ScreenShot
| Created | 2021.08.15 12:41 | Machine | s1_win7_x6402 |
| Filename | sefile.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 24 detected (malicious, high confidence, Artemis, Unsafe, Save, Attribute, HighConfidence, Kryptik, CLASSIC, HPGen, Emotet, Wacatac, score, BScope, Static AI, Malicious PE, susgen, ZexaF, rq0@auH0dYhG, confidence, 100%, QVM10) | ||
| md5 | 970dac7d9d006a955e21a10241c65afc | ||
| sha256 | faf9a5d22867764f24fa7d01da08bced67681b89593fcf95faf52c731013cf99 | ||
| ssdeep | 6144:HL7M2aKYCPghnI4FmwvOM7rQP84oWdPgdSHe:H3M2cI4FdvOorQ7XdPgQH | ||
| imphash | 6b22ece31495fe337ab5b098b4e30ca3 | ||
| impfuzzy | 48:k5ZXEUg/XdljM+RFxrWt/7suD+cnU5nemU:kDaVljMwrWt/7l+cnU5nep | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42e000 EnumDateFormatsExW
0x42e004 MoveFileExA
0x42e008 EndUpdateResourceW
0x42e00c InterlockedIncrement
0x42e010 InterlockedDecrement
0x42e014 ReadConsoleOutputAttribute
0x42e018 GetSystemWindowsDirectoryW
0x42e01c GetEnvironmentStringsW
0x42e020 GetUserDefaultLCID
0x42e024 WaitForSingleObject
0x42e028 SetConsoleScreenBufferSize
0x42e02c GetComputerNameW
0x42e030 SetEvent
0x42e034 GetConsoleAliasesLengthA
0x42e038 CreateActCtxW
0x42e03c GetConsoleCP
0x42e040 LocalShrink
0x42e044 ReadConsoleOutputW
0x42e048 GetVersionExW
0x42e04c GetFileAttributesA
0x42e050 lstrcpynW
0x42e054 GetConsoleAliasW
0x42e058 VerifyVersionInfoA
0x42e05c WriteConsoleW
0x42e060 WritePrivateProfileSectionW
0x42e064 IsBadWritePtr
0x42e068 ReadFile
0x42e06c GetModuleFileNameW
0x42e070 GetCompressedFileSizeA
0x42e074 GetSystemDirectoryA
0x42e078 CreateFileW
0x42e07c lstrcatA
0x42e080 GetACP
0x42e084 GetVolumePathNameA
0x42e088 lstrlenW
0x42e08c SetConsoleTitleA
0x42e090 VerifyVersionInfoW
0x42e094 InterlockedExchange
0x42e098 GetLastError
0x42e09c GetProcAddress
0x42e0a0 EnterCriticalSection
0x42e0a4 GetLocalTime
0x42e0a8 GetProcessId
0x42e0ac LocalAlloc
0x42e0b0 SetCalendarInfoW
0x42e0b4 DnsHostnameToComputerNameA
0x42e0b8 CreateTapePartition
0x42e0bc SetConsoleDisplayMode
0x42e0c0 SetFileApisToANSI
0x42e0c4 GlobalGetAtomNameW
0x42e0c8 SetEnvironmentVariableA
0x42e0cc GetModuleHandleA
0x42e0d0 UpdateResourceW
0x42e0d4 CancelTimerQueueTimer
0x42e0d8 GetConsoleTitleW
0x42e0dc BuildCommDCBA
0x42e0e0 VirtualProtect
0x42e0e4 PeekConsoleInputA
0x42e0e8 FindFirstVolumeW
0x42e0ec GetSystemDefaultLangID
0x42e0f0 GetStartupInfoW
0x42e0f4 HeapAlloc
0x42e0f8 UnhandledExceptionFilter
0x42e0fc SetUnhandledExceptionFilter
0x42e100 GetModuleHandleW
0x42e104 TlsGetValue
0x42e108 TlsAlloc
0x42e10c TlsSetValue
0x42e110 TlsFree
0x42e114 SetLastError
0x42e118 GetCurrentThreadId
0x42e11c Sleep
0x42e120 ExitProcess
0x42e124 WriteFile
0x42e128 GetStdHandle
0x42e12c GetModuleFileNameA
0x42e130 FreeEnvironmentStringsW
0x42e134 GetCommandLineW
0x42e138 SetHandleCount
0x42e13c GetFileType
0x42e140 GetStartupInfoA
0x42e144 DeleteCriticalSection
0x42e148 HeapCreate
0x42e14c VirtualFree
0x42e150 HeapFree
0x42e154 QueryPerformanceCounter
0x42e158 GetTickCount
0x42e15c GetCurrentProcessId
0x42e160 GetSystemTimeAsFileTime
0x42e164 RaiseException
0x42e168 TerminateProcess
0x42e16c GetCurrentProcess
0x42e170 IsDebuggerPresent
0x42e174 LeaveCriticalSection
0x42e178 VirtualAlloc
0x42e17c HeapReAlloc
0x42e180 GetCPInfo
0x42e184 GetOEMCP
