ScreenShot
| Created | 2021.08.12 09:36 | Machine | s1_win7_x6401 |
| Filename | 3.php | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 38 detected (AIDetect, malware2, malicious, high confidence, Fragtor, Unsafe, Save, Kryptik, Eldorado, HMAY, Blocker, DropperX, HPGen, Emotet, A + Troj, Krypt, Static AI, Malicious PE, ai score=80, STOP, se45665, Sabsik, score, ZexaF, oq0@aeNDj7li, BScope, Androm, CLASSIC, susgen, confidence, 100%, QVM10) | ||
| md5 | 26a5a30af2a8f19775fb79d1679052e6 | ||
| sha256 | 6a6c76468f25ca6d92463cc715fe615b2b449468a85e9c183693d8ea5a70fff1 | ||
| ssdeep | 3072:RHYT/V2WmOfWSnTEXvoH8Gz5sFhQ/XScsYh6gSVywo3c+:RHa5mO//H8XjiC7knGyHM | ||
| imphash | d3a683e5c9bc8c05c0c2f946c056969b | ||
| impfuzzy | 48:KenZFwirzMt41+jLOZYTt8VGAO9j6cCF7dMU:KGFNrz+g+/nTtYGA8j6cCF7Z | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 38 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41b000 GetComputerNameA
0x41b004 lstrlenA
0x41b008 WriteConsoleOutputCharacterA
0x41b00c LocalCompact
0x41b010 MoveFileExW
0x41b014 InterlockedDecrement
0x41b018 GetCurrentProcess
0x41b01c WritePrivateProfileSectionA
0x41b020 GetSystemWindowsDirectoryW
0x41b024 GetUserDefaultLCID
0x41b028 WriteConsoleInputA
0x41b02c SetEvent
0x41b030 IsBadReadPtr
0x41b034 GetConsoleAliasesLengthA
0x41b038 ReadConsoleOutputA
0x41b03c GetUserDefaultLangID
0x41b040 InitializeCriticalSection
0x41b044 GetVolumePathNameW
0x41b048 FindResourceExA
0x41b04c GetConsoleCP
0x41b050 GlobalAlloc
0x41b054 InterlockedPopEntrySList
0x41b058 LeaveCriticalSection
0x41b05c DnsHostnameToComputerNameW
0x41b060 lstrcpynW
0x41b064 GetConsoleAliasW
0x41b068 SetConsoleCursorPosition
0x41b06c GetFileAttributesW
0x41b070 WriteConsoleW
0x41b074 ReadFile
0x41b078 CreateFileW
0x41b07c CreateActCtxA
0x41b080 GetACP
0x41b084 VerifyVersionInfoW
0x41b088 GetCPInfoExW
0x41b08c GetLastError
0x41b090 GetProcAddress
0x41b094 PeekConsoleInputW
0x41b098 EnumDateFormatsExA
0x41b09c GetConsoleDisplayMode
0x41b0a0 DeleteTimerQueue
0x41b0a4 CreateTapePartition
0x41b0a8 GlobalGetAtomNameW
0x41b0ac WaitForMultipleObjects
0x41b0b0 SetSystemTime
0x41b0b4 SetEnvironmentVariableA
0x41b0b8 SetConsoleTitleW
0x41b0bc GetModuleHandleA
0x41b0c0 lstrcatW
0x41b0c4 UpdateResourceW
0x41b0c8 CancelTimerQueueTimer
0x41b0cc GetConsoleTitleW
0x41b0d0 BuildCommDCBA
0x41b0d4 VirtualProtect
0x41b0d8 SetCalendarInfoA
0x41b0dc FindFirstVolumeA
0x41b0e0 EndUpdateResourceA
0x41b0e4 GetVersionExA
0x41b0e8 ReadConsoleInputW
0x41b0ec DeleteFileW
0x41b0f0 GetPrivateProfileSectionW
0x41b0f4 AreFileApisANSI
0x41b0f8 UnhandledExceptionFilter
0x41b0fc SetUnhandledExceptionFilter
0x41b100 GetCommandLineA
0x41b104 GetStartupInfoA
0x41b108 RaiseException
0x41b10c RtlUnwind
0x41b110 GetModuleHandleW
0x41b114 Sleep
0x41b118 ExitProcess
0x41b11c WriteFile
0x41b120 GetStdHandle
0x41b124 GetModuleFileNameA
0x41b128 TerminateProcess
0x41b12c IsDebuggerPresent
0x41b130 HeapAlloc
0x41b134 HeapFree
0x41b138 FreeEnvironmentStringsA
0x41b13c GetEnvironmentStrings
0x41b140 FreeEnvironmentStringsW
0x41b144 WideCharToMultiByte
0x41b148 GetEnvironmentStringsW
0x41b14c SetHandleCount
0x41b150 GetFileType
0x41b154 DeleteCriticalSection
0x41b158 TlsGetValue
0x41b15c TlsAlloc
0x41b160 TlsSetValue
0x41b164 TlsFree
0x41b168 InterlockedIncrement
0x41b16c SetLastError
0x41b170 GetCurrentThreadId
0x41b174 HeapCreate
0x41b178 VirtualFree
0x41b17c QueryPerformanceCounter
0x41b180 GetTickCount
0x41b184 GetCurrentProcessId
0x41b188 GetSystemTimeAsFileTime
0x41b18c EnterCriticalSection
0x41b190 LoadLibraryA
