ScreenShot
| Created | 2021.08.13 09:48 | Machine | s1_win7_x6402 |
| Filename | Rx4.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 26 detected (malicious, high confidence, Unsafe, Save, confidence, 100%, Attribute, HighConfidence, GenKryptik, FIWQ, Chapak, FileRepMalware, Emotet, Outbreak, kcloud, Sabsik, score, Obscure, CLASSIC, Static AI, Suspicious PE, ZexaF, tuW@ayBbiTcH, QVM10) | ||
| md5 | cebd70129181b2d00175a09425028661 | ||
| sha256 | b0e0893c4a07b3a6c42c33988741f24c283be68927f79e0388e30d91eed7e2c2 | ||
| ssdeep | 6144:KN4z5x2rNAo0eQ2sCTQ6UGSeywoFaVt4Co5pZRtW2JrMNk:jz5Aqo0eQOTQ6N0nQt4j/ZO2Jrkk | ||
| imphash | 62f5ddafa2c16d26eaa8112b2787e21c | ||
| impfuzzy | 48:mTzUbkYJq3mK8wQyMSaEBcftqPy29JSOPb:mVYIPL7M/EBcftqPyUJSOPb | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 26 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x429000 GetComputerNameA
0x429004 EnumResourceNamesW
0x429008 UnregisterWait
0x42900c SetPriorityClass
0x429010 WriteConsoleInputW
0x429014 SetFilePointer
0x429018 GetConsoleAliasesLengthW
0x42901c InterlockedIncrement
0x429020 InterlockedDecrement
0x429024 WaitNamedPipeA
0x429028 CompareFileTime
0x42902c SetEnvironmentVariableW
0x429030 CreateDirectoryW
0x429034 GlobalLock
0x429038 SetEvent
0x42903c FreeEnvironmentStringsA
0x429040 GetTickCount
0x429044 GetCommandLineA
0x429048 GlobalAlloc
0x42904c AddRefActCtx
0x429050 LoadLibraryW
0x429054 GetSystemWow64DirectoryW
0x429058 IsProcessorFeaturePresent
0x42905c CreateSemaphoreA
0x429060 ReadFile
0x429064 GetModuleFileNameW
0x429068 CompareStringW
0x42906c lstrlenW
0x429070 LCMapStringA
0x429074 GetFileSizeEx
0x429078 GetStartupInfoA
0x42907c OpenMutexW
0x429080 GetHandleInformation
0x429084 GetCurrentDirectoryW
0x429088 SetLastError
0x42908c GetProcAddress
0x429090 VirtualAlloc
0x429094 WriteProfileSectionA
0x429098 ReadFileEx
0x42909c CopyFileA
0x4290a0 GetPrivateProfileStringA
0x4290a4 LoadLibraryA
0x4290a8 OpenMutexA
0x4290ac GetConsoleScreenBufferInfo
0x4290b0 GetExitCodeThread
0x4290b4 SetCurrentDirectoryW
0x4290b8 PostQueuedCompletionStatus
0x4290bc FindAtomA
0x4290c0 CreateIoCompletionPort
0x4290c4 HeapSetInformation
0x4290c8 GetConsoleCursorInfo
0x4290cc FatalAppExitA
0x4290d0 GetCPInfoExA
0x4290d4 OpenSemaphoreW
0x4290d8 GetVersionExA
0x4290dc TlsAlloc
0x4290e0 GetSystemTime
0x4290e4 CopyFileExA
0x4290e8 GetLastError
0x4290ec MoveFileA
0x4290f0 HeapValidate
0x4290f4 IsBadReadPtr
0x4290f8 RaiseException
0x4290fc EnterCriticalSection
0x429100 LeaveCriticalSection
0x429104 TerminateProcess
0x429108 GetCurrentProcess
0x42910c UnhandledExceptionFilter
0x429110 SetUnhandledExceptionFilter
0x429114 IsDebuggerPresent
0x429118 RtlUnwind
0x42911c GetACP
0x429120 GetOEMCP
0x429124 GetCPInfo
0x429128 IsValidCodePage
0x42912c TlsGetValue
0x429130 GetModuleHandleW
0x429134 TlsSetValue
0x429138 GetCurrentThreadId
0x42913c TlsFree
0x429140 Sleep
0x429144 ExitProcess
0x429148 SetHandleCount
0x42914c GetStdHandle
0x429150 GetFileType
0x429154 DeleteCriticalSection
0x429158 QueryPerformanceCounter
0x42915c GetCurrentProcessId
0x429160 GetSystemTimeAsFileTime
0x429164 GetModuleFileNameA
0x429168 GetEnvironmentStrings
0x42916c FreeEnvironmentStringsW
0x429170 WideCharToMultiByte
0x429174 GetEnvironmentStringsW
0x429178 HeapDestroy
0x42917c HeapCreate
0x429180 HeapFree
0x429184 VirtualFree
0x429188 WriteFile
0x42918c HeapAlloc
0x429190 HeapSize
0x429194 HeapReAlloc
0x429198 DebugBreak
0x42919c OutputDebugStringA
0x4291a0 WriteConsoleW
0x4291a4 OutputDebugStringW
