ScreenShot
Created | 2021.06.25 10:28 | Machine | s1_win7_x6402 |
Filename | sfx_123_701.exe | ||
Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
AI Score |
|
Behavior Score |
|
ZERO API | file : clean | ||
VT API (file) | 19 detected (AIDetect, malware2, Unsafe, malicious, Generic ML PUA, Archive, Bomb, AdwareLinkury, Static AI, Suspicious PE, Score, Bunitucrypt, Artemis, Probably Heur, RARAutorun, Slntscn24, bVWkC5, confidence) | ||
md5 | ef3a953c9b8c6e64271a8dc164b3455e | ||
sha256 | 0aa2f411f7491197cb3b4aeaf0fb09587363907fdb75f6725dc5d1c887f11ab2 | ||
ssdeep | 49152:lqbxYnkXlm7fUoXXkKl1WCCVtkH84EHTtR3c:cxYnkXlmLHkKTWf+c4EzHc | ||
imphash | 49091c5c46d1ed156931ed11f43d3afa | ||
impfuzzy | 24:dlJgvUZOB2QaeD7cSjRTZzjMn+cOvu9T/2DX7dtDX+sDc+plmowWVLOoviZ3jM3:A2OcLKcURt1YgXBtDX+Kc+pnCA |
Network IP location
Signature (18cnts)
Level | Description |
---|---|
watch | Communicates with host for which no DNS query was performed |
watch | File has been identified by 19 AntiVirus engines on VirusTotal as malicious |
watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
notice | A process created a hidden window |
notice | Allocates read-write-execute memory (usually to unpack itself) |
notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
notice | Creates a suspicious process |
notice | Drops an executable to the user AppData folder |
notice | Executes one or more WMI queries |
notice | Potentially malicious URLs were found in the process memory dump |
notice | Terminates another process |
notice | Uses Windows utilities for basic Windows functionality |
notice | Yara rule detected in process memory |
info | Checks amount of memory in system |
info | Command line console output was observed |
info | Queries for the computername |
info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
info | This executable has a PDB path |
Rules (38cnts)
Level | Name | Description | Collection |
---|---|---|---|
watch | Network_Downloader | File Downloader | memory |
notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
notice | Create_Service | Create a windows service | memory |
notice | Escalate_priviledges | Escalate priviledges | memory |
notice | Hijack_Network | Hijack network configuration | memory |
notice | KeyLogger | Run a KeyLogger | memory |
notice | local_credential_Steal | Steal credential | memory |
notice | Network_DGA | Communication using DGA | memory |
notice | Network_DNS | Communications use DNS | memory |
notice | Network_FTP | Communications over FTP | memory |
notice | Network_HTTP | Communications over HTTP | memory |
notice | Network_P2P_Win | Communications over P2P network | memory |
notice | Network_TCP_Socket | Communications over RAW Socket | memory |
notice | Persistence | Install itself for autorun at Windows startup | memory |
notice | ScreenShot | Take ScreenShot | memory |
notice | Sniff_Audio | Record Audio | memory |
notice | Str_Win32_Http_API | Match Windows Http API call | memory |
notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
info | anti_dbg | Checks if being debugged | memory |
info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
info | Check_Dlls | (no description) | memory |
info | DebuggerCheck__GlobalFlags | (no description) | memory |
info | DebuggerCheck__QueryInfo | (no description) | memory |
info | DebuggerCheck__RemoteAPI | (no description) | memory |
