ScreenShot
| Created | 2021.07.29 11:14 | Machine | s1_win7_x6401 |
| Filename | Bendor.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetect, malware1, malicious, high confidence, Artemis, Save, confidence, 100%, Attribute, HighConfidence, Kryptik, HLWH, Fragtor, FileRepMalware, CLASSIC, susgen, Azorult, score, ZexaF, LuW@aqC7tBhG, ai score=89, BScope, Static AI, Malicious PE, Unsafe, HwoC5VsA) | ||
| md5 | fe3acb1ca7cdc3be9e5c823560285d43 | ||
| sha256 | 4b4a923961f79b7d86fb67f94bc615be3ed2f204cb02d8da9b313e60fa7afc20 | ||
| ssdeep | 12288:NGq1GEXJQ4PdDUzCmd4TSU4339e0StlbFclZ1Lr+7gYEnMHwyzW3J4W05kEphY3c:NNGEXJQ4PdDURd2XclZ1LrdYEnMPzk4n | ||
| imphash | 613f2e4a97d34083c947d866c86b0b7d | ||
| impfuzzy | 48:MZzCFwOYoJdplhwW4pMYsFOWKaE8fcRhV85oceLXk7BY:MZyLplaVXSbE8fcRhV85leLXkO | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| watch | Tries to unhook Windows functions monitored by Cuckoo |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421000 GetComputerNameA
0x421004 UnregisterWait
0x421008 SetFilePointer
0x42100c lstrlenA
0x421010 GetConsoleAliasesLengthW
0x421014 CopyFileExW
0x421018 TlsGetValue
0x42101c GetConsoleAliasExesLengthA
0x421020 MapUserPhysicalPages
0x421024 InterlockedIncrement
0x421028 VerSetConditionMask
0x42102c InterlockedDecrement
0x421030 ZombifyActCtx
0x421034 CompareFileTime
0x421038 GetSystemWindowsDirectoryW
0x42103c SetEnvironmentVariableW
0x421040 GlobalLock
0x421044 WriteConsoleInputA
0x421048 FreeEnvironmentStringsA
0x42104c CreateNamedPipeW
0x421050 VirtualFree
0x421054 GenerateConsoleCtrlEvent
0x421058 GetConsoleAliasExesW
0x42105c WriteFile
0x421060 SetCommState
0x421064 SetProcessPriorityBoost
0x421068 FindResourceExA
0x42106c LoadLibraryW
0x421070 GetCalendarInfoA
0x421074 GetVersionExW
0x421078 InitAtomTable
0x42107c GlobalFlags
0x421080 GetComputerNameExA
0x421084 GetConsoleAliasW
0x421088 SetConsoleCursorPosition
0x42108c GetBinaryTypeW
0x421090 VirtualUnlock
0x421094 InterlockedExchange
0x421098 GetFileSizeEx
0x42109c SetCurrentDirectoryA
0x4210a0 GetStartupInfoA
0x4210a4 GetCPInfoExW
0x4210a8 FreeLibraryAndExitThread
0x4210ac GetCurrentDirectoryW
0x4210b0 ReadConsoleOutputCharacterA
0x4210b4 GetProcAddress
0x4210b8 SetFirmwareEnvironmentVariableW
0x4210bc ReadFileEx
0x4210c0 SetStdHandle
0x4210c4 SetComputerNameA
0x4210c8 GetLocalTime
0x4210cc LoadLibraryA
0x4210d0 OpenMutexA
0x4210d4 CreateSemaphoreW
0x4210d8 LocalAlloc
0x4210dc WriteProfileSectionW
0x4210e0 FindAtomA
0x4210e4 SetSystemTime
0x4210e8 CreateIoCompletionPort
0x4210ec SetConsoleTitleW
0x4210f0 EnumResourceNamesA
0x4210f4 WriteProfileStringW
0x4210f8 BuildCommDCBA
0x4210fc CompareStringA
0x421100 GetFileAttributesExW
0x421104 GetConsoleCursorInfo
0x421108 GetCPInfoExA
0x42110c _lopen
0x421110 FindAtomW