0x4291a8 MultiByteToWideChar
0x4291ac GetStringTypeA
0x4291b0 GetStringTypeW
0x4291b4 GetLocaleInfoA
0x4291b8 LCMapStringW
0x4291bc InitializeCriticalSectionAndSpinCount
0x4291c0 FlushFileBuffers
0x4291c4 GetConsoleCP
0x4291c8 GetConsoleMode
0x4291cc CloseHandle
0x4291d0 SetStdHandle
0x4291d4 WriteConsoleA
0x4291d8 GetConsoleOutputCP
0x4291dc CreateFileA
0x4291e0 GetModuleHandleA
EAT(Export Address Table) is none
KERNEL32.dll
0x429000 GetComputerNameA
0x429004 EnumResourceNamesW
0x429008 UnregisterWait
0x42900c SetPriorityClass
0x429010 WriteConsoleInputW
0x429014 SetFilePointer
0x429018 GetConsoleAliasesLengthW
0x42901c InterlockedIncrement
0x429020 InterlockedDecrement
0x429024 WaitNamedPipeA
0x429028 CompareFileTime
0x42902c SetEnvironmentVariableW
0x429030 CreateDirectoryW
0x429034 GlobalLock
0x429038 SetEvent
0x42903c FreeEnvironmentStringsA
0x429040 GetTickCount
0x429044 GetCommandLineA
0x429048 GlobalAlloc
0x42904c AddRefActCtx
0x429050 LoadLibraryW
0x429054 GetSystemWow64DirectoryW
0x429058 IsProcessorFeaturePresent
0x42905c CreateSemaphoreA
0x429060 ReadFile
0x429064 GetModuleFileNameW
0x429068 CompareStringW
0x42906c lstrlenW
0x429070 LCMapStringA
0x429074 GetFileSizeEx
0x429078 GetStartupInfoA
0x42907c OpenMutexW
0x429080 GetHandleInformation
0x429084 GetCurrentDirectoryW
0x429088 SetLastError
0x42908c GetProcAddress
0x429090 VirtualAlloc
0x429094 WriteProfileSectionA
0x429098 ReadFileEx
0x42909c CopyFileA
0x4290a0 GetPrivateProfileStringA
0x4290a4 LoadLibraryA
0x4290a8 OpenMutexA
0x4290ac GetConsoleScreenBufferInfo
0x4290b0 GetExitCodeThread
0x4290b4 SetCurrentDirectoryW
0x4290b8 PostQueuedCompletionStatus
0x4290bc FindAtomA
0x4290c0 CreateIoCompletionPort
0x4290c4 HeapSetInformation
0x4290c8 GetConsoleCursorInfo
0x4290cc FatalAppExitA
0x4290d0 GetCPInfoExA
0x4290d4 OpenSemaphoreW
0x4290d8 GetVersionExA
0x4290dc TlsAlloc
0x4290e0 GetSystemTime
0x4290e4 CopyFileExA
0x4290e8 GetLastError
0x4290ec MoveFileA
0x4290f0 HeapValidate
0x4290f4 IsBadReadPtr
0x4290f8 RaiseException
0x4290fc EnterCriticalSection
0x429100 LeaveCriticalSection
0x429104 TerminateProcess
0x429108 GetCurrentProcess
0x42910c UnhandledExceptionFilter
0x429110 SetUnhandledExceptionFilter
0x429114 IsDebuggerPresent
0x429118 RtlUnwind
0x42911c GetACP
0x429120 GetOEMCP
0x429124 GetCPInfo
0x429128 IsValidCodePage
0x42912c TlsGetValue
0x429130 GetModuleHandleW
0x429134 TlsSetValue
0x429138 GetCurrentThreadId
0x42913c TlsFree
0x429140 Sleep
0x429144 ExitProcess
0x429148 SetHandleCount
0x42914c GetStdHandle
0x429150 GetFileType
0x429154 DeleteCriticalSection
0x429158 QueryPerformanceCounter
0x42915c GetCurrentProcessId
0x429160 GetSystemTimeAsFileTime
0x429164 GetModuleFileNameA
0x429168 GetEnvironmentStrings
0x42916c FreeEnvironmentStringsW
0x429170 WideCharToMultiByte
0x429174 GetEnvironmentStringsW
0x429178 HeapDestroy
0x42917c HeapCreate
0x429180 HeapFree
0x429184 VirtualFree
0x429188 WriteFile
0x42918c HeapAlloc
0x429190 HeapSize
0x429194 HeapReAlloc
0x429198 DebugBreak
0x42919c OutputDebugStringA
0x4291a0 WriteConsoleW
0x4291a4 OutputDebugStringW
0x4291a8 MultiByteToWideChar
0x4291ac GetStringTypeA
0x4291b0 GetStringTypeW
0x4291b4 GetLocaleInfoA
0x4291b8 LCMapStringW
0x4291bc InitializeCriticalSectionAndSpinCount
0x4291c0 FlushFileBuffers
0x4291c4 GetConsoleCP
0x4291c8 GetConsoleMode
0x4291cc CloseHandle
0x4291d0 SetStdHandle
0x4291d4 WriteConsoleA
0x4291d8 GetConsoleOutputCP
0x4291dc CreateFileA
0x4291e0 GetModuleHandleA
EAT(Export Address Table) is none