info | DebuggerException__ConsoleCtrl | (no description) | memory |
info | DebuggerException__SetConsoleCtrl | (no description) | memory |
info | DebuggerHiding__Active | (no description) | memory |
info | DebuggerHiding__Thread | (no description) | memory |
info | disable_dep | Bypass DEP | memory |
info | IsDLL | (no description) | binaries (download) |
info | IsPE32 | (no description) | binaries (download) |
info | IsPE32 | (no description) | binaries (upload) |
info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
info | PE_Header_Zero | PE File Signature | binaries (download) |
info | PE_Header_Zero | PE File Signature | binaries (upload) |
info | SEH__vectored | (no description) | memory |
info | ThreadControl__Context | (no description) | memory |
info | win_hook | Affect hook table | memory |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x422000 GetLastError
0x422004 SetLastError
0x422008 GetFileType
0x42200c GetStdHandle
0x422010 WriteFile
0x422014 ReadFile
0x422018 FlushFileBuffers
0x42201c SetEndOfFile
0x422020 SetFilePointer
0x422024 SetFileTime
0x422028 CloseHandle
0x42202c CreateFileW
0x422030 CreateDirectoryW
0x422034 SetFileAttributesW
0x422038 GetFileAttributesW
0x42203c DeleteFileW
0x422040 MoveFileW
0x422044 FindClose
0x422048 FindFirstFileW
0x42204c FindNextFileW
0x422050 GetVersionExW
0x422054 GetCurrentDirectoryW
0x422058 GetFullPathNameW
0x42205c FoldStringW
0x422060 GetModuleFileNameW
0x422064 GetModuleHandleW
0x422068 FindResourceW
0x42206c FreeLibrary
0x422070 GetProcAddress
0x422074 GetCurrentProcessId
0x422078 ExitProcess
0x42207c Sleep
0x422080 LoadLibraryW
0x422084 GetSystemDirectoryW
0x422088 CompareStringW
0x42208c AllocConsole
0x422090 FreeConsole
0x422094 AttachConsole
0x422098 WriteConsoleW
0x42209c TzSpecificLocalTimeToSystemTime
0x4220a0 SystemTimeToFileTime
0x4220a4 FileTimeToLocalFileTime
0x4220a8 LocalFileTimeToFileTime
0x4220ac FileTimeToSystemTime
0x4220b0 GetCPInfo
0x4220b4 IsDBCSLeadByte
0x4220b8 MultiByteToWideChar
0x4220bc WideCharToMultiByte
0x4220c0 GlobalAlloc
0x4220c4 GetTickCount
0x4220c8 SetCurrentDirectoryW
0x4220cc GetExitCodeProcess
0x4220d0 WaitForSingleObject
0x4220d4 GetLocalTime
0x4220d8 MapViewOfFile
0x4220dc UnmapViewOfFile
0x4220e0 CreateFileMappingW
0x4220e4 OpenFileMappingW
0x4220e8 GetCommandLineW
0x4220ec SetEnvironmentVariableW
0x4220f0 ExpandEnvironmentStringsW
0x4220f4 GetTempPathW
0x4220f8 MoveFileExW
0x4220fc GetLocaleInfoW
0x422100 GetTimeFormatW
0x422104 GetDateFormatW
0x422108 GetNumberFormatW
0x42210c RaiseException
0x422110 GetSystemInfo
0x422114 VirtualProtect
0x422118 VirtualQuery
0x42211c LoadLibraryExA
0x422120 IsProcessorFeaturePresent
0x422124 IsDebuggerPresent
0x422128 UnhandledExceptionFilter
0x42212c SetUnhandledExceptionFilter
0x422130 GetStartupInfoW
0x422134 QueryPerformanceCounter
0x422138 GetCurrentThreadId
0x42213c GetSystemTimeAsFileTime
0x422140 InitializeSListHead
0x422144 GetCurrentProcess
0x422148 TerminateProcess
0x42214c RtlUnwind
0x422150 EncodePointer
0x422154 EnterCriticalSection
0x422158 LeaveCriticalSection
0x42215c DeleteCriticalSection
0x422160 InitializeCriticalSectionAndSpinCount
0x422164 TlsAlloc
0x422168 TlsGetValue
0x42216c TlsSetValue
0x422170 TlsFree
0x422174 LoadLibraryExW
0x422178 QueryPerformanceFrequency
0x42217c GetModuleHandleExW
0x422180 GetModuleFileNameA
0x422184 GetACP
0x422188 HeapFree
0x42218c HeapAlloc
0x422190 HeapReAlloc
