ScreenShot
| Created | 2021.06.25 15:21 | Machine | s1_win7_x6401 |
| Filename | QmXhZxGAX1HF6vaMC1sdLPwpJLWkkveZnyp86K1daFGLBq | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 20 detected (Python, Mikey, Eldorado, Malicious, score, ai score=80, ASMalwS, Wacapew) | ||
| md5 | 5e1792eae07b1aa1771f496f338e11c1 | ||
| sha256 | 9666834327abc09d439de802ac288da4d31299517f886c030c1ac7792928876a | ||
| ssdeep | 196608:uH0aFUCsXDjDyfmdJolpPgToa10/9nFOnJ+kJ7mc56m:uLFUCEDLJ83a10tsEVcg | ||
| imphash | f4cf09dd5265ea802d83e943c2137765 | ||
| impfuzzy | 48:CkB9rteS1hEc+ppYCRcgT+ONRi5bmbU1M:lBFteS1hEc+ppY8t+CI+yM | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| notice | Creates executable files on the filesystem |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (11cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140023028 GetCommandLineW
0x140023030 GetEnvironmentVariableW
0x140023038 SetEnvironmentVariableW
0x140023040 ExpandEnvironmentStringsW
0x140023048 CreateDirectoryW
0x140023050 GetTempPathW
0x140023058 WaitForSingleObject
0x140023060 Sleep
0x140023068 GetExitCodeProcess
0x140023070 GetStartupInfoW
0x140023078 LoadLibraryExW
0x140023080 CloseHandle
0x140023088 GetCurrentProcess
0x140023090 LoadLibraryA
0x140023098 LocalFree
0x1400230a0 FormatMessageW
0x1400230a8 MultiByteToWideChar
0x1400230b0 WideCharToMultiByte
0x1400230b8 SetEndOfFile
0x1400230c0 GetProcAddress
0x1400230c8 GetModuleFileNameW
0x1400230d0 SetDllDirectoryW
0x1400230d8 CreateProcessW
0x1400230e0 GetLastError
0x1400230e8 RtlCaptureContext
0x1400230f0 RtlLookupFunctionEntry
0x1400230f8 RtlVirtualUnwind
0x140023100 UnhandledExceptionFilter
0x140023108 SetUnhandledExceptionFilter
0x140023110 TerminateProcess
0x140023118 IsProcessorFeaturePresent
0x140023120 QueryPerformanceCounter
0x140023128 GetCurrentProcessId
0x140023130 GetCurrentThreadId
0x140023138 GetSystemTimeAsFileTime
0x140023140 InitializeSListHead
0x140023148 IsDebuggerPresent
0x140023150 GetModuleHandleW
0x140023158 RtlUnwindEx
0x140023160 SetLastError
0x140023168 EnterCriticalSection
0x140023170 LeaveCriticalSection
0x140023178 DeleteCriticalSection
0x140023180 InitializeCriticalSectionAndSpinCount
0x140023188 TlsAlloc
0x140023190 TlsGetValue
0x140023198 TlsSetValue
0x1400231a0 TlsFree
0x1400231a8 FreeLibrary
0x1400231b0 RaiseException
0x1400231b8 GetCommandLineA
0x1400231c0 ReadFile
0x1400231c8 CreateFileW
0x1400231d0 GetDriveTypeW
0x1400231d8 GetFileInformationByHandle
0x1400231e0 GetFileType
0x1400231e8 PeekNamedPipe
0x1400231f0 SystemTimeToTzSpecificLocalTime
0x1400231f8 FileTimeToSystemTime
0x140023200 GetFullPathNameW
0x140023208 RemoveDirectoryW
0x140023210 FindClose
0x140023218 FindFirstFileExW
0x140023220 FindNextFileW
0x140023228 SetStdHandle
0x140023230 SetConsoleCtrlHandler
0x140023238 DeleteFileW
0x140023240 GetStdHandle
0x140023248 WriteFile
0x140023250 ExitProcess
0x140023258 GetModuleHandleExW
0x140023260 HeapAlloc
0x140023268 HeapFree
0x140023270 GetConsoleMode
0x140023278 ReadConsoleW
0x140023280 SetFilePointerEx
0x140023288 GetConsoleCP
0x140023290 GetFileSizeEx
0x140023298 CompareStringW
0x1400232a0 LCMapStringW
0x1400232a8 GetCurrentDirectoryW
0x1400232b0 FlushFileBuffers
0x1400232b8 GetFileAttributesExW
0x1400232c0 IsValidCodePage
0x1400232c8 GetACP
0x1400232d0 GetOEMCP
0x1400232d8 GetCPInfo
0x1400232e0 GetEnvironmentStringsW