0x42e188 IsValidCodePage
0x42e18c RtlUnwind
0x42e190 LoadLibraryA
0x42e194 InitializeCriticalSectionAndSpinCount
0x42e198 GetLocaleInfoA
0x42e19c GetStringTypeA
0x42e1a0 MultiByteToWideChar
0x42e1a4 GetStringTypeW
0x42e1a8 LCMapStringA
0x42e1ac WideCharToMultiByte
0x42e1b0 LCMapStringW
0x42e1b4 HeapSize
USER32.dll
0x42e1bc RealGetWindowClassA
EAT(Export Address Table) is none
KERNEL32.dll
0x42e000 EnumDateFormatsExW
0x42e004 MoveFileExA
0x42e008 EndUpdateResourceW
0x42e00c InterlockedIncrement
0x42e010 InterlockedDecrement
0x42e014 ReadConsoleOutputAttribute
0x42e018 GetSystemWindowsDirectoryW
0x42e01c GetEnvironmentStringsW
0x42e020 GetUserDefaultLCID
0x42e024 WaitForSingleObject
0x42e028 SetConsoleScreenBufferSize
0x42e02c GetComputerNameW
0x42e030 SetEvent
0x42e034 GetConsoleAliasesLengthA
0x42e038 CreateActCtxW
0x42e03c GetConsoleCP
0x42e040 LocalShrink
0x42e044 ReadConsoleOutputW
0x42e048 GetVersionExW
0x42e04c GetFileAttributesA
0x42e050 lstrcpynW
0x42e054 GetConsoleAliasW
0x42e058 VerifyVersionInfoA
0x42e05c WriteConsoleW
0x42e060 WritePrivateProfileSectionW
0x42e064 IsBadWritePtr
0x42e068 ReadFile
0x42e06c GetModuleFileNameW
0x42e070 GetCompressedFileSizeA
0x42e074 GetSystemDirectoryA
0x42e078 CreateFileW
0x42e07c lstrcatA
0x42e080 GetACP
0x42e084 GetVolumePathNameA
0x42e088 lstrlenW
0x42e08c SetConsoleTitleA
0x42e090 VerifyVersionInfoW
0x42e094 InterlockedExchange
0x42e098 GetLastError
0x42e09c GetProcAddress
0x42e0a0 EnterCriticalSection
0x42e0a4 GetLocalTime
0x42e0a8 GetProcessId
0x42e0ac LocalAlloc
0x42e0b0 SetCalendarInfoW
0x42e0b4 DnsHostnameToComputerNameA
0x42e0b8 CreateTapePartition
0x42e0bc SetConsoleDisplayMode
0x42e0c0 SetFileApisToANSI
0x42e0c4 GlobalGetAtomNameW
0x42e0c8 SetEnvironmentVariableA
0x42e0cc GetModuleHandleA
0x42e0d0 UpdateResourceW
0x42e0d4 CancelTimerQueueTimer
0x42e0d8 GetConsoleTitleW
0x42e0dc BuildCommDCBA
0x42e0e0 VirtualProtect
0x42e0e4 PeekConsoleInputA
0x42e0e8 FindFirstVolumeW
0x42e0ec GetSystemDefaultLangID
0x42e0f0 GetStartupInfoW
0x42e0f4 HeapAlloc
0x42e0f8 UnhandledExceptionFilter
0x42e0fc SetUnhandledExceptionFilter
0x42e100 GetModuleHandleW
0x42e104 TlsGetValue
0x42e108 TlsAlloc
0x42e10c TlsSetValue
0x42e110 TlsFree
0x42e114 SetLastError
0x42e118 GetCurrentThreadId
0x42e11c Sleep
0x42e120 ExitProcess
0x42e124 WriteFile
0x42e128 GetStdHandle
0x42e12c GetModuleFileNameA
0x42e130 FreeEnvironmentStringsW
0x42e134 GetCommandLineW
0x42e138 SetHandleCount
0x42e13c GetFileType
0x42e140 GetStartupInfoA
0x42e144 DeleteCriticalSection
0x42e148 HeapCreate
0x42e14c VirtualFree
0x42e150 HeapFree
0x42e154 QueryPerformanceCounter
0x42e158 GetTickCount
0x42e15c GetCurrentProcessId
0x42e160 GetSystemTimeAsFileTime
0x42e164 RaiseException
0x42e168 TerminateProcess
0x42e16c GetCurrentProcess
0x42e170 IsDebuggerPresent
0x42e174 LeaveCriticalSection
0x42e178 VirtualAlloc
0x42e17c HeapReAlloc
0x42e180 GetCPInfo
0x42e184 GetOEMCP
0x42e188 IsValidCodePage
0x42e18c RtlUnwind
0x42e190 LoadLibraryA
0x42e194 InitializeCriticalSectionAndSpinCount
0x42e198 GetLocaleInfoA
0x42e19c GetStringTypeA
0x42e1a0 MultiByteToWideChar
0x42e1a4 GetStringTypeW
0x42e1a8 LCMapStringA
0x42e1ac WideCharToMultiByte
0x42e1b0 LCMapStringW
0x42e1b4 HeapSize
USER32.dll
0x42e1bc RealGetWindowClassA
EAT(Export Address Table) is none