ScreenShot
| Created | 2021.08.15 12:46 | Machine | s1_win7_x6402 |
| Filename | file.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 24 detected (malicious, high confidence, GenericRXPR, Unsafe, Save, ZexaF, MqW@a8WMSTkH, Attribute, HighConfidence, GenKryptik, FIZF, Static AI, Malicious PE, Score, Sabsik, Obscure, CLASSIC, Azorult, susgen, confidence, 100%, QVM10) | ||
| md5 | 4538e3df24ed8b8cd6a3474b2f0e1f74 | ||
| sha256 | 46c2df358cebea0eed3ae32167c399a445ce0f106f473997775889f8ac2ca733 | ||
| ssdeep | 12288:8LtsJ0XDsa21ugSSbujX45JbdSxqly5WxX8Vbc:ZJ0XyCU5JbWf8X8VY | ||
| imphash | 7516bd35cc21aff34ab4b704c018e246 | ||
| impfuzzy | 48:Cz2wRjXshWrZ/JU8qHYKZEXjaEBcftgJX8+aadVN:dw7deHBZEXGEBcftgJX8+jdVN | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 GetComputerNameA
0x41f008 GetThreadContext
0x41f00c EnumResourceNamesW
0x41f010 UnregisterWait
0x41f014 WriteConsoleInputW
0x41f018 SetFilePointer
0x41f01c lstrlenA
0x41f020 GetQueuedCompletionStatus
0x41f024 InterlockedDecrement
0x41f028 CompareFileTime
0x41f02c CreateDirectoryW
0x41f030 GlobalLock
0x41f034 OpenSemaphoreA
0x41f038 FreeEnvironmentStringsA
0x41f03c GetTickCount
0x41f040 GetConsoleAliasesLengthA
0x41f044 WaitNamedPipeW
0x41f048 WriteFile
0x41f04c GetPriorityClass
0x41f050 AddRefActCtx
0x41f054 LoadLibraryW
0x41f058 GetConsoleMode
0x41f05c TerminateThread
0x41f060 CopyFileW
0x41f064 GetSystemWow64DirectoryW
0x41f068 IsProcessorFeaturePresent
0x41f06c CreateSemaphoreA
0x41f070 IsDBCSLeadByte
0x41f074 GetModuleFileNameW
0x41f078 GetOverlappedResult
0x41f07c CompareStringW
0x41f080 LCMapStringA
0x41f084 GetFileSizeEx
0x41f088 SetCurrentDirectoryA
0x41f08c GetStartupInfoA
0x41f090 GetCPInfoExW
0x41f094 OpenMutexW
0x41f098 GetHandleInformation
0x41f09c GetCurrentDirectoryW
0x41f0a0 SetLastError
0x41f0a4 GetProcAddress
0x41f0a8 VirtualAlloc
0x41f0ac ReadFileEx
0x41f0b0 GetPrivateProfileStringA
0x41f0b4 ResetEvent
0x41f0b8 LoadLibraryA
0x41f0bc GetConsoleScreenBufferInfo
0x41f0c0 LocalAlloc
0x41f0c4 PostQueuedCompletionStatus
0x41f0c8 WriteProfileSectionW
0x41f0cc FindAtomA
0x41f0d0 HeapSetInformation
0x41f0d4 GetConsoleCursorInfo
0x41f0d8 FatalAppExitA
0x41f0dc SetThreadAffinityMask
0x41f0e0 GetVersionExA
0x41f0e4 TlsAlloc
0x41f0e8 FindAtomW
0x41f0ec GetSystemTime
0x41f0f0 CopyFileExA
0x41f0f4 GetStartupInfoW
0x41f0f8 HeapValidate
0x41f0fc IsBadReadPtr
0x41f100 RaiseException
0x41f104 EnterCriticalSection
0x41f108 LeaveCriticalSection
0x41f10c TerminateProcess
0x41f110 GetCurrentProcess
0x41f114 UnhandledExceptionFilter
0x41f118 SetUnhandledExceptionFilter
0x41f11c IsDebuggerPresent
0x41f120 DeleteCriticalSection
0x41f124 QueryPerformanceCounter
0x41f128 GetCurrentThreadId
0x41f12c GetCurrentProcessId
0x41f130 GetSystemTimeAsFileTime
0x41f134 GetModuleHandleW
0x41f138 Sleep
0x41f13c InterlockedIncrement
0x41f140 ExitProcess
0x41f144 FreeEnvironmentStringsW
0x41f148 GetEnvironmentStringsW
0x41f14c SetHandleCount
0x41f150 GetStdHandle
0x41f154 GetFileType
0x41f158 TlsGetValue
0x41f15c TlsSetValue
0x41f160 TlsFree
0x41f164 GetLastError
0x41f168 HeapDestroy
0x41f16c HeapCreate
0x41f170 HeapFree
0x41f174 VirtualFree
0x41f178 GetModuleFileNameA
0x41f17c HeapAlloc
0x41f180 HeapSize
0x41f184 HeapReAlloc
0x41f188 GetACP
0x41f18c GetOEMCP
0x41f190 GetCPInfo
0x41f194 IsValidCodePage
0x41f198 RtlUnwind
0x41f19c DebugBreak
0x41f1a0 OutputDebugStringA
0x41f1a4 WriteConsoleW
0x41f1a8 OutputDebugStringW
0x41f1ac MultiByteToWideChar
