ScreenShot
| Created | 2021.07.26 09:51 | Machine | s1_win7_x6401 |
| Filename | lipster.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 24 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, Kryptik, Eldorado, Attribute, HighConfidence, HLVE, CLASSIC, Mokes, Wacatac, score, Artemis, BScope, Static AI, Malicious PE, ZexaF, yuW@a4OSCNpG, confidence, 100%) | ||
| md5 | 97e8e525e2fc27c2634da7d235f5ff5c | ||
| sha256 | 0a9ff0b46182a441c0f9c021722817984ec884266c123d2fd6257f9c70d322ab | ||
| ssdeep | 12288:DcyFrVdwvwFGB3yVywS1B0a7OkeOMSBM:LVdwvwFi1eMeOMiM | ||
| imphash | f072aaf7476b5a5a056c892b505526e0 | ||
| impfuzzy | 48:cZeXODvYnHadf6qpaO/3KKaEZt76c+JUXBr/MNGg:cIe06p6EaseEZt76c+JURr/Mh | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42a000 SetFilePointer
0x42a004 lstrlenA
0x42a008 FindResourceExW
0x42a00c MapUserPhysicalPages
0x42a010 FreeLibrary
0x42a014 InterlockedIncrement
0x42a018 GetCommState
0x42a01c InterlockedDecrement
0x42a020 ZombifyActCtx
0x42a024 SetFirmwareEnvironmentVariableA
0x42a028 GetSystemWindowsDirectoryW
0x42a02c GetNamedPipeHandleStateA
0x42a030 GlobalLock
0x42a034 GetComputerNameW
0x42a038 FreeEnvironmentStringsA
0x42a03c GetProcessPriorityBoost
0x42a040 GetTickCount
0x42a044 GetCommConfig
0x42a048 GetConsoleAliasesLengthA
0x42a04c GetWindowsDirectoryA
0x42a050 GetConsoleAliasExesW
0x42a054 WriteFile
0x42a058 TlsSetValue
0x42a05c GlobalAlloc
0x42a060 VirtualFreeEx
0x42a064 LoadLibraryW
0x42a068 _hread
0x42a06c GetCalendarInfoA
0x42a070 GetSystemWow64DirectoryW
0x42a074 SetSystemTimeAdjustment
0x42a078 InitAtomTable
0x42a07c GlobalFlags
0x42a080 GetComputerNameExA
0x42a084 GetBinaryTypeA
0x42a088 GetAtomNameW
0x42a08c ReadFile
0x42a090 GetSystemDirectoryA
0x42a094 GetBinaryTypeW
0x42a098 ExitThread
0x42a09c DeactivateActCtx
0x42a0a0 CreateDirectoryA
0x42a0a4 ReleaseActCtx
0x42a0a8 GetFileSizeEx
0x42a0ac GetStartupInfoA
0x42a0b0 GetCurrentDirectoryW
0x42a0b4 ReadConsoleOutputCharacterA
0x42a0b8 GetProcAddress
0x42a0bc GetProcessHeaps
0x42a0c0 VerLanguageNameA
0x42a0c4 CreateNamedPipeA
0x42a0c8 SetStdHandle
0x42a0cc SetComputerNameA
0x42a0d0 BuildCommDCBW
0x42a0d4 GetLocalTime
0x42a0d8 LoadLibraryA
0x42a0dc Process32FirstW
0x42a0e0 CreateSemaphoreW
0x42a0e4 SetConsoleCtrlHandler
0x42a0e8 SetCurrentDirectoryW
0x42a0ec WriteProfileSectionW
0x42a0f0 VirtualLock
0x42a0f4 SetConsoleWindowInfo
0x42a0f8 FindAtomA
0x42a0fc WriteProfileStringA
0x42a100 SetConsoleTitleW
0x42a104 VirtualProtect
0x42a108 CompareStringA
0x42a10c GetFileAttributesExW
0x42a110 GetCPInfoExA
0x42a114 _lopen
0x42a118 GetVolumeNameForVolumeMountPointW
0x42a11c DeleteFileW
0x42a120 GetCurrentProcessId
0x42a124 GetProfileSectionW