0x41b194 InitializeCriticalSectionAndSpinCount
0x41b198 VirtualAlloc
0x41b19c HeapReAlloc
0x41b1a0 HeapSize
0x41b1a4 GetCPInfo
0x41b1a8 GetOEMCP
0x41b1ac IsValidCodePage
0x41b1b0 GetLocaleInfoA
0x41b1b4 LCMapStringA
0x41b1b8 MultiByteToWideChar
0x41b1bc LCMapStringW
0x41b1c0 GetStringTypeA
0x41b1c4 GetStringTypeW
USER32.dll
0x41b1cc GetAltTabInfoW
0x41b1d0 RealGetWindowClassA
EAT(Export Address Table) Library
0x401065 @GetOtherVice@12
KERNEL32.dll
0x41b000 GetComputerNameA
0x41b004 lstrlenA
0x41b008 WriteConsoleOutputCharacterA
0x41b00c LocalCompact
0x41b010 MoveFileExW
0x41b014 InterlockedDecrement
0x41b018 GetCurrentProcess
0x41b01c WritePrivateProfileSectionA
0x41b020 GetSystemWindowsDirectoryW
0x41b024 GetUserDefaultLCID
0x41b028 WriteConsoleInputA
0x41b02c SetEvent
0x41b030 IsBadReadPtr
0x41b034 GetConsoleAliasesLengthA
0x41b038 ReadConsoleOutputA
0x41b03c GetUserDefaultLangID
0x41b040 InitializeCriticalSection
0x41b044 GetVolumePathNameW
0x41b048 FindResourceExA
0x41b04c GetConsoleCP
0x41b050 GlobalAlloc
0x41b054 InterlockedPopEntrySList
0x41b058 LeaveCriticalSection
0x41b05c DnsHostnameToComputerNameW
0x41b060 lstrcpynW
0x41b064 GetConsoleAliasW
0x41b068 SetConsoleCursorPosition
0x41b06c GetFileAttributesW
0x41b070 WriteConsoleW
0x41b074 ReadFile
0x41b078 CreateFileW
0x41b07c CreateActCtxA
0x41b080 GetACP
0x41b084 VerifyVersionInfoW
0x41b088 GetCPInfoExW
0x41b08c GetLastError
0x41b090 GetProcAddress
0x41b094 PeekConsoleInputW
0x41b098 EnumDateFormatsExA
0x41b09c GetConsoleDisplayMode
0x41b0a0 DeleteTimerQueue
0x41b0a4 CreateTapePartition
0x41b0a8 GlobalGetAtomNameW
0x41b0ac WaitForMultipleObjects
0x41b0b0 SetSystemTime
0x41b0b4 SetEnvironmentVariableA
0x41b0b8 SetConsoleTitleW
0x41b0bc GetModuleHandleA
0x41b0c0 lstrcatW
0x41b0c4 UpdateResourceW
0x41b0c8 CancelTimerQueueTimer
0x41b0cc GetConsoleTitleW
0x41b0d0 BuildCommDCBA
0x41b0d4 VirtualProtect
0x41b0d8 SetCalendarInfoA
0x41b0dc FindFirstVolumeA
0x41b0e0 EndUpdateResourceA
0x41b0e4 GetVersionExA
0x41b0e8 ReadConsoleInputW
0x41b0ec DeleteFileW
0x41b0f0 GetPrivateProfileSectionW
0x41b0f4 AreFileApisANSI
0x41b0f8 UnhandledExceptionFilter
0x41b0fc SetUnhandledExceptionFilter
0x41b100 GetCommandLineA
0x41b104 GetStartupInfoA
0x41b108 RaiseException
0x41b10c RtlUnwind
0x41b110 GetModuleHandleW
0x41b114 Sleep
0x41b118 ExitProcess
0x41b11c WriteFile
0x41b120 GetStdHandle
0x41b124 GetModuleFileNameA
0x41b128 TerminateProcess
0x41b12c IsDebuggerPresent
0x41b130 HeapAlloc
0x41b134 HeapFree
0x41b138 FreeEnvironmentStringsA
0x41b13c GetEnvironmentStrings
0x41b140 FreeEnvironmentStringsW
0x41b144 WideCharToMultiByte
0x41b148 GetEnvironmentStringsW
0x41b14c SetHandleCount
0x41b150 GetFileType
0x41b154 DeleteCriticalSection
0x41b158 TlsGetValue
0x41b15c TlsAlloc
0x41b160 TlsSetValue
0x41b164 TlsFree
0x41b168 InterlockedIncrement
0x41b16c SetLastError
0x41b170 GetCurrentThreadId
0x41b174 HeapCreate
0x41b178 VirtualFree
0x41b17c QueryPerformanceCounter
0x41b180 GetTickCount
0x41b184 GetCurrentProcessId
0x41b188 GetSystemTimeAsFileTime
0x41b18c EnterCriticalSection
0x41b190 LoadLibraryA
0x41b194 InitializeCriticalSectionAndSpinCount
0x41b198 VirtualAlloc
0x41b19c HeapReAlloc
0x41b1a0 HeapSize
0x41b1a4 GetCPInfo
0x41b1a8 GetOEMCP
0x41b1ac IsValidCodePage
0x41b1b0 GetLocaleInfoA
0x41b1b4 LCMapStringA
0x41b1b8 MultiByteToWideChar
0x41b1bc LCMapStringW
0x41b1c0 GetStringTypeA
0x41b1c4 GetStringTypeW
USER32.dll
0x41b1cc GetAltTabInfoW
0x41b1d0 RealGetWindowClassA
EAT(Export Address Table) Library
0x401065 @GetOtherVice@12