0x41f1b0 InitializeCriticalSectionAndSpinCount
0x41f1b4 WideCharToMultiByte
0x41f1b8 LCMapStringW
0x41f1bc GetStringTypeA
0x41f1c0 GetStringTypeW
0x41f1c4 GetLocaleInfoA
0x41f1c8 FlushFileBuffers
0x41f1cc GetConsoleCP
0x41f1d0 ReadFile
0x41f1d4 CloseHandle
0x41f1d8 SetStdHandle
0x41f1dc WriteConsoleA
0x41f1e0 GetConsoleOutputCP
0x41f1e4 CreateFileA
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 GetComputerNameA
0x41f008 GetThreadContext
0x41f00c EnumResourceNamesW
0x41f010 UnregisterWait
0x41f014 WriteConsoleInputW
0x41f018 SetFilePointer
0x41f01c lstrlenA
0x41f020 GetQueuedCompletionStatus
0x41f024 InterlockedDecrement
0x41f028 CompareFileTime
0x41f02c CreateDirectoryW
0x41f030 GlobalLock
0x41f034 OpenSemaphoreA
0x41f038 FreeEnvironmentStringsA
0x41f03c GetTickCount
0x41f040 GetConsoleAliasesLengthA
0x41f044 WaitNamedPipeW
0x41f048 WriteFile
0x41f04c GetPriorityClass
0x41f050 AddRefActCtx
0x41f054 LoadLibraryW
0x41f058 GetConsoleMode
0x41f05c TerminateThread
0x41f060 CopyFileW
0x41f064 GetSystemWow64DirectoryW
0x41f068 IsProcessorFeaturePresent
0x41f06c CreateSemaphoreA
0x41f070 IsDBCSLeadByte
0x41f074 GetModuleFileNameW
0x41f078 GetOverlappedResult
0x41f07c CompareStringW
0x41f080 LCMapStringA
0x41f084 GetFileSizeEx
0x41f088 SetCurrentDirectoryA
0x41f08c GetStartupInfoA
0x41f090 GetCPInfoExW
0x41f094 OpenMutexW
0x41f098 GetHandleInformation
0x41f09c GetCurrentDirectoryW
0x41f0a0 SetLastError
0x41f0a4 GetProcAddress
0x41f0a8 VirtualAlloc
0x41f0ac ReadFileEx
0x41f0b0 GetPrivateProfileStringA
0x41f0b4 ResetEvent
0x41f0b8 LoadLibraryA
0x41f0bc GetConsoleScreenBufferInfo
0x41f0c0 LocalAlloc
0x41f0c4 PostQueuedCompletionStatus
0x41f0c8 WriteProfileSectionW
0x41f0cc FindAtomA
0x41f0d0 HeapSetInformation
0x41f0d4 GetConsoleCursorInfo
0x41f0d8 FatalAppExitA
0x41f0dc SetThreadAffinityMask
0x41f0e0 GetVersionExA
0x41f0e4 TlsAlloc
0x41f0e8 FindAtomW
0x41f0ec GetSystemTime
0x41f0f0 CopyFileExA
0x41f0f4 GetStartupInfoW
0x41f0f8 HeapValidate
0x41f0fc IsBadReadPtr
0x41f100 RaiseException
0x41f104 EnterCriticalSection
0x41f108 LeaveCriticalSection
0x41f10c TerminateProcess
0x41f110 GetCurrentProcess
0x41f114 UnhandledExceptionFilter
0x41f118 SetUnhandledExceptionFilter
0x41f11c IsDebuggerPresent
0x41f120 DeleteCriticalSection
0x41f124 QueryPerformanceCounter
0x41f128 GetCurrentThreadId
0x41f12c GetCurrentProcessId
0x41f130 GetSystemTimeAsFileTime
0x41f134 GetModuleHandleW
0x41f138 Sleep
0x41f13c InterlockedIncrement
0x41f140 ExitProcess
0x41f144 FreeEnvironmentStringsW
0x41f148 GetEnvironmentStringsW
0x41f14c SetHandleCount
0x41f150 GetStdHandle
0x41f154 GetFileType
0x41f158 TlsGetValue
0x41f15c TlsSetValue
0x41f160 TlsFree
0x41f164 GetLastError
0x41f168 HeapDestroy
0x41f16c HeapCreate
0x41f170 HeapFree
0x41f174 VirtualFree
0x41f178 GetModuleFileNameA
0x41f17c HeapAlloc
0x41f180 HeapSize
0x41f184 HeapReAlloc
0x41f188 GetACP
0x41f18c GetOEMCP
0x41f190 GetCPInfo
0x41f194 IsValidCodePage
0x41f198 RtlUnwind
0x41f19c DebugBreak
0x41f1a0 OutputDebugStringA
0x41f1a4 WriteConsoleW
0x41f1a8 OutputDebugStringW
0x41f1ac MultiByteToWideChar
0x41f1b0 InitializeCriticalSectionAndSpinCount
0x41f1b4 WideCharToMultiByte
0x41f1b8 LCMapStringW
0x41f1bc GetStringTypeA
0x41f1c0 GetStringTypeW
0x41f1c4 GetLocaleInfoA
0x41f1c8 FlushFileBuffers
0x41f1cc GetConsoleCP
0x41f1d0 ReadFile
0x41f1d4 CloseHandle
0x41f1d8 SetStdHandle
0x41f1dc WriteConsoleA
0x41f1e0 GetConsoleOutputCP
0x41f1e4 CreateFileA
EAT(Export Address Table) is none