ScreenShot
| Created | 2021.06.25 00:09 | Machine | s1_win7_x6401 |
| Filename | c.1x | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | e0da003c129a2b3d91e459c732290418 | ||
| sha256 | 710f00304004fe991c085c99ef5f98558bb5ef145aa5c0855ce2c0e091aa4743 | ||
| ssdeep | 6144:aCjat9IUJkIFBHUq1Z/N1MSg+qYrFl5xMLWK5+2X3RteQchn8xLLRbYPIH50nrT6:au7UqIFBHmyARbYpru | ||
| imphash | 6307511523848f04b88937cef8b71729 | ||
| impfuzzy | 48:+WS1Yp1m1ff1/1gV6ERA49cgCNkX+VySjaEQSKOFhLSMBSA:+WS1YpAZFaUE+49cgCNdVygV | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x40c008 Process32FirstW
0x40c00c GetComputerNameA
0x40c010 GetModuleFileNameA
0x40c014 FindFirstFileA
0x40c018 FindNextFileA
0x40c01c FindClose
0x40c020 Sleep
0x40c024 GetLastError
0x40c028 LoadLibraryA
0x40c02c SystemTimeToFileTime
0x40c030 GetSystemTime
0x40c034 VirtualProtect
0x40c038 Process32NextW
0x40c03c GetSystemDirectoryA
0x40c040 GetProcAddress
0x40c044 GetCurrentProcess
0x40c048 FindResourceW
0x40c04c GetModuleHandleW
0x40c050 SetUnhandledExceptionFilter
0x40c054 TerminateProcess
0x40c058 IsProcessorFeaturePresent
0x40c05c IsDebuggerPresent
0x40c060 GetStartupInfoW
0x40c064 QueryPerformanceCounter
0x40c068 GetCurrentProcessId
0x40c06c GetCurrentThreadId
0x40c070 VirtualAlloc
0x40c074 CreateToolhelp32Snapshot
0x40c078 GetSystemTimeAsFileTime
0x40c07c UnhandledExceptionFilter
0x40c080 InitializeSListHead
ADVAPI32.dll
0x40c000 GetUserNameA
MSVCP140.dll
0x40c088 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
0x40c08c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
0x40c090 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
0x40c094 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
0x40c098 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
0x40c09c ?_Xout_of_range@std@@YAXPBD@Z
0x40c0a0 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x40c0a4 ?_Xlength_error@std@@YAXPBD@Z
VCRUNTIME140.dll
0x40c0ac __std_exception_copy
0x40c0b0 __CxxFrameHandler3
0x40c0b4 memchr
0x40c0b8 memcpy
0x40c0bc memset
0x40c0c0 _except_handler4_common
0x40c0c4 memmove
0x40c0c8 _CxxThrowException
0x40c0cc __current_exception_context
0x40c0d0 __current_exception
0x40c0d4 __std_exception_destroy
api-ms-win-crt-runtime-l1-1-0.dll
0x40c108 _cexit
0x40c10c _seh_filter_exe
0x40c110 _set_app_type
0x40c114 _configure_wide_argv
0x40c118 _initialize_wide_environment
0x40c11c _get_wide_winmain_command_line
0x40c120 _initterm
0x40c124 _crt_atexit
0x40c128 _exit
0x40c12c terminate
0x40c130 _c_exit
0x40c134 _register_thread_local_exe_atexit_callback
0x40c138 _register_onexit_function
0x40c13c _initialize_onexit_table
0x40c140 _controlfp_s
0x40c144 exit
0x40c148 _initterm_e
0x40c14c _invalid_parameter_noinfo_noreturn
api-ms-win-crt-utility-l1-1-0.dll
0x40c184 rand
0x40c188 srand
api-ms-win-crt-heap-l1-1-0.dll
0x40c0e4 malloc
0x40c0e8 free
0x40c0ec _set_new_mode
0x40c0f0 _callnewh
api-ms-win-crt-environment-l1-1-0.dll
0x40c0dc getenv_s
api-ms-win-crt-stdio-l1-1-0.dll
0x40c154 __stdio_common_vsprintf
0x40c158 fopen_s
0x40c15c _set_fmode
0x40c160 fseek
0x40c164 fclose
