ScreenShot
| Created | 2021.08.14 09:54 | Machine | s1_win7_x6402 |
| Filename | apines.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 38 detected (malicious, high confidence, HwoCPr8A, Unsafe, Save, Zurgop, Kryptik, Eldorado, Attribute, HighConfidence, HMBS, CLASSIC, A + Troj, Krypt, DownLoader41, HPGen, NetSteal, 32RXWG, RedLine, score, FTUB, BScope, Azorult, Static AI, Suspicious PE, GenKryptik, FIXG, ZexaF, rq0@aqW8ZVpG, Genetic, confidence, 100%, susgen) | ||
| md5 | d60de31e6e431d66634f84ef0ee29f37 | ||
| sha256 | 5f813f5fd0f6245500bda8b4df4649810ae1c51bb07ee10e12d19388adab1fb4 | ||
| ssdeep | 6144:WLumndWPXsJ3VgDq1tdWhASPFpWOROyR4MWiheCi:W6YqI3VgDwjOAMTWOHORihri | ||
| imphash | 8dcae17739f93a54640d82b608ad24e8 | ||
| impfuzzy | 24:XckrkVkQ0Zaj3+frkrKbCzDkXV4B/caJcDS1hPFDZvHeyuJ0g4btslXuOZyvDIur:XzzZXzkrK+1hPFZ+ytsvuDIIcR7GH2C | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 38 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42e000 lstrlenA
0x42e004 GetConsoleAliasesLengthW
0x42e008 MoveFileExA
0x42e00c InterlockedIncrement
0x42e010 InterlockedDecrement
0x42e014 ReadConsoleOutputAttribute
0x42e018 GetEnvironmentStringsW
0x42e01c GetUserDefaultLCID
0x42e020 WaitForSingleObject
0x42e024 SetConsoleScreenBufferSize
0x42e028 SetEvent
0x42e02c IsBadReadPtr
0x42e030 GetUserDefaultLangID
0x42e034 GetVolumePathNameW
0x42e038 GetConsoleCP
0x42e03c LocalShrink
0x42e040 GetSystemWindowsDirectoryA
0x42e044 ReadConsoleOutputW
0x42e048 GetFileAttributesA
0x42e04c lstrcpynW
0x42e050 GetConsoleAliasW
0x42e054 VerifyVersionInfoA
0x42e058 WriteConsoleW
0x42e05c WritePrivateProfileSectionW
0x42e060 ReadFile
0x42e064 GetModuleFileNameW
0x42e068 GetCompressedFileSizeA
0x42e06c GetSystemDirectoryA
0x42e070 CreateActCtxA
0x42e074 lstrcatA
0x42e078 GetACP
0x42e07c VerifyVersionInfoW
0x42e080 SetLastError
0x42e084 GetProcAddress
0x42e088 PeekConsoleInputW
0x42e08c EnumDateFormatsExA
0x42e090 EnterCriticalSection
0x42e094 BuildCommDCBW
0x42e098 GetLocalTime
0x42e09c GetProcessId
0x42e0a0 LocalAlloc
0x42e0a4 DeleteTimerQueue
0x42e0a8 SetCalendarInfoW
0x42e0ac DnsHostnameToComputerNameA
0x42e0b0 CreateTapePartition
0x42e0b4 SetConsoleDisplayMode
0x42e0b8 SetFileApisToANSI
0x42e0bc GlobalGetAtomNameW
0x42e0c0 SetEnvironmentVariableA
0x42e0c4 SetConsoleTitleW
0x42e0c8 GetModuleHandleA
0x42e0cc UpdateResourceW
0x42e0d0 GetConsoleTitleW
0x42e0d4 VirtualProtect
0x42e0d8 EndUpdateResourceA
0x42e0dc GetVersionExA
0x42e0e0 FindFirstVolumeW
0x42e0e4 LCMapStringW
0x42e0e8 CreateFileW
0x42e0ec GetComputerNameA
0x42e0f0 UnhandledExceptionFilter
0x42e0f4 SetUnhandledExceptionFilter
0x42e0f8 GetStartupInfoW
0x42e0fc GetModuleHandleW
0x42e100 Sleep
0x42e104 ExitProcess
0x42e108 GetLastError
0x42e10c WriteFile
0x42e110 GetStdHandle
0x42e114 GetModuleFileNameA
0x42e118 HeapAlloc
0x42e11c FreeEnvironmentStringsW
0x42e120 GetCommandLineW
0x42e124 SetHandleCount
0x42e128 GetFileType
0x42e12c GetStartupInfoA
0x42e130 DeleteCriticalSection
0x42e134 TlsGetValue
0x42e138 TlsAlloc
0x42e13c TlsSetValue
0x42e140 TlsFree
0x42e144 GetCurrentThreadId
0x42e148 HeapCreate
0x42e14c VirtualFree
0x42e150 HeapFree
0x42e154 QueryPerformanceCounter
0x42e158 GetTickCount
0x42e15c GetCurrentProcessId
0x42e160 GetSystemTimeAsFileTime
0x42e164 LeaveCriticalSection
0x42e168 TerminateProcess
0x42e16c GetCurrentProcess
0x42e170 IsDebuggerPresent
0x42e174 LoadLibraryA
