ScreenShot
| Created | 2021.07.30 10:28 | Machine | s1_win7_x6401 |
| Filename | ksvchost.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 25 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, ZexaF, lzW@aGTQzWlG, FileRepMetagen, Lockbit, Score, Azorult, Artemis, Kryptik, CLASSIC, Static AI, Malicious PE, susgen, GenKryptik, FIDC, confidence, 100%, QVM10) | ||
| md5 | 0f9f7906389dee17c4606dd2cad2d214 | ||
| sha256 | 97e08f5f3864085eec56de1fc9663eb42761be09df31592034760a3a243ced28 | ||
| ssdeep | 24576:oL7Kps0PJFtwxJp4u3r/KXfrxE7ZWR2Rp3FoiBqNZsH:2eRwZV7/KO7YXi | ||
| imphash | 6609a790c95d93752d6f03b3682a0f6d | ||
| impfuzzy | 48:hVPBHMYVdPYEQIIsOSYExKaEBcU9ftfV85ZbXCP:hPP/pIsmYEBcCftfV85ZbXCP | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 25 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x421008 UnregisterWait
0x42100c GetFileSize
0x421010 GetNativeSystemInfo
0x421014 SetFilePointer
0x421018 GetConsoleAliasesLengthW
0x42101c CopyFileExW
0x421020 SetLocalTime
0x421024 InterlockedIncrement
0x421028 VerSetConditionMask
0x42102c InterlockedDecrement
0x421030 ZombifyActCtx
0x421034 CompareFileTime
0x421038 GetSystemWindowsDirectoryW
0x42103c SetEnvironmentVariableW
0x421040 GlobalLock
0x421044 SetConsoleScreenBufferSize
0x421048 WriteConsoleInputA
0x42104c SetComputerNameW
0x421050 FreeEnvironmentStringsA
0x421054 VirtualFree
0x421058 SetProcessPriorityBoost
0x42105c FindResourceExA
0x421060 GetConsoleAliasExesLengthW
0x421064 GetComputerNameExA
0x421068 CreateSemaphoreA
0x42106c GetFileAttributesW
0x421070 GetBinaryTypeA
0x421074 ReadFile
0x421078 EnumResourceNamesW
0x42107c CompareStringW
0x421080 lstrlenW
0x421084 InterlockedExchange
0x421088 SetCurrentDirectoryA
0x42108c GetStartupInfoA
0x421090 GetCPInfoExW
0x421094 OpenMutexW
0x421098 GetCurrentDirectoryW
0x42109c GetProcAddress
0x4210a0 CreateNamedPipeA
0x4210a4 WriteProfileSectionA
0x4210a8 ReadFileEx
0x4210ac SetStdHandle
0x4210b0 DisableThreadLibraryCalls
0x4210b4 GetPrivateProfileStringA
0x4210b8 LoadLibraryA
0x4210bc GetConsoleScreenBufferInfo
0x4210c0 LocalAlloc
0x4210c4 PostQueuedCompletionStatus
0x4210c8 FindAtomA
0x4210cc WriteProfileStringW
0x4210d0 FatalAppExitA
0x4210d4 GetVersionExA
0x4210d8 TlsAlloc
0x4210dc DeleteFileW
0x4210e0 LCMapStringW
0x4210e4 AreFileApisANSI
0x4210e8 GetOverlappedResult
0x4210ec GetComputerNameA
0x4210f0 GetLastError
0x4210f4 MoveFileA
0x4210f8 GetCommandLineA
0x4210fc HeapValidate
0x421100 IsBadReadPtr
0x421104 RaiseException
0x421108 EnterCriticalSection
0x42110c LeaveCriticalSection
0x421110 SetHandleCount
0x421114 GetStdHandle
0x421118 GetFileType
0x42111c DeleteCriticalSection
0x421120 TerminateProcess
0x421124 GetCurrentProcess
0x421128 UnhandledExceptionFilter
0x42112c SetUnhandledExceptionFilter
0x421130 IsDebuggerPresent
0x421134 GetModuleFileNameW
0x421138 QueryPerformanceCounter
0x42113c GetTickCount
0x421140 GetCurrentThreadId
0x421144 GetCurrentProcessId
0x421148 GetSystemTimeAsFileTime
0x42114c GetModuleHandleW
0x421150 Sleep
0x421154 ExitProcess
0x421158 GetModuleFileNameA
0x42115c GetEnvironmentStrings
0x421160 FreeEnvironmentStringsW
0x421164 WideCharToMultiByte
0x421168 GetEnvironmentStringsW
0x42116c TlsGetValue
0x421170 TlsSetValue
0x421174 TlsFree
0x421178 SetLastError
0x42117c HeapDestroy
0x421180 HeapCreate
0x421184 HeapFree
0x421188 WriteFile
0x42118c HeapAlloc
0x421190 HeapSize
0x421194 HeapReAlloc
0x421198 VirtualAlloc
0x42119c GetACP
0x4211a0 GetOEMCP
0x4211a4 GetCPInfo
0x4211a8 IsValidCodePage
0x4211ac RtlUnwind
0x4211b0 GetConsoleCP
0x4211b4 GetConsoleMode
0x4211b8 InitializeCriticalSectionAndSpinCount
0x4211bc DebugBreak
0x4211c0 OutputDebugStringA
0x4211c4 WriteConsoleW
