ScreenShot
| Created | 2021.07.28 09:32 | Machine | s1_win7_x6401 |
| Filename | file.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 30 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, Graftor, PWSX, Generic@ML, RDML, 0neywbOSO9F5vvsDORvL0A, MultiPlug, ai score=82, Sabsik, score, Artemis, BScope, Static AI, Malicious PE, HLVP, ZexaF, UuW@a8ayH@hI, susgen) | ||
| md5 | 5f0f316459cf8e92f8705124acdbe3e4 | ||
| sha256 | b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13 | ||
| ssdeep | 12288:7n5IQdj9J0t1CIQklyPGt0dPf2OgiCjwnRl/1T7xu8+3oIa1oDVLBTv5NKrk52mB:7Nut1CIHlgGOgwnTu3zRtTX2kLB | ||
| imphash | c6ebbfd08d361ef29153e4487e25f820 | ||
| impfuzzy | 48:Omz4ezOYh1sgZD4T3YsFO8tfKaEO26c+x0STXr/zBY:OmjikH1OoSvtfEO26c+ySTXr/2 | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42b000 GetVolumeNameForVolumeMountPointA
0x42b004 GetComputerNameA
0x42b008 UnregisterWait
0x42b00c GetFileSize
0x42b010 SetFilePointer
0x42b014 lstrlenA
0x42b018 GetConsoleAliasesLengthW
0x42b01c GetConsoleAliasExesA
0x42b020 GetConsoleAliasExesLengthA
0x42b024 MapUserPhysicalPages
0x42b028 FreeLibrary
0x42b02c InterlockedIncrement
0x42b030 InterlockedDecrement
0x42b034 ZombifyActCtx
0x42b038 GlobalLock
0x42b03c GetFileAttributesExA
0x42b040 GetTickCount
0x42b044 GetCommConfig
0x42b048 GenerateConsoleCtrlEvent
0x42b04c SetCommState
0x42b050 SetProcessPriorityBoost
0x42b054 TlsSetValue
0x42b058 GetEnvironmentStrings
0x42b05c FindResourceExA
0x42b060 GlobalAlloc
0x42b064 LoadLibraryW
0x42b068 _hread
0x42b06c GetCalendarInfoA
0x42b070 GetSystemWow64DirectoryW
0x42b074 SetSystemTimeAdjustment
0x42b078 GetSystemWindowsDirectoryA
0x42b07c InitAtomTable
0x42b080 GlobalFlags
0x42b084 GetComputerNameExA
0x42b088 GetConsoleAliasW
0x42b08c GetBinaryTypeA
0x42b090 ReadFile
0x42b094 CompareStringW
0x42b098 SetConsoleTitleA
0x42b09c VirtualUnlock
0x42b0a0 SetCurrentDirectoryA
0x42b0a4 GetStartupInfoA
0x42b0a8 GetCPInfoExW
0x42b0ac VerLanguageNameA
0x42b0b0 SetFirmwareEnvironmentVariableW
0x42b0b4 CreateNamedPipeA
0x42b0b8 WriteProfileSectionA
0x42b0bc SetStdHandle
0x42b0c0 SetComputerNameA
0x42b0c4 VerLanguageNameW
0x42b0c8 GetLocalTime
0x42b0cc LoadLibraryA
0x42b0d0 CreateSemaphoreW
0x42b0d4 Process32NextW
0x42b0d8 CreateIoCompletionPort
0x42b0dc FreeEnvironmentStringsW
0x42b0e0 EnumResourceNamesA
0x42b0e4 WriteProfileStringW
0x42b0e8 BuildCommDCBA
0x42b0ec VirtualProtect
0x42b0f0 GetCurrentDirectoryA
0x42b0f4 _lopen
0x42b0f8 FindAtomW
0x42b0fc GetWindowsDirectoryW
0x42b100 GetVersion
0x42b104 ReadConsoleOutputCharacterW
0x42b108 GetProfileSectionW
0x42b10c LCMapStringW
0x42b110 CopyFileExA
0x42b114 AreFileApisANSI
0x42b118 CommConfigDialogW