0x42a128 LCMapStringW
0x42a12c CopyFileExA
0x42a130 CommConfigDialogW
0x42a134 GetModuleHandleA
0x42a138 GetLastError
0x42a13c WideCharToMultiByte
0x42a140 GetCommandLineA
0x42a144 HeapValidate
0x42a148 IsBadReadPtr
0x42a14c RaiseException
0x42a150 TerminateProcess
0x42a154 GetCurrentProcess
0x42a158 UnhandledExceptionFilter
0x42a15c SetUnhandledExceptionFilter
0x42a160 IsDebuggerPresent
0x42a164 GetModuleFileNameW
0x42a168 GetACP
0x42a16c GetOEMCP
0x42a170 GetCPInfo
0x42a174 IsValidCodePage
0x42a178 TlsGetValue
0x42a17c GetModuleHandleW
0x42a180 TlsAlloc
0x42a184 GetCurrentThreadId
0x42a188 TlsFree
0x42a18c SetLastError
0x42a190 EnterCriticalSection
0x42a194 LeaveCriticalSection
0x42a198 DeleteCriticalSection
0x42a19c QueryPerformanceCounter
0x42a1a0 GetSystemTimeAsFileTime
0x42a1a4 Sleep
0x42a1a8 ExitProcess
0x42a1ac GetModuleFileNameA
0x42a1b0 GetEnvironmentStrings
0x42a1b4 FreeEnvironmentStringsW
0x42a1b8 GetEnvironmentStringsW
0x42a1bc SetHandleCount
0x42a1c0 GetStdHandle
0x42a1c4 GetFileType
0x42a1c8 HeapDestroy
0x42a1cc HeapCreate
0x42a1d0 HeapFree
0x42a1d4 VirtualFree
0x42a1d8 HeapAlloc
0x42a1dc HeapSize
0x42a1e0 HeapReAlloc
0x42a1e4 VirtualAlloc
0x42a1e8 DebugBreak
0x42a1ec OutputDebugStringA
0x42a1f0 WriteConsoleW
0x42a1f4 OutputDebugStringW
0x42a1f8 RtlUnwind
0x42a1fc MultiByteToWideChar
0x42a200 LCMapStringA
0x42a204 GetStringTypeA
0x42a208 GetStringTypeW
0x42a20c GetLocaleInfoA
0x42a210 GetConsoleCP
0x42a214 GetConsoleMode
0x42a218 InitializeCriticalSectionAndSpinCount
0x42a21c FlushFileBuffers
0x42a220 WriteConsoleA
0x42a224 GetConsoleOutputCP
0x42a228 CloseHandle
0x42a22c CreateFileA
USER32.dll
0x42a234 GetMenuInfo
0x42a238 GetListBoxInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x42a000 SetFilePointer
0x42a004 lstrlenA
0x42a008 FindResourceExW
0x42a00c MapUserPhysicalPages
0x42a010 FreeLibrary
0x42a014 InterlockedIncrement
0x42a018 GetCommState
0x42a01c InterlockedDecrement
0x42a020 ZombifyActCtx
0x42a024 SetFirmwareEnvironmentVariableA
0x42a028 GetSystemWindowsDirectoryW
0x42a02c GetNamedPipeHandleStateA
0x42a030 GlobalLock
0x42a034 GetComputerNameW
0x42a038 FreeEnvironmentStringsA
0x42a03c GetProcessPriorityBoost
0x42a040 GetTickCount
0x42a044 GetCommConfig
0x42a048 GetConsoleAliasesLengthA
0x42a04c GetWindowsDirectoryA
0x42a050 GetConsoleAliasExesW
0x42a054 WriteFile
0x42a058 TlsSetValue
0x42a05c GlobalAlloc
0x42a060 VirtualFreeEx
0x42a064 LoadLibraryW
0x42a068 _hread
0x42a06c GetCalendarInfoA
0x42a070 GetSystemWow64DirectoryW
0x42a074 SetSystemTimeAdjustment
0x42a078 InitAtomTable
0x42a07c GlobalFlags
0x42a080 GetComputerNameExA
0x42a084 GetBinaryTypeA
0x42a088 GetAtomNameW
0x42a08c ReadFile
0x42a090 GetSystemDirectoryA