0x4211c8 OutputDebugStringW
0x4211cc LoadLibraryW
0x4211d0 MultiByteToWideChar
0x4211d4 LCMapStringA
0x4211d8 GetStringTypeA
0x4211dc GetStringTypeW
0x4211e0 GetLocaleInfoA
0x4211e4 FlushFileBuffers
0x4211e8 WriteConsoleA
0x4211ec GetConsoleOutputCP
0x4211f0 CloseHandle
0x4211f4 CreateFileA
0x4211f8 GetModuleHandleA
GDI32.dll
0x421000 GetBoundsRect
WINHTTP.dll
0x421200 WinHttpOpen
EAT(Export Address Table) is none
KERNEL32.dll
0x421008 UnregisterWait
0x42100c GetFileSize
0x421010 GetNativeSystemInfo
0x421014 SetFilePointer
0x421018 GetConsoleAliasesLengthW
0x42101c CopyFileExW
0x421020 SetLocalTime
0x421024 InterlockedIncrement
0x421028 VerSetConditionMask
0x42102c InterlockedDecrement
0x421030 ZombifyActCtx
0x421034 CompareFileTime
0x421038 GetSystemWindowsDirectoryW
0x42103c SetEnvironmentVariableW
0x421040 GlobalLock
0x421044 SetConsoleScreenBufferSize
0x421048 WriteConsoleInputA
0x42104c SetComputerNameW
0x421050 FreeEnvironmentStringsA
0x421054 VirtualFree
0x421058 SetProcessPriorityBoost
0x42105c FindResourceExA
0x421060 GetConsoleAliasExesLengthW
0x421064 GetComputerNameExA
0x421068 CreateSemaphoreA
0x42106c GetFileAttributesW
0x421070 GetBinaryTypeA
0x421074 ReadFile
0x421078 EnumResourceNamesW
0x42107c CompareStringW
0x421080 lstrlenW
0x421084 InterlockedExchange
0x421088 SetCurrentDirectoryA
0x42108c GetStartupInfoA
0x421090 GetCPInfoExW
0x421094 OpenMutexW
0x421098 GetCurrentDirectoryW
0x42109c GetProcAddress
0x4210a0 CreateNamedPipeA
0x4210a4 WriteProfileSectionA
0x4210a8 ReadFileEx
0x4210ac SetStdHandle
0x4210b0 DisableThreadLibraryCalls
0x4210b4 GetPrivateProfileStringA
0x4210b8 LoadLibraryA
0x4210bc GetConsoleScreenBufferInfo
0x4210c0 LocalAlloc
0x4210c4 PostQueuedCompletionStatus
0x4210c8 FindAtomA
0x4210cc WriteProfileStringW
0x4210d0 FatalAppExitA
0x4210d4 GetVersionExA
0x4210d8 TlsAlloc
0x4210dc DeleteFileW
0x4210e0 LCMapStringW
0x4210e4 AreFileApisANSI
0x4210e8 GetOverlappedResult
0x4210ec GetComputerNameA
0x4210f0 GetLastError
0x4210f4 MoveFileA
0x4210f8 GetCommandLineA
0x4210fc HeapValidate
0x421100 IsBadReadPtr
0x421104 RaiseException
0x421108 EnterCriticalSection
0x42110c LeaveCriticalSection
0x421110 SetHandleCount
0x421114 GetStdHandle
0x421118 GetFileType
0x42111c DeleteCriticalSection
0x421120 TerminateProcess
0x421124 GetCurrentProcess
0x421128 UnhandledExceptionFilter
0x42112c SetUnhandledExceptionFilter
0x421130 IsDebuggerPresent
0x421134 GetModuleFileNameW
0x421138 QueryPerformanceCounter
0x42113c GetTickCount
0x421140 GetCurrentThreadId
0x421144 GetCurrentProcessId
0x421148 GetSystemTimeAsFileTime
0x42114c GetModuleHandleW
0x421150 Sleep
0x421154 ExitProcess
0x421158 GetModuleFileNameA
0x42115c GetEnvironmentStrings
0x421160 FreeEnvironmentStringsW
0x421164 WideCharToMultiByte
0x421168 GetEnvironmentStringsW
0x42116c TlsGetValue
0x421170 TlsSetValue
0x421174 TlsFree
0x421178 SetLastError
0x42117c HeapDestroy
0x421180 HeapCreate
0x421184 HeapFree
0x421188 WriteFile
0x42118c HeapAlloc
0x421190 HeapSize
0x421194 HeapReAlloc
0x421198 VirtualAlloc
0x42119c GetACP
0x4211a0 GetOEMCP
0x4211a4 GetCPInfo
0x4211a8 IsValidCodePage
0x4211ac RtlUnwind
0x4211b0 GetConsoleCP
0x4211b4 GetConsoleMode
0x4211b8 InitializeCriticalSectionAndSpinCount
0x4211bc DebugBreak
0x4211c0 OutputDebugStringA
0x4211c4 WriteConsoleW
0x4211c8 OutputDebugStringW
0x4211cc LoadLibraryW
0x4211d0 MultiByteToWideChar
0x4211d4 LCMapStringA
0x4211d8 GetStringTypeA
0x4211dc GetStringTypeW
0x4211e0 GetLocaleInfoA
0x4211e4 FlushFileBuffers
0x4211e8 WriteConsoleA
0x4211ec GetConsoleOutputCP
0x4211f0 CloseHandle
0x4211f4 CreateFileA
0x4211f8 GetModuleHandleA
GDI32.dll
0x421000 GetBoundsRect
WINHTTP.dll
0x421200 WinHttpOpen
EAT(Export Address Table) is none