0x42b11c DeleteFileA
0x42b120 UnhandledExceptionFilter
0x42b124 SetUnhandledExceptionFilter
0x42b128 GetLastError
0x42b12c WideCharToMultiByte
0x42b130 GetCommandLineA
0x42b134 HeapValidate
0x42b138 IsBadReadPtr
0x42b13c RaiseException
0x42b140 GetModuleHandleW
0x42b144 Sleep
0x42b148 GetProcAddress
0x42b14c ExitProcess
0x42b150 GetModuleFileNameA
0x42b154 WriteFile
0x42b158 GetStdHandle
0x42b15c TerminateProcess
0x42b160 GetCurrentProcess
0x42b164 IsDebuggerPresent
0x42b168 GetModuleFileNameW
0x42b16c GetACP
0x42b170 GetOEMCP
0x42b174 GetCPInfo
0x42b178 IsValidCodePage
0x42b17c TlsGetValue
0x42b180 TlsAlloc
0x42b184 GetCurrentThreadId
0x42b188 TlsFree
0x42b18c SetLastError
0x42b190 EnterCriticalSection
0x42b194 LeaveCriticalSection
0x42b198 DeleteCriticalSection
0x42b19c SetHandleCount
0x42b1a0 GetFileType
0x42b1a4 QueryPerformanceCounter
0x42b1a8 GetCurrentProcessId
0x42b1ac GetSystemTimeAsFileTime
0x42b1b0 FreeEnvironmentStringsA
0x42b1b4 GetEnvironmentStringsW
0x42b1b8 HeapDestroy
0x42b1bc HeapCreate
0x42b1c0 HeapFree
0x42b1c4 VirtualFree
0x42b1c8 HeapAlloc
0x42b1cc HeapSize
0x42b1d0 HeapReAlloc
0x42b1d4 VirtualAlloc
0x42b1d8 InitializeCriticalSectionAndSpinCount
0x42b1dc DebugBreak
0x42b1e0 OutputDebugStringA
0x42b1e4 WriteConsoleW
0x42b1e8 OutputDebugStringW
0x42b1ec RtlUnwind
0x42b1f0 MultiByteToWideChar
0x42b1f4 LCMapStringA
0x42b1f8 GetStringTypeA
0x42b1fc GetStringTypeW
0x42b200 GetLocaleInfoA
0x42b204 GetConsoleCP
0x42b208 GetConsoleMode
0x42b20c FlushFileBuffers
0x42b210 WriteConsoleA
0x42b214 GetConsoleOutputCP
0x42b218 CloseHandle
0x42b21c CreateFileA
0x42b220 GetModuleHandleA
USER32.dll
0x42b228 GetMessageTime
0x42b22c GetMenuInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x42b000 GetVolumeNameForVolumeMountPointA
0x42b004 GetComputerNameA
0x42b008 UnregisterWait
0x42b00c GetFileSize
0x42b010 SetFilePointer
0x42b014 lstrlenA
0x42b018 GetConsoleAliasesLengthW
0x42b01c GetConsoleAliasExesA
0x42b020 GetConsoleAliasExesLengthA
0x42b024 MapUserPhysicalPages
0x42b028 FreeLibrary
0x42b02c InterlockedIncrement
0x42b030 InterlockedDecrement
0x42b034 ZombifyActCtx
0x42b038 GlobalLock
0x42b03c GetFileAttributesExA
0x42b040 GetTickCount
0x42b044 GetCommConfig
0x42b048 GenerateConsoleCtrlEvent
0x42b04c SetCommState
0x42b050 SetProcessPriorityBoost
0x42b054 TlsSetValue
0x42b058 GetEnvironmentStrings
0x42b05c FindResourceExA
0x42b060 GlobalAlloc
0x42b064 LoadLibraryW
0x42b068 _hread
0x42b06c GetCalendarInfoA
0x42b070 GetSystemWow64DirectoryW
0x42b074 SetSystemTimeAdjustment
0x42b078 GetSystemWindowsDirectoryA
0x42b07c InitAtomTable
0x42b080 GlobalFlags
0x42b084 GetComputerNameExA