0x42e178 InitializeCriticalSectionAndSpinCount
0x42e17c RaiseException
0x42e180 VirtualAlloc
0x42e184 HeapReAlloc
0x42e188 GetCPInfo
0x42e18c GetOEMCP
0x42e190 IsValidCodePage
0x42e194 RtlUnwind
0x42e198 HeapSize
0x42e19c GetLocaleInfoA
0x42e1a0 WideCharToMultiByte
0x42e1a4 GetStringTypeA
0x42e1a8 MultiByteToWideChar
0x42e1ac GetStringTypeW
0x42e1b0 LCMapStringA
USER32.dll
0x42e1b8 RealGetWindowClassW
EAT(Export Address Table) Library
0x401000 @GetOtherVice@16
KERNEL32.dll
0x42e000 lstrlenA
0x42e004 GetConsoleAliasesLengthW
0x42e008 MoveFileExA
0x42e00c InterlockedIncrement
0x42e010 InterlockedDecrement
0x42e014 ReadConsoleOutputAttribute
0x42e018 GetEnvironmentStringsW
0x42e01c GetUserDefaultLCID
0x42e020 WaitForSingleObject
0x42e024 SetConsoleScreenBufferSize
0x42e028 SetEvent
0x42e02c IsBadReadPtr
0x42e030 GetUserDefaultLangID
0x42e034 GetVolumePathNameW
0x42e038 GetConsoleCP
0x42e03c LocalShrink
0x42e040 GetSystemWindowsDirectoryA
0x42e044 ReadConsoleOutputW
0x42e048 GetFileAttributesA
0x42e04c lstrcpynW
0x42e050 GetConsoleAliasW
0x42e054 VerifyVersionInfoA
0x42e058 WriteConsoleW
0x42e05c WritePrivateProfileSectionW
0x42e060 ReadFile
0x42e064 GetModuleFileNameW
0x42e068 GetCompressedFileSizeA
0x42e06c GetSystemDirectoryA
0x42e070 CreateActCtxA
0x42e074 lstrcatA
0x42e078 GetACP
0x42e07c VerifyVersionInfoW
0x42e080 SetLastError
0x42e084 GetProcAddress
0x42e088 PeekConsoleInputW
0x42e08c EnumDateFormatsExA
0x42e090 EnterCriticalSection
0x42e094 BuildCommDCBW
0x42e098 GetLocalTime
0x42e09c GetProcessId
0x42e0a0 LocalAlloc
0x42e0a4 DeleteTimerQueue
0x42e0a8 SetCalendarInfoW
0x42e0ac DnsHostnameToComputerNameA
0x42e0b0 CreateTapePartition
0x42e0b4 SetConsoleDisplayMode
0x42e0b8 SetFileApisToANSI
0x42e0bc GlobalGetAtomNameW
0x42e0c0 SetEnvironmentVariableA
0x42e0c4 SetConsoleTitleW
0x42e0c8 GetModuleHandleA
0x42e0cc UpdateResourceW
0x42e0d0 GetConsoleTitleW
0x42e0d4 VirtualProtect
0x42e0d8 EndUpdateResourceA
0x42e0dc GetVersionExA
0x42e0e0 FindFirstVolumeW
0x42e0e4 LCMapStringW
0x42e0e8 CreateFileW
0x42e0ec GetComputerNameA
0x42e0f0 UnhandledExceptionFilter
0x42e0f4 SetUnhandledExceptionFilter
0x42e0f8 GetStartupInfoW
0x42e0fc GetModuleHandleW
0x42e100 Sleep
0x42e104 ExitProcess
0x42e108 GetLastError
0x42e10c WriteFile
0x42e110 GetStdHandle
0x42e114 GetModuleFileNameA
0x42e118 HeapAlloc
0x42e11c FreeEnvironmentStringsW
0x42e120 GetCommandLineW
0x42e124 SetHandleCount
0x42e128 GetFileType
0x42e12c GetStartupInfoA
0x42e130 DeleteCriticalSection
0x42e134 TlsGetValue
0x42e138 TlsAlloc
0x42e13c TlsSetValue
0x42e140 TlsFree
0x42e144 GetCurrentThreadId
0x42e148 HeapCreate
0x42e14c VirtualFree
0x42e150 HeapFree
0x42e154 QueryPerformanceCounter
0x42e158 GetTickCount
0x42e15c GetCurrentProcessId
0x42e160 GetSystemTimeAsFileTime
0x42e164 LeaveCriticalSection
0x42e168 TerminateProcess
0x42e16c GetCurrentProcess
0x42e170 IsDebuggerPresent
0x42e174 LoadLibraryA
0x42e178 InitializeCriticalSectionAndSpinCount
0x42e17c RaiseException
0x42e180 VirtualAlloc
0x42e184 HeapReAlloc
0x42e188 GetCPInfo
0x42e18c GetOEMCP
0x42e190 IsValidCodePage
0x42e194 RtlUnwind
0x42e198 HeapSize
0x42e19c GetLocaleInfoA
0x42e1a0 WideCharToMultiByte
0x42e1a4 GetStringTypeA
0x42e1a8 MultiByteToWideChar
0x42e1ac GetStringTypeW
0x42e1b0 LCMapStringA
USER32.dll
0x42e1b8 RealGetWindowClassW
EAT(Export Address Table) Library
0x401000 @GetOtherVice@16