0x42a094 GetBinaryTypeW
0x42a098 ExitThread
0x42a09c DeactivateActCtx
0x42a0a0 CreateDirectoryA
0x42a0a4 ReleaseActCtx
0x42a0a8 GetFileSizeEx
0x42a0ac GetStartupInfoA
0x42a0b0 GetCurrentDirectoryW
0x42a0b4 ReadConsoleOutputCharacterA
0x42a0b8 GetProcAddress
0x42a0bc GetProcessHeaps
0x42a0c0 VerLanguageNameA
0x42a0c4 CreateNamedPipeA
0x42a0c8 SetStdHandle
0x42a0cc SetComputerNameA
0x42a0d0 BuildCommDCBW
0x42a0d4 GetLocalTime
0x42a0d8 LoadLibraryA
0x42a0dc Process32FirstW
0x42a0e0 CreateSemaphoreW
0x42a0e4 SetConsoleCtrlHandler
0x42a0e8 SetCurrentDirectoryW
0x42a0ec WriteProfileSectionW
0x42a0f0 VirtualLock
0x42a0f4 SetConsoleWindowInfo
0x42a0f8 FindAtomA
0x42a0fc WriteProfileStringA
0x42a100 SetConsoleTitleW
0x42a104 VirtualProtect
0x42a108 CompareStringA
0x42a10c GetFileAttributesExW
0x42a110 GetCPInfoExA
0x42a114 _lopen
0x42a118 GetVolumeNameForVolumeMountPointW
0x42a11c DeleteFileW
0x42a120 GetCurrentProcessId
0x42a124 GetProfileSectionW
0x42a128 LCMapStringW
0x42a12c CopyFileExA
0x42a130 CommConfigDialogW
0x42a134 GetModuleHandleA
0x42a138 GetLastError
0x42a13c WideCharToMultiByte
0x42a140 GetCommandLineA
0x42a144 HeapValidate
0x42a148 IsBadReadPtr
0x42a14c RaiseException
0x42a150 TerminateProcess
0x42a154 GetCurrentProcess
0x42a158 UnhandledExceptionFilter
0x42a15c SetUnhandledExceptionFilter
0x42a160 IsDebuggerPresent
0x42a164 GetModuleFileNameW
0x42a168 GetACP
0x42a16c GetOEMCP
0x42a170 GetCPInfo
0x42a174 IsValidCodePage
0x42a178 TlsGetValue
0x42a17c GetModuleHandleW
0x42a180 TlsAlloc
0x42a184 GetCurrentThreadId
0x42a188 TlsFree
0x42a18c SetLastError
0x42a190 EnterCriticalSection
0x42a194 LeaveCriticalSection
0x42a198 DeleteCriticalSection
0x42a19c QueryPerformanceCounter
0x42a1a0 GetSystemTimeAsFileTime
0x42a1a4 Sleep
0x42a1a8 ExitProcess
0x42a1ac GetModuleFileNameA
0x42a1b0 GetEnvironmentStrings
0x42a1b4 FreeEnvironmentStringsW
0x42a1b8 GetEnvironmentStringsW
0x42a1bc SetHandleCount
0x42a1c0 GetStdHandle
0x42a1c4 GetFileType
0x42a1c8 HeapDestroy
0x42a1cc HeapCreate
0x42a1d0 HeapFree
0x42a1d4 VirtualFree
0x42a1d8 HeapAlloc
0x42a1dc HeapSize
0x42a1e0 HeapReAlloc
0x42a1e4 VirtualAlloc
0x42a1e8 DebugBreak
0x42a1ec OutputDebugStringA
0x42a1f0 WriteConsoleW
0x42a1f4 OutputDebugStringW
0x42a1f8 RtlUnwind
0x42a1fc MultiByteToWideChar
0x42a200 LCMapStringA
0x42a204 GetStringTypeA
0x42a208 GetStringTypeW
0x42a20c GetLocaleInfoA
0x42a210 GetConsoleCP
0x42a214 GetConsoleMode
0x42a218 InitializeCriticalSectionAndSpinCount
0x42a21c FlushFileBuffers
0x42a220 WriteConsoleA
0x42a224 GetConsoleOutputCP
0x42a228 CloseHandle
0x42a22c CreateFileA
USER32.dll
0x42a234 GetMenuInfo
0x42a238 GetListBoxInfo
EAT(Export Address Table) is none