ScreenShot
| Created | 2021.08.02 09:14 | Machine | s1_win7_x6401 |
| Filename | ly%E7%99%BB%E9%99%86%E5%99%A82021.exe | ||
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 41 detected (AIDetect, malware2, malicious, high confidence, Bulz, Artemis, Unsafe, Save, confidence, VMProtect, Attribute, HighConfidence, VMProtBad, R01FC0RGV21, BadFile, Static AI, Malicious PE, Black, Gen2, ai score=87, kcloud, Wacapew, score, Generic@ML, RDML, CEXW7a6fPeqegbKXT9EcEQ, FJQoQc6zoEk, susgen, HgIASZQA) | ||
| md5 | e4dc1316bde5f058c3eaf297a378f07e | ||
| sha256 | 6e5a7fcf8c27fb801d08efe579582948fea2eb62f2edf9669350c50eaa91ed71 | ||
| ssdeep | 24576:vIt5+bgJZt6Ay6hHW3BfIOcqCqxEclEappvNo6JOyRyjIm5h/29xNkXt/94IFi1s:8kgAADhHW9PcrclEIrRKmnksR0DfM | ||
| imphash | f6e4c27a9632149744d004de67a6dd3e | ||
| impfuzzy | 6:omcsuVMACw/eGa7gW9AkLd89mRPhj67Lb0TR2/U3QB0o46GSErBJAEf/JLGCZB:omHxRfhL+YRF6/UgBChjAgZGCZB | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 41 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to stop active services |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | Performs some HTTP requests |
| notice | Sends data using the HTTP POST Method |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
ADVAPI32.DLL
0xf8b000 RegEnumValueA
COMCTL32.DLL
0xf8b008 ImageList_ReplaceIcon
COMDLG32.DLL
0xf8b010 GetSaveFileNameA
GDI32.dll
0xf8b018 CreateBrushIndirect
IMAGEHLP.DLL
0xf8b020 ImageNtHeader
KERNEL32.dll
0xf8b028 DeleteCriticalSection
msvcrt.dll
0xf8b030 strtod
OLEAUT32.DLL
0xf8b038 SysAllocStringLen
SHELL32.DLL
0xf8b040 Shell_NotifyIconA
SHLWAPI.DLL
0xf8b048 SHDeleteKeyA
USER32.dll
0xf8b050 SetMenuItemBitmaps
WININET.DLL
0xf8b058 InternetConnectA
WS2_32.dll
0xf8b060 inet_addr
KERNEL32.dll
0xf8b068 GetModuleFileNameW
KERNEL32.dll
0xf8b070 GetModuleHandleA
0xf8b074 LoadLibraryA
0xf8b078 LocalAlloc
0xf8b07c LocalFree
0xf8b080 GetModuleFileNameA
0xf8b084 ExitProcess
EAT(Export Address Table) Library
0x4184a0 BlowfishKeyInit
0x4196c0 sub_434FA0
0x419790 sub_435066
0x419860 sub_43512C
ADVAPI32.DLL
0xf8b000 RegEnumValueA
COMCTL32.DLL
0xf8b008 ImageList_ReplaceIcon
COMDLG32.DLL
0xf8b010 GetSaveFileNameA
GDI32.dll
0xf8b018 CreateBrushIndirect
IMAGEHLP.DLL
0xf8b020 ImageNtHeader
KERNEL32.dll
0xf8b028 DeleteCriticalSection
msvcrt.dll
0xf8b030 strtod
OLEAUT32.DLL
0xf8b038 SysAllocStringLen
SHELL32.DLL
0xf8b040 Shell_NotifyIconA
SHLWAPI.DLL
0xf8b048 SHDeleteKeyA
USER32.dll
0xf8b050 SetMenuItemBitmaps
WININET.DLL
0xf8b058 InternetConnectA
WS2_32.dll
0xf8b060 inet_addr
KERNEL32.dll
0xf8b068 GetModuleFileNameW
KERNEL32.dll
0xf8b070 GetModuleHandleA
0xf8b074 LoadLibraryA
0xf8b078 LocalAlloc
0xf8b07c LocalFree
0xf8b080 GetModuleFileNameA
0xf8b084 ExitProcess
EAT(Export Address Table) Library
0x4184a0 BlowfishKeyInit
0x4196c0 sub_434FA0
0x419790 sub_435066
0x419860 sub_43512C