0x1400232e8 FreeEnvironmentStringsW
0x1400232f0 GetStringTypeW
0x1400232f8 GetProcessHeap
0x140023300 GetTimeZoneInformation
0x140023308 HeapSize
0x140023310 HeapReAlloc
0x140023318 WriteConsoleW
ADVAPI32.dll
0x140023000 ConvertSidToStringSidW
0x140023008 GetTokenInformation
0x140023010 OpenProcessToken
0x140023018 ConvertStringSecurityDescriptorToSecurityDescriptorW
EAT(Export Address Table) is none
KERNEL32.dll
0x140023028 GetCommandLineW
0x140023030 GetEnvironmentVariableW
0x140023038 SetEnvironmentVariableW
0x140023040 ExpandEnvironmentStringsW
0x140023048 CreateDirectoryW
0x140023050 GetTempPathW
0x140023058 WaitForSingleObject
0x140023060 Sleep
0x140023068 GetExitCodeProcess
0x140023070 GetStartupInfoW
0x140023078 LoadLibraryExW
0x140023080 CloseHandle
0x140023088 GetCurrentProcess
0x140023090 LoadLibraryA
0x140023098 LocalFree
0x1400230a0 FormatMessageW
0x1400230a8 MultiByteToWideChar
0x1400230b0 WideCharToMultiByte
0x1400230b8 SetEndOfFile
0x1400230c0 GetProcAddress
0x1400230c8 GetModuleFileNameW
0x1400230d0 SetDllDirectoryW
0x1400230d8 CreateProcessW
0x1400230e0 GetLastError
0x1400230e8 RtlCaptureContext
0x1400230f0 RtlLookupFunctionEntry
0x1400230f8 RtlVirtualUnwind
0x140023100 UnhandledExceptionFilter
0x140023108 SetUnhandledExceptionFilter
0x140023110 TerminateProcess
0x140023118 IsProcessorFeaturePresent
0x140023120 QueryPerformanceCounter
0x140023128 GetCurrentProcessId
0x140023130 GetCurrentThreadId
0x140023138 GetSystemTimeAsFileTime
0x140023140 InitializeSListHead
0x140023148 IsDebuggerPresent
0x140023150 GetModuleHandleW
0x140023158 RtlUnwindEx
0x140023160 SetLastError
0x140023168 EnterCriticalSection
0x140023170 LeaveCriticalSection
0x140023178 DeleteCriticalSection
0x140023180 InitializeCriticalSectionAndSpinCount
0x140023188 TlsAlloc
0x140023190 TlsGetValue
0x140023198 TlsSetValue
0x1400231a0 TlsFree
0x1400231a8 FreeLibrary
0x1400231b0 RaiseException
0x1400231b8 GetCommandLineA
0x1400231c0 ReadFile
0x1400231c8 CreateFileW
0x1400231d0 GetDriveTypeW
0x1400231d8 GetFileInformationByHandle
0x1400231e0 GetFileType
0x1400231e8 PeekNamedPipe
0x1400231f0 SystemTimeToTzSpecificLocalTime
0x1400231f8 FileTimeToSystemTime
0x140023200 GetFullPathNameW
0x140023208 RemoveDirectoryW
0x140023210 FindClose
0x140023218 FindFirstFileExW
0x140023220 FindNextFileW
0x140023228 SetStdHandle
0x140023230 SetConsoleCtrlHandler
0x140023238 DeleteFileW
0x140023240 GetStdHandle
0x140023248 WriteFile
0x140023250 ExitProcess
0x140023258 GetModuleHandleExW
0x140023260 HeapAlloc
0x140023268 HeapFree
0x140023270 GetConsoleMode
0x140023278 ReadConsoleW
0x140023280 SetFilePointerEx
0x140023288 GetConsoleCP
0x140023290 GetFileSizeEx
0x140023298 CompareStringW
0x1400232a0 LCMapStringW
0x1400232a8 GetCurrentDirectoryW
0x1400232b0 FlushFileBuffers
0x1400232b8 GetFileAttributesExW
0x1400232c0 IsValidCodePage
0x1400232c8 GetACP
0x1400232d0 GetOEMCP
0x1400232d8 GetCPInfo
0x1400232e0 GetEnvironmentStringsW
0x1400232e8 FreeEnvironmentStringsW
0x1400232f0 GetStringTypeW
0x1400232f8 GetProcessHeap
0x140023300 GetTimeZoneInformation
0x140023308 HeapSize
0x140023310 HeapReAlloc
0x140023318 WriteConsoleW
ADVAPI32.dll
0x140023000 ConvertSidToStringSidW
0x140023008 GetTokenInformation
0x140023010 OpenProcessToken
0x140023018 ConvertStringSecurityDescriptorToSecurityDescriptorW
EAT(Export Address Table) is none