0x40c168 ftell
0x40c16c fwrite
0x40c170 __p__commode
0x40c174 fread
api-ms-win-crt-time-l1-1-0.dll
0x40c17c _time64
api-ms-win-crt-math-l1-1-0.dll
0x40c100 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x40c0f8 _configthreadlocale
EAT(Export Address Table) is none
KERNEL32.dll
0x40c008 Process32FirstW
0x40c00c GetComputerNameA
0x40c010 GetModuleFileNameA
0x40c014 FindFirstFileA
0x40c018 FindNextFileA
0x40c01c FindClose
0x40c020 Sleep
0x40c024 GetLastError
0x40c028 LoadLibraryA
0x40c02c SystemTimeToFileTime
0x40c030 GetSystemTime
0x40c034 VirtualProtect
0x40c038 Process32NextW
0x40c03c GetSystemDirectoryA
0x40c040 GetProcAddress
0x40c044 GetCurrentProcess
0x40c048 FindResourceW
0x40c04c GetModuleHandleW
0x40c050 SetUnhandledExceptionFilter
0x40c054 TerminateProcess
0x40c058 IsProcessorFeaturePresent
0x40c05c IsDebuggerPresent
0x40c060 GetStartupInfoW
0x40c064 QueryPerformanceCounter
0x40c068 GetCurrentProcessId
0x40c06c GetCurrentThreadId
0x40c070 VirtualAlloc
0x40c074 CreateToolhelp32Snapshot
0x40c078 GetSystemTimeAsFileTime
0x40c07c UnhandledExceptionFilter
0x40c080 InitializeSListHead
ADVAPI32.dll
0x40c000 GetUserNameA
MSVCP140.dll
0x40c088 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
0x40c08c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
0x40c090 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
0x40c094 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
0x40c098 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
0x40c09c ?_Xout_of_range@std@@YAXPBD@Z
0x40c0a0 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x40c0a4 ?_Xlength_error@std@@YAXPBD@Z
VCRUNTIME140.dll
0x40c0ac __std_exception_copy
0x40c0b0 __CxxFrameHandler3
0x40c0b4 memchr
0x40c0b8 memcpy
0x40c0bc memset
0x40c0c0 _except_handler4_common
0x40c0c4 memmove
0x40c0c8 _CxxThrowException
0x40c0cc __current_exception_context
0x40c0d0 __current_exception
0x40c0d4 __std_exception_destroy
api-ms-win-crt-runtime-l1-1-0.dll
0x40c108 _cexit
0x40c10c _seh_filter_exe
0x40c110 _set_app_type
0x40c114 _configure_wide_argv
0x40c118 _initialize_wide_environment
0x40c11c _get_wide_winmain_command_line
0x40c120 _initterm
0x40c124 _crt_atexit
0x40c128 _exit
0x40c12c terminate
0x40c130 _c_exit
0x40c134 _register_thread_local_exe_atexit_callback
0x40c138 _register_onexit_function
0x40c13c _initialize_onexit_table
0x40c140 _controlfp_s
0x40c144 exit
0x40c148 _initterm_e
0x40c14c _invalid_parameter_noinfo_noreturn
api-ms-win-crt-utility-l1-1-0.dll
0x40c184 rand
0x40c188 srand
api-ms-win-crt-heap-l1-1-0.dll
0x40c0e4 malloc
0x40c0e8 free
0x40c0ec _set_new_mode
0x40c0f0 _callnewh
api-ms-win-crt-environment-l1-1-0.dll
0x40c0dc getenv_s
api-ms-win-crt-stdio-l1-1-0.dll
0x40c154 __stdio_common_vsprintf
0x40c158 fopen_s
0x40c15c _set_fmode
0x40c160 fseek
0x40c164 fclose
0x40c168 ftell
0x40c16c fwrite
0x40c170 __p__commode
0x40c174 fread
api-ms-win-crt-time-l1-1-0.dll
0x40c17c _time64
api-ms-win-crt-math-l1-1-0.dll
0x40c100 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x40c0f8 _configthreadlocale
EAT(Export Address Table) is none