0x421114 GetVolumeNameForVolumeMountPointW
0x421118 GetProfileSectionW
0x42111c AreFileApisANSI
0x421120 CommConfigDialogW
0x421124 DeleteFileA
0x421128 FlushFileBuffers
0x42112c GetLastError
0x421130 MoveFileA
0x421134 GetCommandLineA
0x421138 HeapValidate
0x42113c IsBadReadPtr
0x421140 RaiseException
0x421144 DeleteCriticalSection
0x421148 EnterCriticalSection
0x42114c LeaveCriticalSection
0x421150 GetModuleFileNameW
0x421154 SetUnhandledExceptionFilter
0x421158 QueryPerformanceCounter
0x42115c GetTickCount
0x421160 GetCurrentThreadId
0x421164 GetCurrentProcessId
0x421168 GetSystemTimeAsFileTime
0x42116c GetModuleHandleW
0x421170 Sleep
0x421174 ExitProcess
0x421178 GetModuleFileNameA
0x42117c GetEnvironmentStrings
0x421180 FreeEnvironmentStringsW
0x421184 WideCharToMultiByte
0x421188 GetEnvironmentStringsW
0x42118c SetHandleCount
0x421190 GetStdHandle
0x421194 GetFileType
0x421198 TlsAlloc
0x42119c TlsSetValue
0x4211a0 TlsFree
0x4211a4 SetLastError
0x4211a8 HeapDestroy
0x4211ac HeapCreate
0x4211b0 HeapFree
0x4211b4 HeapAlloc
0x4211b8 TerminateProcess
0x4211bc GetCurrentProcess
0x4211c0 UnhandledExceptionFilter
0x4211c4 IsDebuggerPresent
0x4211c8 HeapSize
0x4211cc HeapReAlloc
0x4211d0 VirtualAlloc
0x4211d4 GetACP
0x4211d8 GetOEMCP
0x4211dc GetCPInfo
0x4211e0 IsValidCodePage
0x4211e4 RtlUnwind
0x4211e8 InitializeCriticalSectionAndSpinCount
0x4211ec DebugBreak
0x4211f0 OutputDebugStringA
0x4211f4 WriteConsoleW
0x4211f8 OutputDebugStringW
0x4211fc MultiByteToWideChar
0x421200 LCMapStringA
0x421204 LCMapStringW
0x421208 GetStringTypeA
0x42120c GetStringTypeW
0x421210 GetLocaleInfoA
0x421214 GetConsoleCP
0x421218 GetConsoleMode
0x42121c WriteConsoleA
0x421220 GetConsoleOutputCP
0x421224 CreateFileA
0x421228 CloseHandle
0x42122c GetModuleHandleA
USER32.dll
0x421234 GetMessageTime
0x421238 GetMenuInfo
EAT(Export Address Table) is none
KERNEL32.dll
0x421000 GetComputerNameA
0x421004 UnregisterWait
0x421008 SetFilePointer
0x42100c lstrlenA
0x421010 GetConsoleAliasesLengthW
0x421014 CopyFileExW
0x421018 TlsGetValue
0x42101c GetConsoleAliasExesLengthA
0x421020 MapUserPhysicalPages
0x421024 InterlockedIncrement
0x421028 VerSetConditionMask
0x42102c InterlockedDecrement
0x421030 ZombifyActCtx
0x421034 CompareFileTime
0x421038 GetSystemWindowsDirectoryW
0x42103c SetEnvironmentVariableW
0x421040 GlobalLock
0x421044 WriteConsoleInputA
0x421048 FreeEnvironmentStringsA
0x42104c CreateNamedPipeW
0x421050 VirtualFree
0x421054 GenerateConsoleCtrlEvent
0x421058 GetConsoleAliasExesW
0x42105c WriteFile
0x421060 SetCommState
0x421064 SetProcessPriorityBoost
0x421068 FindResourceExA
0x42106c LoadLibraryW
0x421070 GetCalendarInfoA
0x421074 GetVersionExW
0x421078 InitAtomTable
0x42107c GlobalFlags
0x421080 GetComputerNameExA
0x421084 GetConsoleAliasW
