ScreenShot
| Created | 2021.08.16 10:45 | Machine | s1_win7_x6402 |
| Filename | file.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 15 detected (Johnnie, malicious, Generic ML PUA, ai score=84, Sabsik, score, QVM41) | ||
| md5 | 7eb6505eaf18fd1b29a09f3c52a4f678 | ||
| sha256 | 89ba3afda1cec9c96eb1eb933fd09f346804e8c7df46b10fc384cc8762d64582 | ||
| ssdeep | 24576:a20gPgFKKcYbNroq5aG3vmQxAVBbIcXU2:LKFyURxAjIEU2 | ||
| imphash | 4cfda23baf1e2e983ddfeca47a5c755a | ||
| impfuzzy | 96:dbq8fi+fcmX1nd5pIiOL5EpIAHdZqWI8NuKkZsD:s6FaibpHdIWRNZhD | ||
Network IP location
Signature (37cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Deletes executed files from disk |
| watch | Executes one or more WMI queries |
| watch | File has been identified by 15 AntiVirus engines on VirusTotal as malicious |
| watch | Harvests credentials from local FTP client softwares |
| watch | One or more non-whitelisted processes were created |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | The process wscript.exe wrote an executable file to disk |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Queries for potentially installed applications |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | This executable has a PDB path |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (18cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (7cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
SURICATA HTTP unable to match response to request
SURICATA HTTP unable to match response to request
PE API
IAT(Import Address Table) Library
COMCTL32.dll
0x42a028 InitCommonControlsEx
SHLWAPI.dll
0x42a298 SHAutoComplete
KERNEL32.dll
0x42a068 FindClose
0x42a06c FindNextFileW
0x42a070 FindFirstFileW
0x42a074 GetVersionExW
0x42a078 GetCurrentDirectoryW
0x42a07c GetFullPathNameW
0x42a080 GetModuleFileNameW
0x42a084 FindResourceW
0x42a088 GetModuleHandleW
0x42a08c FreeLibrary
0x42a090 GetProcAddress
0x42a094 LoadLibraryW
0x42a098 GetCurrentProcessId
0x42a09c GetLocaleInfoW
0x42a0a0 GetNumberFormatW
0x42a0a4 SetEnvironmentVariableW
0x42a0a8 ExpandEnvironmentStringsW
0x42a0ac WaitForSingleObject
0x42a0b0 GetDateFormatW
0x42a0b4 GetTimeFormatW
0x42a0b8 FileTimeToSystemTime
0x42a0bc FileTimeToLocalFileTime
0x42a0c0 GetExitCodeProcess
0x42a0c4 GetTempPathW
0x42a0c8 MoveFileExW
0x42a0cc UnmapViewOfFile
0x42a0d0 Sleep
0x42a0d4 MapViewOfFile
0x42a0d8 GetCommandLineW
0x42a0dc CreateFileMappingW
0x42a0e0 GetTickCount
0x42a0e4 OpenFileMappingW
0x42a0e8 InitializeCriticalSection
0x42a0ec DeleteCriticalSection
0x42a0f0 EnterCriticalSection
0x42a0f4 LeaveCriticalSection
0x42a0f8 CreateThread
0x42a0fc GetProcessAffinityMask
0x42a100 CreateEventW
0x42a104 CreateSemaphoreW
0x42a108 ReleaseSemaphore
0x42a10c ResetEvent
0x42a110 SetEvent
0x42a114 SetThreadPriority
0x42a118 SystemTimeToFileTime
0x42a11c GetSystemTime
0x42a120 SystemTimeToTzSpecificLocalTime
0x42a124 TzSpecificLocalTimeToSystemTime
0x42a128 LocalFileTimeToFileTime
0x42a12c WideCharToMultiByte
0x42a130 MultiByteToWideChar
0x42a134 CompareStringW
0x42a138 IsDBCSLeadByte
0x42a13c SetFileTime
0x42a140 SetFileAttributesW
0x42a144 SetCurrentDirectoryW
