ScreenShot
| Created | 2021.07.09 18:27 | Machine | s1_win7_x6401 |
| Filename | app.dll | ||
| Type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 14 detected (malicious, high confidence, Ursnif, GenericKD, score, Outbreak, PossibleThreat, ZedlaF, Bq4@a8prUll, Hx4CdcQA) | ||
| md5 | f3be390b01c85970deeae124ca36ce2d | ||
| sha256 | 4eef8b6a5bcd808cd0ab0e33efcea2c2f9a36abe556e56556de8550383c9d3ce | ||
| ssdeep | 12288:AmYDWUbdfyU+H93bJ3aBGQIuSR35F5VBpx:yBbdfJsJqBG5VB/ | ||
| imphash | 6507b1356328cc79bafe86c109deb6e0 | ||
| impfuzzy | 48:CDgZD9ktMS1wGPc+pp6XWZ/HXUn6gaFMEdK7CvE:0g5WtMS1wGPc+ppMe/0uKYE | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| warning | Generates some ICMP traffic |
| watch | File has been identified by 14 AntiVirus engines on VirusTotal as malicious |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Performs some HTTP requests |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Queries for the computername |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (9cnts) ?
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x104c014 GetCommandLineA
0x104c018 GetEnvironmentVariableA
0x104c01c GetTempPathA
0x104c020 GetWindowsDirectoryA
0x104c024 GetCurrentDirectoryA
0x104c028 SetFileAttributesA
0x104c02c SetSystemPowerState
0x104c030 SetConsoleCP
0x104c034 WriteConsoleW
0x104c038 HeapReAlloc
0x104c03c CreateProcessA
0x104c040 GetFileSizeEx
0x104c044 GetStringTypeW
0x104c048 FlushFileBuffers
0x104c04c GetProcessHeap
0x104c050 FreeEnvironmentStringsW
0x104c054 GetEnvironmentStringsW
0x104c058 WideCharToMultiByte
0x104c05c GetCommandLineW
0x104c060 GetCPInfo
0x104c064 GetModuleFileNameA
0x104c068 FormatMessageA
0x104c06c GetSystemTimeAsFileTime
0x104c070 HeapSize
0x104c074 VirtualProtect
0x104c078 GetOEMCP
0x104c07c GetACP
0x104c080 IsValidCodePage
0x104c084 FindNextFileW
0x104c088 FindFirstFileExW
0x104c08c FindClose
0x104c090 SetFilePointerEx
0x104c094 SetEndOfFile
0x104c098 MultiByteToWideChar
0x104c09c GetConsoleCP
0x104c0a0 UnhandledExceptionFilter
0x104c0a4 SetUnhandledExceptionFilter
0x104c0a8 GetCurrentProcess
0x104c0ac TerminateProcess
0x104c0b0 IsProcessorFeaturePresent
0x104c0b4 QueryPerformanceCounter
0x104c0b8 GetCurrentProcessId
0x104c0bc GetCurrentThreadId
0x104c0c0 InitializeSListHead
0x104c0c4 IsDebuggerPresent
0x104c0c8 GetStartupInfoW
0x104c0cc GetModuleHandleW
0x104c0d0 RaiseException
0x104c0d4 RtlUnwind
0x104c0d8 InterlockedFlushSList
0x104c0dc GetLastError
0x104c0e0 SetLastError
0x104c0e4 EncodePointer
0x104c0e8 EnterCriticalSection
0x104c0ec LeaveCriticalSection
0x104c0f0 DeleteCriticalSection
0x104c0f4 InitializeCriticalSectionAndSpinCount
0x104c0f8 TlsAlloc
0x104c0fc TlsGetValue
0x104c100 TlsSetValue
0x104c104 TlsFree
0x104c108 FreeLibrary
0x104c10c GetProcAddress
0x104c110 LoadLibraryExW
0x104c114 CloseHandle
0x104c118 CreateFileW
0x104c11c GetFileType
0x104c120 ExitProcess
0x104c124 GetModuleHandleExW
0x104c128 GetModuleFileNameW
0x104c12c HeapAlloc
0x104c130 HeapFree
0x104c134 LCMapStringW
0x104c138 GetLocaleInfoW
0x104c13c IsValidLocale
0x104c140 GetUserDefaultLCID
0x104c144 EnumSystemLocalesW
0x104c148 GetStdHandle
0x104c14c ReadFile
0x104c150 GetConsoleMode
0x104c154 ReadConsoleW
0x104c158 SetStdHandle
0x104c15c WriteFile
0x104c160 DecodePointer
USER32.dll
0x104c168 ValidateRect
0x104c16c MapWindowPoints
0x104c170 PostMessageW
0x104c174 EmptyClipboard
0x104c178 GetSystemMetrics
0x104c17c DestroyMenu
0x104c180 BeginPaint
0x104c184 InvalidateRect
ole32.dll
