _ftol
0x40c144 qsort
0x40c148 fopen
0x40c14c perror
0x40c150 fclose
0x40c154 fflush
0x40c158 calloc
0x40c15c malloc
0x40c160 signal
0x40c164 printf
0x40c168 _isctype
0x40c16c atoi
0x40c170 exit
0x40c174 __mb_cur_max
0x40c178 _pctype
0x40c17c strchr
0x40c180 fprintf
0x40c184 _controlfp
0x40c188 _strdup
0x40c18c _strnicmp
KERNEL32.dll
0x40c00c PeekNamedPipe
0x40c010 ReadFile
0x40c014 WriteFile
0x40c018 LoadLibraryA
0x40c01c GetProcAddress
0x40c020 GetVersionExA
0x40c024 GetExitCodeProcess
0x40c028 TerminateProcess
0x40c02c LeaveCriticalSection
0x40c030 SetEvent
0x40c034 ReleaseMutex
0x40c038 EnterCriticalSection
0x40c03c DeleteCriticalSection
0x40c040 InitializeCriticalSection
0x40c044 CreateMutexA
0x40c048 GetFileType
0x40c04c SetLastError
0x40c050 FreeEnvironmentStringsW
0x40c054 GetEnvironmentStringsW
0x40c058 GlobalFree
0x40c05c GetCommandLineW
0x40c060 TlsAlloc
0x40c064 TlsFree
0x40c068 DuplicateHandle
0x40c06c GetCurrentProcess
0x40c070 SetHandleInformation
0x40c074 CloseHandle
0x40c078 GetSystemTimeAsFileTime
0x40c07c FileTimeToSystemTime
0x40c080 GetTimeZoneInformation
0x40c084 FileTimeToLocalFileTime
0x40c088 SystemTimeToFileTime
0x40c08c SystemTimeToTzSpecificLocalTime
0x40c090 Sleep
0x40c094 FormatMessageA
0x40c098 GetLastError
0x40c09c WaitForSingleObject
0x40c0a0 CreateEventA
0x40c0a4 SetStdHandle
0x40c0a8 SetFilePointer
0x40c0ac CreateFileA
0x40c0b0 CreateFileW
0x40c0b4 GetOverlappedResult
0x40c0b8 DeviceIoControl
0x40c0bc GetFileInformationByHandle
0x40c0c0 LocalFree
ADVAPI32.dll
0x40c000 FreeSid
0x40c004 AllocateAndInitializeSid
WSOCK32.dll
0x40c1a0 getsockopt
0x40c1a4 connect
0x40c1a8 htons
0x40c1ac gethostbyname
0x40c1b0 ntohl
0x40c1b4 inet_ntoa
0x40c1b8 setsockopt
0x40c1bc socket
0x40c1c0 closesocket
0x40c1c4 select
0x40c1c8 ioctlsocket
0x40c1cc __WSAFDIsSet
0x40c1d0 WSAStartup
0x40c1d4 WSACleanup
0x40c1d8 WSAGetLastError
WS2_32.dll
0x40c194 WSARecv
0x40c198 WSASend
EAT(Export Address Table) is none
MSVCRT.dll
0x40c0c8 _iob
0x40c0cc _except_handler3
0x40c0d0 __set_app_type
0x40c0d4 __p__fmode
0x40c0d8 __p__commode
0x40c0dc _adjust_fdiv
0x40c0e0 __setusermatherr
0x40c0e4 _initterm
0x40c0e8 __getmainargs
0x40c0ec __p___initenv
0x40c0f0 _XcptFilter
0x40c0f4 _exit
0x40c0f8 _onexit
0x40c0fc __dllonexit
0x40c100 strrchr
0x40c104 wcsncmp
0x40c108 _close
0x40c10c wcslen
0x40c110 wcscpy
0x40c114 strerror
0x40c118 modf
0x40c11c strspn
0x40c120 realloc
0x40c124 __p__environ
0x40c128 __p__wenviron
0x40c12c _errno
0x40c130 free
0x40c134 strncmp
0x40c138 strstr
0x40c13c strncpy
0x40c140 _ftol
0x40c144 qsort
0x40c148 fopen
0x40c14c perror
0x40c150 fclose
0x40c154 fflush
0x40c158 calloc
0x40c15c malloc
0x40c160 signal
0x40c164 printf
0x40c168 _isctype
0x40c16c atoi
0x40c170 exit
0x40c174 __mb_cur_max
0x40c178 _pctype
0x40c17c strchr
0x40c180 fprintf
0x40c184 _controlfp
0x40c188 _strdup
0x40c18c _strnicmp
KERNEL32.dll
0x40c00c PeekNamedPipe
0x40c010 ReadFile
0x40c014 WriteFile
0x40c018 LoadLibraryA
0x40c01c GetProcAddress
0x40c020 GetVersionExA
0x40c024 GetExitCodeProcess
0x40c028 TerminateProcess
0x40c02c LeaveCriticalSection
0x40c030 SetEvent
0x40c034 ReleaseMutex
0x40c038 EnterCriticalSection
0x40c03c DeleteCriticalSection
0x40c040 InitializeCriticalSection
0x40c044 CreateMutexA
0x40c048 GetFileType
0x40c04c SetLastError
0x40c050 FreeEnvironmentStringsW
0x40c054 GetEnvironmentStringsW
0x40c058 GlobalFree
0x40c05c GetCommandLineW
0x40c060 TlsAlloc
0x40c064 TlsFree
0x40c068 DuplicateHandle
0x40c06c GetCurrentProcess
0x40c070 SetHandleInformation
0x40c074 CloseHandle
0x40c078 GetSystemTimeAsFileTime
0x40c07c FileTimeToSystemTime
0x40c080 GetTimeZoneInformation
0x40c084 FileTimeToLocalFileTime
0x40c088 SystemTimeToFileTime
0x40c08c SystemTimeToTzSpecificLocalTime
0x40c090 Sleep
0x40c094 FormatMessageA
0x40c098 GetLastError
0x40c09c WaitForSingleObject
0x40c0a0 CreateEventA
0x40c0a4 SetStdHandle
0x40c0a8 SetFilePointer
0x40c0ac CreateFileA
0x40c0b0 CreateFileW
0x40c0b4 GetOverlappedResult
0x40c0b8 DeviceIoControl
0x40c0bc GetFileInformationByHandle
0x40c0c0 LocalFree
ADVAPI32.dll
0x40c000 FreeSid
0x40c004 AllocateAndInitializeSid
WSOCK32.dll
0x40c1a0 getsockopt
0x40c1a4 connect
0x40c1a8 htons
0x40c1ac gethostbyname
0x40c1b0 ntohl
0x40c1b4 inet_ntoa
0x40c1b8 setsockopt
0x40c1bc socket
0x40c1c0 closesocket
0x40c1c4 select
0x40c1c8 ioctlsocket
0x40c1cc __WSAFDIsSet
0x40c1d0 WSAStartup
0x40c1d4 WSACleanup
0x40c1d8 WSAGetLastError
WS2_32.dll
0x40c194 WSARecv
0x40c198 WSASend
EAT(Export Address Table) is none