0x42a148 WriteConsoleW
0x42a14c GetConsoleOutputCP
0x42a150 WriteConsoleA
0x42a154 SetStdHandle
0x42a158 GetLocaleInfoA
0x42a15c GetStringTypeW
0x42a160 GetStringTypeA
0x42a164 LoadLibraryA
0x42a168 GetConsoleMode
0x42a16c GetConsoleCP
0x42a170 InitializeCriticalSectionAndSpinCount
0x42a174 QueryPerformanceCounter
0x42a178 SetHandleCount
0x42a17c GetEnvironmentStringsW
0x42a180 FreeEnvironmentStringsW
0x42a184 GetEnvironmentStrings
0x42a188 FreeEnvironmentStringsA
0x42a18c GetModuleHandleA
0x42a190 LCMapStringW
0x42a194 LCMapStringA
0x42a198 IsValidCodePage
0x42a19c GetOEMCP
0x42a1a0 GetACP
0x42a1a4 GetModuleFileNameA
0x42a1a8 ExitProcess
0x42a1ac HeapSize
0x42a1b0 IsDebuggerPresent
0x42a1b4 SetUnhandledExceptionFilter
0x42a1b8 UnhandledExceptionFilter
0x42a1bc TerminateProcess
0x42a1c0 VirtualAlloc
0x42a1c4 VirtualFree
0x42a1c8 HeapCreate
0x42a1cc InterlockedDecrement
0x42a1d0 GetCurrentThreadId
0x42a1d4 InterlockedIncrement
0x42a1d8 TlsFree
0x42a1dc TlsSetValue
0x42a1e0 TlsAlloc
0x42a1e4 TlsGetValue
0x42a1e8 GetStartupInfoA
0x42a1ec GetCommandLineA
0x42a1f0 RaiseException
0x42a1f4 GetFileAttributesW
0x42a1f8 FlushFileBuffers
0x42a1fc ReadFile
0x42a200 GetFileType
0x42a204 SetEndOfFile
0x42a208 SetFilePointer
0x42a20c WriteFile
0x42a210 GetStdHandle
0x42a214 GetLongPathNameW
0x42a218 GetShortPathNameW
0x42a21c GlobalAlloc
0x42a220 MoveFileW
0x42a224 CreateFileW
0x42a228 CreateDirectoryW
0x42a22c DeviceIoControl
0x42a230 RemoveDirectoryW
0x42a234 DeleteFileW
0x42a238 CreateHardLinkW
0x42a23c GetCurrentProcess
0x42a240 CloseHandle
0x42a244 SetLastError
0x42a248 GetLastError
0x42a24c CreateFileA
0x42a250 GetCPInfo
0x42a254 GetSystemTimeAsFileTime
0x42a258 HeapAlloc
0x42a25c HeapReAlloc
0x42a260 HeapFree
0x42a264 RtlUnwind
USER32.dll
0x42a2a0 EnableWindow
0x42a2a4 GetDlgItem
0x42a2a8 ShowWindow
0x42a2ac SetWindowLongW
0x42a2b0 GetDC
0x42a2b4 ReleaseDC
0x42a2b8 FindWindowExW
0x42a2bc GetParent
0x42a2c0 MapWindowPoints
0x42a2c4 CreateWindowExW
0x42a2c8 UpdateWindow
0x42a2cc LoadCursorW
0x42a2d0 RegisterClassExW
0x42a2d4 DefWindowProcW
0x42a2d8 DestroyWindow
0x42a2dc CopyRect
0x42a2e0 IsWindow
0x42a2e4 CharUpperW
0x42a2e8 OemToCharBuffA
0x42a2ec LoadIconW
0x42a2f0 LoadBitmapW
0x42a2f4 PostMessageW
0x42a2f8 GetSysColor
0x42a2fc SetForegroundWindow
0x42a300 MessageBoxW
0x42a304 WaitForInputIdle
0x42a308 IsWindowVisible
0x42a30c DialogBoxParamW
0x42a310 DestroyIcon
0x42a314 SetFocus
0x42a318 GetClassNameW
0x42a31c SendDlgItemMessageW
0x42a320 EndDialog
0x42a324 GetDlgItemTextW
0x42a328 SetDlgItemTextW
0x42a32c wvsprintfW
0x42a330 SendMessageW
0x42a334 PeekMessageW
0x42a338 GetMessageW
0x42a33c TranslateMessage
0x42a340 DispatchMessageW
0x42a344 LoadStringW
0x42a348 GetWindowRect
0x42a34c GetClientRect
0x42a350 SetWindowPos
0x42a354 GetWindowTextW
0x42a358 SetWindowTextW
0x42a35c GetSystemMetrics
0x42a360 GetWindow
0x42a364 GetWindowLongW
GDI32.dll
0x42a040 GetDeviceCaps
0x42a044 CreateCompatibleDC
0x42a048 CreateCompatibleBitmap
0x42a04c SelectObject
0x42a050 StretchBlt
0x42a054 DeleteDC
0x42a058 GetObjectW
0x42a05c DeleteObject
0x42a060 CreateDIBSection