0x42b088 GetConsoleAliasW
0x42b08c GetBinaryTypeA
0x42b090 ReadFile
0x42b094 CompareStringW
0x42b098 SetConsoleTitleA
0x42b09c VirtualUnlock
0x42b0a0 SetCurrentDirectoryA
0x42b0a4 GetStartupInfoA
0x42b0a8 GetCPInfoExW
0x42b0ac VerLanguageNameA
0x42b0b0 SetFirmwareEnvironmentVariableW
0x42b0b4 CreateNamedPipeA
0x42b0b8 WriteProfileSectionA
0x42b0bc SetStdHandle
0x42b0c0 SetComputerNameA
0x42b0c4 VerLanguageNameW
0x42b0c8 GetLocalTime
0x42b0cc LoadLibraryA
0x42b0d0 CreateSemaphoreW
0x42b0d4 Process32NextW
0x42b0d8 CreateIoCompletionPort
0x42b0dc FreeEnvironmentStringsW
0x42b0e0 EnumResourceNamesA
0x42b0e4 WriteProfileStringW
0x42b0e8 BuildCommDCBA
0x42b0ec VirtualProtect
0x42b0f0 GetCurrentDirectoryA
0x42b0f4 _lopen
0x42b0f8 FindAtomW
0x42b0fc GetWindowsDirectoryW
0x42b100 GetVersion
0x42b104 ReadConsoleOutputCharacterW
0x42b108 GetProfileSectionW
0x42b10c LCMapStringW
0x42b110 CopyFileExA
0x42b114 AreFileApisANSI
0x42b118 CommConfigDialogW
0x42b11c DeleteFileA
0x42b120 UnhandledExceptionFilter
0x42b124 SetUnhandledExceptionFilter
0x42b128 GetLastError
0x42b12c WideCharToMultiByte
0x42b130 GetCommandLineA
0x42b134 HeapValidate
0x42b138 IsBadReadPtr
0x42b13c RaiseException
0x42b140 GetModuleHandleW
0x42b144 Sleep
0x42b148 GetProcAddress
0x42b14c ExitProcess
0x42b150 GetModuleFileNameA
0x42b154 WriteFile
0x42b158 GetStdHandle
0x42b15c TerminateProcess
0x42b160 GetCurrentProcess
0x42b164 IsDebuggerPresent
0x42b168 GetModuleFileNameW
0x42b16c GetACP
0x42b170 GetOEMCP
0x42b174 GetCPInfo
0x42b178 IsValidCodePage
0x42b17c TlsGetValue
0x42b180 TlsAlloc
0x42b184 GetCurrentThreadId
0x42b188 TlsFree
0x42b18c SetLastError
0x42b190 EnterCriticalSection
0x42b194 LeaveCriticalSection
0x42b198 DeleteCriticalSection
0x42b19c SetHandleCount
0x42b1a0 GetFileType
0x42b1a4 QueryPerformanceCounter
0x42b1a8 GetCurrentProcessId
0x42b1ac GetSystemTimeAsFileTime
0x42b1b0 FreeEnvironmentStringsA
0x42b1b4 GetEnvironmentStringsW
0x42b1b8 HeapDestroy
0x42b1bc HeapCreate
0x42b1c0 HeapFree
0x42b1c4 VirtualFree
0x42b1c8 HeapAlloc
0x42b1cc HeapSize
0x42b1d0 HeapReAlloc
0x42b1d4 VirtualAlloc
0x42b1d8 InitializeCriticalSectionAndSpinCount
0x42b1dc DebugBreak
0x42b1e0 OutputDebugStringA
0x42b1e4 WriteConsoleW
0x42b1e8 OutputDebugStringW
0x42b1ec RtlUnwind
0x42b1f0 MultiByteToWideChar
0x42b1f4 LCMapStringA
0x42b1f8 GetStringTypeA
0x42b1fc GetStringTypeW
0x42b200 GetLocaleInfoA
0x42b204 GetConsoleCP
0x42b208 GetConsoleMode
0x42b20c FlushFileBuffers
0x42b210 WriteConsoleA
0x42b214 GetConsoleOutputCP
0x42b218 CloseHandle
0x42b21c CreateFileA
0x42b220 GetModuleHandleA
USER32.dll
0x42b228 GetMessageTime
0x42b22c GetMenuInfo
EAT(Export Address Table) is none