0x422194 GetStringTypeW
0x422198 LCMapStringW
0x42219c FindFirstFileExA
0x4221a0 FindNextFileA
0x4221a4 IsValidCodePage
0x4221a8 GetOEMCP
0x4221ac GetCommandLineA
0x4221b0 GetEnvironmentStringsW
0x4221b4 FreeEnvironmentStringsW
0x4221b8 GetProcessHeap
0x4221bc SetStdHandle
0x4221c0 HeapSize
0x4221c4 GetConsoleCP
0x4221c8 GetConsoleMode
0x4221cc SetFilePointerEx
0x4221d0 DecodePointer
EAT(Export Address Table) Library
KERNEL32.dll
0x422000 GetLastError
0x422004 SetLastError
0x422008 GetFileType
0x42200c GetStdHandle
0x422010 WriteFile
0x422014 ReadFile
0x422018 FlushFileBuffers
0x42201c SetEndOfFile
0x422020 SetFilePointer
0x422024 SetFileTime
0x422028 CloseHandle
0x42202c CreateFileW
0x422030 CreateDirectoryW
0x422034 SetFileAttributesW
0x422038 GetFileAttributesW
0x42203c DeleteFileW
0x422040 MoveFileW
0x422044 FindClose
0x422048 FindFirstFileW
0x42204c FindNextFileW
0x422050 GetVersionExW
0x422054 GetCurrentDirectoryW
0x422058 GetFullPathNameW
0x42205c FoldStringW
0x422060 GetModuleFileNameW
0x422064 GetModuleHandleW
0x422068 FindResourceW
0x42206c FreeLibrary
0x422070 GetProcAddress
0x422074 GetCurrentProcessId
0x422078 ExitProcess
0x42207c Sleep
0x422080 LoadLibraryW
0x422084 GetSystemDirectoryW
0x422088 CompareStringW
0x42208c AllocConsole
0x422090 FreeConsole
0x422094 AttachConsole
0x422098 WriteConsoleW
0x42209c TzSpecificLocalTimeToSystemTime
0x4220a0 SystemTimeToFileTime
0x4220a4 FileTimeToLocalFileTime
0x4220a8 LocalFileTimeToFileTime
0x4220ac FileTimeToSystemTime
0x4220b0 GetCPInfo
0x4220b4 IsDBCSLeadByte
0x4220b8 MultiByteToWideChar
0x4220bc WideCharToMultiByte
0x4220c0 GlobalAlloc
0x4220c4 GetTickCount
0x4220c8 SetCurrentDirectoryW
0x4220cc GetExitCodeProcess
0x4220d0 WaitForSingleObject
0x4220d4 GetLocalTime
0x4220d8 MapViewOfFile
0x4220dc UnmapViewOfFile
0x4220e0 CreateFileMappingW
0x4220e4 OpenFileMappingW
0x4220e8 GetCommandLineW
0x4220ec SetEnvironmentVariableW
0x4220f0 ExpandEnvironmentStringsW
0x4220f4 GetTempPathW
0x4220f8 MoveFileExW
0x4220fc GetLocaleInfoW
0x422100 GetTimeFormatW
0x422104 GetDateFormatW
0x422108 GetNumberFormatW
0x42210c RaiseException
0x422110 GetSystemInfo
0x422114 VirtualProtect
0x422118 VirtualQuery
0x42211c LoadLibraryExA
0x422120 IsProcessorFeaturePresent
0x422124 IsDebuggerPresent
0x422128 UnhandledExceptionFilter
0x42212c SetUnhandledExceptionFilter
0x422130 GetStartupInfoW
0x422134 QueryPerformanceCounter
0x422138 GetCurrentThreadId
0x42213c GetSystemTimeAsFileTime
0x422140 InitializeSListHead
0x422144 GetCurrentProcess
0x422148 TerminateProcess
0x42214c RtlUnwind
0x422150 EncodePointer
0x422154 EnterCriticalSection
0x422158 LeaveCriticalSection
0x42215c DeleteCriticalSection
0x422160 InitializeCriticalSectionAndSpinCount
0x422164 TlsAlloc
0x422168 TlsGetValue
0x42216c TlsSetValue
0x422170 TlsFree
0x422174 LoadLibraryExW
0x422178 QueryPerformanceFrequency
0x42217c GetModuleHandleExW
0x422180 GetModuleFileNameA
0x422184 GetACP
0x422188 HeapFree
0x42218c HeapAlloc
0x422190 HeapReAlloc
0x422194 GetStringTypeW
0x422198 LCMapStringW
0x42219c FindFirstFileExA
0x4221a0 FindNextFileA
0x4221a4 IsValidCodePage
0x4221a8 GetOEMCP
0x4221ac GetCommandLineA
0x4221b0 GetEnvironmentStringsW
0x4221b4 FreeEnvironmentStringsW
0x4221b8 GetProcessHeap
0x4221bc SetStdHandle
0x4221c0 HeapSize
0x4221c4 GetConsoleCP
0x4221c8 GetConsoleMode
0x4221cc SetFilePointerEx
0x4221d0 DecodePointer
EAT(Export Address Table) Library