COMDLG32.dll
0x42a030 GetSaveFileNameW
0x42a034 CommDlgExtendedError
0x42a038 GetOpenFileNameW
ADVAPI32.dll
0x42a000 RegOpenKeyExW
0x42a004 RegQueryValueExW
0x42a008 RegCreateKeyExW
0x42a00c RegSetValueExW
0x42a010 RegCloseKey
0x42a014 SetFileSecurityW
0x42a018 OpenProcessToken
0x42a01c LookupPrivilegeValueW
0x42a020 AdjustTokenPrivileges
SHELL32.dll
0x42a274 SHBrowseForFolderW
0x42a278 ShellExecuteExW
0x42a27c SHGetSpecialFolderLocation
0x42a280 SHFileOperationW
0x42a284 SHGetPathFromIDListW
0x42a288 SHGetMalloc
0x42a28c SHChangeNotify
0x42a290 SHGetFileInfoW
ole32.dll
0x42a36c CLSIDFromString
0x42a370 CoCreateInstance
0x42a374 OleInitialize
0x42a378 OleUninitialize
0x42a37c CreateStreamOnHGlobal
OLEAUT32.dll
0x42a26c VariantInit
EAT(Export Address Table) Library
COMCTL32.dll
0x42a028 InitCommonControlsEx
SHLWAPI.dll
0x42a298 SHAutoComplete
KERNEL32.dll
0x42a068 FindClose
0x42a06c FindNextFileW
0x42a070 FindFirstFileW
0x42a074 GetVersionExW
0x42a078 GetCurrentDirectoryW
0x42a07c GetFullPathNameW
0x42a080 GetModuleFileNameW
0x42a084 FindResourceW
0x42a088 GetModuleHandleW
0x42a08c FreeLibrary
0x42a090 GetProcAddress
0x42a094 LoadLibraryW
0x42a098 GetCurrentProcessId
0x42a09c GetLocaleInfoW
0x42a0a0 GetNumberFormatW
0x42a0a4 SetEnvironmentVariableW
0x42a0a8 ExpandEnvironmentStringsW
0x42a0ac WaitForSingleObject
0x42a0b0 GetDateFormatW
0x42a0b4 GetTimeFormatW
0x42a0b8 FileTimeToSystemTime
0x42a0bc FileTimeToLocalFileTime
0x42a0c0 GetExitCodeProcess
0x42a0c4 GetTempPathW
0x42a0c8 MoveFileExW
0x42a0cc UnmapViewOfFile
0x42a0d0 Sleep
0x42a0d4 MapViewOfFile
0x42a0d8 GetCommandLineW
0x42a0dc CreateFileMappingW
0x42a0e0 GetTickCount
0x42a0e4 OpenFileMappingW
0x42a0e8 InitializeCriticalSection
0x42a0ec DeleteCriticalSection
0x42a0f0 EnterCriticalSection
0x42a0f4 LeaveCriticalSection
0x42a0f8 CreateThread
0x42a0fc GetProcessAffinityMask
0x42a100 CreateEventW
0x42a104 CreateSemaphoreW
0x42a108 ReleaseSemaphore
0x42a10c ResetEvent
0x42a110 SetEvent
0x42a114 SetThreadPriority
0x42a118 SystemTimeToFileTime
0x42a11c GetSystemTime
0x42a120 SystemTimeToTzSpecificLocalTime
0x42a124 TzSpecificLocalTimeToSystemTime
0x42a128 LocalFileTimeToFileTime
0x42a12c WideCharToMultiByte
0x42a130 MultiByteToWideChar
0x42a134 CompareStringW
0x42a138 IsDBCSLeadByte
0x42a13c SetFileTime
0x42a140 SetFileAttributesW
0x42a144 SetCurrentDirectoryW
0x42a148 WriteConsoleW
0x42a14c GetConsoleOutputCP
0x42a150 WriteConsoleA
0x42a154 SetStdHandle
0x42a158 GetLocaleInfoA
0x42a15c GetStringTypeW
0x42a160 GetStringTypeA
0x42a164 LoadLibraryA
0x42a168 GetConsoleMode
0x42a16c GetConsoleCP
0x42a170 InitializeCriticalSectionAndSpinCount
0x42a174 QueryPerformanceCounter
0x42a178 SetHandleCount
0x42a17c GetEnvironmentStringsW
0x42a180 FreeEnvironmentStringsW
0x42a184 GetEnvironmentStrings
0x42a188 FreeEnvironmentStringsA
0x42a18c GetModuleHandleA
0x42a190 LCMapStringW
0x42a194 LCMapStringA
0x42a198 IsValidCodePage
0x42a19c GetOEMCP
0x42a1a0 GetACP
0x42a1a4 GetModuleFileNameA
0x42a1a8 ExitProcess
0x42a1ac HeapSize
0x42a1b0 IsDebuggerPresent
0x42a1b4 SetUnhandledExceptionFilter
0x42a1b8 UnhandledExceptionFilter
