ScreenShot
| Created | 2021.06.28 18:11 | Machine | s1_win7_x6402 |
| Filename | vshosts.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 15 detected (malicious, high confidence, Unsafe, Attribute, HighConfidence, Generic ML PUA, Tnega, ZexaF, @J0@a8BTE1cG, ET#92%, RDMK, cmRtazrV7gfZrgWZGJXWiKJcIz6B, Static AI, Suspicious PE, susgen) | ||
| md5 | fa0b6d3c4c059a046944771a8d6fe7ca | ||
| sha256 | 2448bed4db497e26e9def8dc20369bfd843bcb0e73dab435fe61ead1cc2f869a | ||
| ssdeep | 196608:/2KZtT4C9f41RkCDIhWbk/jtKdFJSl9dxHlKe5:/XZtTfu8CDY3/IdFJ69ddV | ||
| imphash | ae28306bf70f5963ea0555dfe529913b | ||
| impfuzzy | 6:Aqi+AZQAcPh/MKq/JLGDgJLgJtXIKFJQQZ/OIA+m1BJAEnERGDfA7VSNLAcPh/MH:8hQfP9qZGoQtXJxZGb9AJcDfA5kLfP9m | ||
Network IP location
Signature (11cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | A process attempted to delay the analysis task. |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a windows hook that monitors keyboard input (keylogger) |
| watch | File has been identified by 15 AntiVirus engines on VirusTotal as malicious |
| watch | Installs an hook procedure to monitor for mouse events |
| watch | Looks for the Windows Idle Time to determine the uptime |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (2cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0xdc7000 GetVersionExW
WTSAPI32.dll
0xdc7008 WTSSendMessageW
KERNEL32.dll
0xdc7010 VirtualQuery
USER32.dll
0xdc7018 GetUserObjectInformationW
KERNEL32.dll
0xdc7020 LocalAlloc
0xdc7024 LocalFree
0xdc7028 GetModuleFileNameW
0xdc702c GetProcessAffinityMask
0xdc7030 SetProcessAffinityMask
0xdc7034 SetThreadAffinityMask
0xdc7038 Sleep
0xdc703c ExitProcess
0xdc7040 FreeLibrary
0xdc7044 LoadLibraryA
0xdc7048 GetModuleHandleA
0xdc704c GetProcAddress
USER32.dll
0xdc7054 GetProcessWindowStation
0xdc7058 GetUserObjectInformationW
EAT(Export Address Table) is none
KERNEL32.dll
0xdc7000 GetVersionExW
WTSAPI32.dll
0xdc7008 WTSSendMessageW
KERNEL32.dll
0xdc7010 VirtualQuery
USER32.dll
0xdc7018 GetUserObjectInformationW
KERNEL32.dll
0xdc7020 LocalAlloc
0xdc7024 LocalFree
0xdc7028 GetModuleFileNameW
0xdc702c GetProcessAffinityMask
0xdc7030 SetProcessAffinityMask
0xdc7034 SetThreadAffinityMask
0xdc7038 Sleep
0xdc703c ExitProcess
0xdc7040 FreeLibrary
0xdc7044 LoadLibraryA
0xdc7048 GetModuleHandleA
0xdc704c GetProcAddress
USER32.dll
0xdc7054 GetProcessWindowStation
0xdc7058 GetUserObjectInformationW
EAT(Export Address Table) is none