ScreenShot
| Created | 2021.06.25 00:20 | Machine | s1_win7_x6402 |
| Filename | md5list.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 61ff50d7c66468a4770076f26e7ac115 | ||
| sha256 | 3e7d2b22194b2b351dfe4e6775ff3082316d37d3f9b10d29dd59c63f89177265 | ||
| ssdeep | 1536:kJsvN3hQl7yQobBS7egg35ncIsHPJIasIabHfRNMqXO4g4039Lwr9xYUYRlMtoOM:kJsvJhQJyQooucIsHPSb5NnXO4RS9LwI | ||
| imphash | f9818f13e97064c2c34b908c5ef5843d | ||
| impfuzzy | 3:swBJAEPwS9KTXzhAXwEQaxRAAbsEBJJ67EGV21MO/Wb3VKSxAdB:dBJAEHGDzyRlbRmVOZ/WbBxAdB | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| info | Command line console output was observed |
Rules (2cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.DLL
0x4302bc LoadLibraryA
0x4302c0 GetProcAddress
0x4302c4 VirtualProtect
0x4302c8 VirtualAlloc
0x4302cc VirtualFree
0x4302d0 ExitProcess
SHLWAPI.dll
0x4302d8 PathFileExistsA
EAT(Export Address Table) is none
KERNEL32.DLL
0x4302bc LoadLibraryA
0x4302c0 GetProcAddress
0x4302c4 VirtualProtect
0x4302c8 VirtualAlloc
0x4302cc VirtualFree
0x4302d0 ExitProcess
SHLWAPI.dll
0x4302d8 PathFileExistsA
EAT(Export Address Table) is none