0x42a1bc TerminateProcess
0x42a1c0 VirtualAlloc
0x42a1c4 VirtualFree
0x42a1c8 HeapCreate
0x42a1cc InterlockedDecrement
0x42a1d0 GetCurrentThreadId
0x42a1d4 InterlockedIncrement
0x42a1d8 TlsFree
0x42a1dc TlsSetValue
0x42a1e0 TlsAlloc
0x42a1e4 TlsGetValue
0x42a1e8 GetStartupInfoA
0x42a1ec GetCommandLineA
0x42a1f0 RaiseException
0x42a1f4 GetFileAttributesW
0x42a1f8 FlushFileBuffers
0x42a1fc ReadFile
0x42a200 GetFileType
0x42a204 SetEndOfFile
0x42a208 SetFilePointer
0x42a20c WriteFile
0x42a210 GetStdHandle
0x42a214 GetLongPathNameW
0x42a218 GetShortPathNameW
0x42a21c GlobalAlloc
0x42a220 MoveFileW
0x42a224 CreateFileW
0x42a228 CreateDirectoryW
0x42a22c DeviceIoControl
0x42a230 RemoveDirectoryW
0x42a234 DeleteFileW
0x42a238 CreateHardLinkW
0x42a23c GetCurrentProcess
0x42a240 CloseHandle
0x42a244 SetLastError
0x42a248 GetLastError
0x42a24c CreateFileA
0x42a250 GetCPInfo
0x42a254 GetSystemTimeAsFileTime
0x42a258 HeapAlloc
0x42a25c HeapReAlloc
0x42a260 HeapFree
0x42a264 RtlUnwind
USER32.dll
0x42a2a0 EnableWindow
0x42a2a4 GetDlgItem
0x42a2a8 ShowWindow
0x42a2ac SetWindowLongW
0x42a2b0 GetDC
0x42a2b4 ReleaseDC
0x42a2b8 FindWindowExW
0x42a2bc GetParent
0x42a2c0 MapWindowPoints
0x42a2c4 CreateWindowExW
0x42a2c8 UpdateWindow
0x42a2cc LoadCursorW
0x42a2d0 RegisterClassExW
0x42a2d4 DefWindowProcW
0x42a2d8 DestroyWindow
0x42a2dc CopyRect
0x42a2e0 IsWindow
0x42a2e4 CharUpperW
0x42a2e8 OemToCharBuffA
0x42a2ec LoadIconW
0x42a2f0 LoadBitmapW
0x42a2f4 PostMessageW
0x42a2f8 GetSysColor
0x42a2fc SetForegroundWindow
0x42a300 MessageBoxW
0x42a304 WaitForInputIdle
0x42a308 IsWindowVisible
0x42a30c DialogBoxParamW
0x42a310 DestroyIcon
0x42a314 SetFocus
0x42a318 GetClassNameW
0x42a31c SendDlgItemMessageW
0x42a320 EndDialog
0x42a324 GetDlgItemTextW
0x42a328 SetDlgItemTextW
0x42a32c wvsprintfW
0x42a330 SendMessageW
0x42a334 PeekMessageW
0x42a338 GetMessageW
0x42a33c TranslateMessage
0x42a340 DispatchMessageW
0x42a344 LoadStringW
0x42a348 GetWindowRect
0x42a34c GetClientRect
0x42a350 SetWindowPos
0x42a354 GetWindowTextW
0x42a358 SetWindowTextW
0x42a35c GetSystemMetrics
0x42a360 GetWindow
0x42a364 GetWindowLongW
GDI32.dll
0x42a040 GetDeviceCaps
0x42a044 CreateCompatibleDC
0x42a048 CreateCompatibleBitmap
0x42a04c SelectObject
0x42a050 StretchBlt
0x42a054 DeleteDC
0x42a058 GetObjectW
0x42a05c DeleteObject
0x42a060 CreateDIBSection
COMDLG32.dll
0x42a030 GetSaveFileNameW
0x42a034 CommDlgExtendedError
0x42a038 GetOpenFileNameW
ADVAPI32.dll
0x42a000 RegOpenKeyExW
0x42a004 RegQueryValueExW
0x42a008 RegCreateKeyExW
0x42a00c RegSetValueExW
0x42a010 RegCloseKey
0x42a014 SetFileSecurityW
0x42a018 OpenProcessToken
0x42a01c LookupPrivilegeValueW
0x42a020 AdjustTokenPrivileges
SHELL32.dll
0x42a274 SHBrowseForFolderW
0x42a278 ShellExecuteExW
0x42a27c SHGetSpecialFolderLocation
0x42a280 SHFileOperationW
0x42a284 SHGetPathFromIDListW
0x42a288 SHGetMalloc
0x42a28c SHChangeNotify
0x42a290 SHGetFileInfoW
ole32.dll
0x42a36c CLSIDFromString
0x42a370 CoCreateInstance
0x42a374 OleInitialize
0x42a378 OleUninitialize
0x42a37c CreateStreamOnHGlobal
OLEAUT32.dll
0x42a26c VariantInit
EAT(Export Address Table) Library