ScreenShot
| Created | 2021.07.02 16:42 | Machine | s1_win7_x6402 |
| Filename | spool.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 52 detected (AIDetect, malware1, malicious, high confidence, DeepScan, Unsafe, Save, confidence, 100%, Attribute, HighConfidence, Farfli, BackdoorX, bvyp, hitbri, Generic@ML, RDML, ZIMIPn0l+OY5llnocRyEJA, R002C0PFR21, A + Mal, SwiftG, Static AI, Malicious PE, TDSS, XPACK, ai score=84, HackTool, Mimikatz, atmn, score, R333274, GenericRXKB, BScope, Phgg, W+Mb7VQS57w, Shiz, GenKryptik, DJUZ, susgen, HwcBNCsA) | ||
| md5 | bd5693ff7ade6c145cece2316064d812 | ||
| sha256 | 51e9acb44814b69e368a13bdfb4bab1961647bc7efd78234aefc755a0e3d6479 | ||
| ssdeep | 12288:eQN9iUTzUjd4OctP+2MUdqb72+6hQaKx1O:eQN9i+FpIo02+eCx1O | ||
| imphash | 19d4e66d725c89ba6712b82bebc8196d | ||
| impfuzzy | 12:mDzCAOovaZGd3wXJYv8ERRvqZ7JVJKu1GlE3ARJRZqRXTAILFQLRP9oD98V:mDdOovuxiv8ERRvq7JHKuklEEfcjt9s | ||
Network IP location
Signature (16cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 52 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a service |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | The executable uses a known packer |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x401000 GetProcAddress
0x401004 GetModuleHandleA
0x401008 GetStartupInfoA
0x40100c GetCommandLineA
0x401010 GetVersion
0x401014 ExitProcess
0x401018 TerminateProcess
0x40101c GetCurrentProcess
0x401020 UnhandledExceptionFilter
0x401024 GetModuleFileNameA
0x401028 FreeEnvironmentStringsA
0x40102c FreeEnvironmentStringsW
0x401030 WideCharToMultiByte
0x401034 GetEnvironmentStrings
0x401038 GetEnvironmentStringsW
0x40103c SetHandleCount
0x401040 GetStdHandle
0x401044 GetFileType
0x401048 GetCurrentThreadId
0x40104c TlsSetValue
0x401050 TlsAlloc
0x401054 SetLastError
0x401058 TlsGetValue
0x40105c GetLastError
0x401060 GetEnvironmentVariableA
0x401064 GetVersionExA
0x401068 HeapDestroy
0x40106c HeapCreate
0x401070 VirtualFree
0x401074 HeapFree
0x401078 RtlUnwind
0x40107c WriteFile
0x401080 InitializeCriticalSection
0x401084 EnterCriticalSection
0x401088 LeaveCriticalSection
0x40108c GetCPInfo
0x401090 GetACP
0x401094 GetOEMCP
0x401098 HeapAlloc
0x40109c VirtualAlloc
0x4010a0 HeapReAlloc
0x4010a4 LoadLibraryA
0x4010a8 MultiByteToWideChar
0x4010ac LCMapStringA
0x4010b0 LCMapStringW
0x4010b4 GetStringTypeA
0x4010b8 GetStringTypeW
0x4010bc InterlockedDecrement
0x4010c0 InterlockedIncrement
EAT(Export Address Table) is none
KERNEL32.dll
0x401000 GetProcAddress
0x401004 GetModuleHandleA
0x401008 GetStartupInfoA
0x40100c GetCommandLineA
0x401010 GetVersion
0x401014 ExitProcess
0x401018 TerminateProcess
0x40101c GetCurrentProcess
0x401020 UnhandledExceptionFilter
0x401024 GetModuleFileNameA
0x401028 FreeEnvironmentStringsA
0x40102c FreeEnvironmentStringsW
0x401030 WideCharToMultiByte
0x401034 GetEnvironmentStrings
0x401038 GetEnvironmentStringsW
0x40103c SetHandleCount
0x401040 GetStdHandle
0x401044 GetFileType
0x401048 GetCurrentThreadId
0x40104c TlsSetValue
0x401050 TlsAlloc
0x401054 SetLastError
0x401058 TlsGetValue
0x40105c GetLastError
0x401060 GetEnvironmentVariableA
0x401064 GetVersionExA
0x401068 HeapDestroy
0x40106c HeapCreate
0x401070 VirtualFree
0x401074 HeapFree
0x401078 RtlUnwind
0x40107c WriteFile
0x401080 InitializeCriticalSection
0x401084 EnterCriticalSection
0x401088 LeaveCriticalSection
0x40108c GetCPInfo
0x401090 GetACP
0x401094 GetOEMCP
0x401098 HeapAlloc
0x40109c VirtualAlloc
0x4010a0 HeapReAlloc
0x4010a4 LoadLibraryA
0x4010a8 MultiByteToWideChar
0x4010ac LCMapStringA
0x4010b0 LCMapStringW
0x4010b4 GetStringTypeA
0x4010b8 GetStringTypeW
0x4010bc InterlockedDecrement
0x4010c0 InterlockedIncrement
EAT(Export Address Table) is none