0x104c1b4 CoTaskMemAlloc
0x104c1b8 CoTaskMemFree
0x104c1bc CoInitialize
0x104c1c0 CoUninitialize
ADVAPI32.dll
0x104c000 RegOpenKeyExA
0x104c004 RegCreateKeyA
0x104c008 RegCloseKey
0x104c00c RegQueryValueExA
WS2_32.dll
0x104c198 WSACloseEvent
0x104c19c WSASocketA
0x104c1a0 WSAConnect
0x104c1a4 WSACleanup
0x104c1a8 WSAStartup
0x104c1ac WSAWaitForMultipleEvents
UxTheme.dll
0x104c18c GetThemeFont
0x104c190 CloseThemeData
EAT(Export Address Table) Library
0x102a030 Fatreply
0x1028d80 Periodwait
0x102a340 Seemprove
0x102a0f0 Which
KERNEL32.dll
0x104c014 GetCommandLineA
0x104c018 GetEnvironmentVariableA
0x104c01c GetTempPathA
0x104c020 GetWindowsDirectoryA
0x104c024 GetCurrentDirectoryA
0x104c028 SetFileAttributesA
0x104c02c SetSystemPowerState
0x104c030 SetConsoleCP
0x104c034 WriteConsoleW
0x104c038 HeapReAlloc
0x104c03c CreateProcessA
0x104c040 GetFileSizeEx
0x104c044 GetStringTypeW
0x104c048 FlushFileBuffers
0x104c04c GetProcessHeap
0x104c050 FreeEnvironmentStringsW
0x104c054 GetEnvironmentStringsW
0x104c058 WideCharToMultiByte
0x104c05c GetCommandLineW
0x104c060 GetCPInfo
0x104c064 GetModuleFileNameA
0x104c068 FormatMessageA
0x104c06c GetSystemTimeAsFileTime
0x104c070 HeapSize
0x104c074 VirtualProtect
0x104c078 GetOEMCP
0x104c07c GetACP
0x104c080 IsValidCodePage
0x104c084 FindNextFileW
0x104c088 FindFirstFileExW
0x104c08c FindClose
0x104c090 SetFilePointerEx
0x104c094 SetEndOfFile
0x104c098 MultiByteToWideChar
0x104c09c GetConsoleCP
0x104c0a0 UnhandledExceptionFilter
0x104c0a4 SetUnhandledExceptionFilter
0x104c0a8 GetCurrentProcess
0x104c0ac TerminateProcess
0x104c0b0 IsProcessorFeaturePresent
0x104c0b4 QueryPerformanceCounter
0x104c0b8 GetCurrentProcessId
0x104c0bc GetCurrentThreadId
0x104c0c0 InitializeSListHead
0x104c0c4 IsDebuggerPresent
0x104c0c8 GetStartupInfoW
0x104c0cc GetModuleHandleW
0x104c0d0 RaiseException
0x104c0d4 RtlUnwind
0x104c0d8 InterlockedFlushSList
0x104c0dc GetLastError
0x104c0e0 SetLastError
0x104c0e4 EncodePointer
0x104c0e8 EnterCriticalSection
0x104c0ec LeaveCriticalSection
0x104c0f0 DeleteCriticalSection
0x104c0f4 InitializeCriticalSectionAndSpinCount
0x104c0f8 TlsAlloc
0x104c0fc TlsGetValue
0x104c100 TlsSetValue
0x104c104 TlsFree
0x104c108 FreeLibrary
0x104c10c GetProcAddress
0x104c110 LoadLibraryExW
0x104c114 CloseHandle
0x104c118 CreateFileW
0x104c11c GetFileType
0x104c120 ExitProcess
0x104c124 GetModuleHandleExW
0x104c128 GetModuleFileNameW
0x104c12c HeapAlloc
0x104c130 HeapFree
0x104c134 LCMapStringW
0x104c138 GetLocaleInfoW
0x104c13c IsValidLocale
0x104c140 GetUserDefaultLCID
0x104c144 EnumSystemLocalesW
0x104c148 GetStdHandle
0x104c14c ReadFile
0x104c150 GetConsoleMode
0x104c154 ReadConsoleW
0x104c158 SetStdHandle
0x104c15c WriteFile
0x104c160 DecodePointer
USER32.dll
0x104c168 ValidateRect
0x104c16c MapWindowPoints
0x104c170 PostMessageW
0x104c174 EmptyClipboard
0x104c178 GetSystemMetrics
0x104c17c DestroyMenu
0x104c180 BeginPaint
0x104c184 InvalidateRect
ole32.dll
0x104c1b4 CoTaskMemAlloc
0x104c1b8 CoTaskMemFree
0x104c1bc CoInitialize
0x104c1c0 CoUninitialize
ADVAPI32.dll
0x104c000 RegOpenKeyExA
0x104c004 RegCreateKeyA
0x104c008 RegCloseKey
0x104c00c RegQueryValueExA
WS2_32.dll
0x104c198 WSACloseEvent
0x104c19c WSASocketA
0x104c1a0 WSAConnect
0x104c1a4 WSACleanup
0x104c1a8 WSAStartup
0x104c1ac WSAWaitForMultipleEvents
UxTheme.dll
0x104c18c GetThemeFont
0x104c190 CloseThemeData
EAT(Export Address Table) Library
0x102a030 Fatreply
0x1028d80 Periodwait
0x102a340 Seemprove
0x102a0f0 Which