0x421088 SetConsoleCursorPosition
0x42108c GetBinaryTypeW
0x421090 VirtualUnlock
0x421094 InterlockedExchange
0x421098 GetFileSizeEx
0x42109c SetCurrentDirectoryA
0x4210a0 GetStartupInfoA
0x4210a4 GetCPInfoExW
0x4210a8 FreeLibraryAndExitThread
0x4210ac GetCurrentDirectoryW
0x4210b0 ReadConsoleOutputCharacterA
0x4210b4 GetProcAddress
0x4210b8 SetFirmwareEnvironmentVariableW
0x4210bc ReadFileEx
0x4210c0 SetStdHandle
0x4210c4 SetComputerNameA
0x4210c8 GetLocalTime
0x4210cc LoadLibraryA
0x4210d0 OpenMutexA
0x4210d4 CreateSemaphoreW
0x4210d8 LocalAlloc
0x4210dc WriteProfileSectionW
0x4210e0 FindAtomA
0x4210e4 SetSystemTime
0x4210e8 CreateIoCompletionPort
0x4210ec SetConsoleTitleW
0x4210f0 EnumResourceNamesA
0x4210f4 WriteProfileStringW
0x4210f8 BuildCommDCBA
0x4210fc CompareStringA
0x421100 GetFileAttributesExW
0x421104 GetConsoleCursorInfo
0x421108 GetCPInfoExA
0x42110c _lopen
0x421110 FindAtomW
0x421114 GetVolumeNameForVolumeMountPointW
0x421118 GetProfileSectionW
0x42111c AreFileApisANSI
0x421120 CommConfigDialogW
0x421124 DeleteFileA
0x421128 FlushFileBuffers
0x42112c GetLastError
0x421130 MoveFileA
0x421134 GetCommandLineA
0x421138 HeapValidate
0x42113c IsBadReadPtr
0x421140 RaiseException
0x421144 DeleteCriticalSection
0x421148 EnterCriticalSection
0x42114c LeaveCriticalSection
0x421150 GetModuleFileNameW
0x421154 SetUnhandledExceptionFilter
0x421158 QueryPerformanceCounter
0x42115c GetTickCount
0x421160 GetCurrentThreadId
0x421164 GetCurrentProcessId
0x421168 GetSystemTimeAsFileTime
0x42116c GetModuleHandleW
0x421170 Sleep
0x421174 ExitProcess
0x421178 GetModuleFileNameA
0x42117c GetEnvironmentStrings
0x421180 FreeEnvironmentStringsW
0x421184 WideCharToMultiByte
0x421188 GetEnvironmentStringsW
0x42118c SetHandleCount
0x421190 GetStdHandle
0x421194 GetFileType
0x421198 TlsAlloc
0x42119c TlsSetValue
0x4211a0 TlsFree
0x4211a4 SetLastError
0x4211a8 HeapDestroy
0x4211ac HeapCreate
0x4211b0 HeapFree
0x4211b4 HeapAlloc
0x4211b8 TerminateProcess
0x4211bc GetCurrentProcess
0x4211c0 UnhandledExceptionFilter
0x4211c4 IsDebuggerPresent
0x4211c8 HeapSize
0x4211cc HeapReAlloc
0x4211d0 VirtualAlloc
0x4211d4 GetACP
0x4211d8 GetOEMCP
0x4211dc GetCPInfo
0x4211e0 IsValidCodePage
0x4211e4 RtlUnwind
0x4211e8 InitializeCriticalSectionAndSpinCount
0x4211ec DebugBreak
0x4211f0 OutputDebugStringA
0x4211f4 WriteConsoleW
0x4211f8 OutputDebugStringW
0x4211fc MultiByteToWideChar
0x421200 LCMapStringA
0x421204 LCMapStringW
0x421208 GetStringTypeA
0x42120c GetStringTypeW
0x421210 GetLocaleInfoA
0x421214 GetConsoleCP
0x421218 GetConsoleMode
0x42121c WriteConsoleA
0x421220 GetConsoleOutputCP
0x421224 CreateFileA
0x421228 CloseHandle
0x42122c GetModuleHandleA
USER32.dll
0x421234 GetMessageTime
0x421238 GetMenuInfo
EAT(Export Address Table) is none