ScreenShot
| Created | 2021.08.16 17:07 | Machine | s1_win7_x6402 |
| Filename | clr.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 13 detected (malicious, high confidence, a variant of WinGo, GoCLR, Bulz, gzxxe, Unsafe, Score, 100%, Sabsik, HackTool, CLASSIC, confidence) | ||
| md5 | 508167b2c34732f05f11f2531b2498a2 | ||
| sha256 | f7abcbdb4896f995674c927c3e3b46fbf40125c26cc8ebb09d88ee0d71d4a25f | ||
| ssdeep | 49152:P8L4dlrb/TkvO90dL3BmAFd4A64nsfJ9uB5q9FbvbhZdGDSj0uBTfA6VzHv3+6kP:P80Du3mAQQQQQQQQQQQQQ | ||
| imphash | c7269d59926fa4252270f407e4dab043 | ||
| impfuzzy | 24:UbVjhN5O+VuT2oLtXOr6kwmDruMztxdEr6tP:K5O+VAXOmGx0oP | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | Detects the presence of Wine emulator |
| watch | File has been identified by 13 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | NPKI_Zero | File included NPKI | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0x9aa020 WriteFile
0x9aa028 WriteConsoleW
0x9aa030 WaitForMultipleObjects
0x9aa038 WaitForSingleObject
0x9aa040 VirtualQuery
0x9aa048 VirtualFree
0x9aa050 VirtualAlloc
0x9aa058 SwitchToThread
0x9aa060 SuspendThread
0x9aa068 Sleep
0x9aa070 SetWaitableTimer
0x9aa078 SetUnhandledExceptionFilter
0x9aa080 SetProcessPriorityBoost
0x9aa088 SetEvent
0x9aa090 SetErrorMode
0x9aa098 SetConsoleCtrlHandler
0x9aa0a0 ResumeThread
0x9aa0a8 PostQueuedCompletionStatus
0x9aa0b0 LoadLibraryA
0x9aa0b8 LoadLibraryW
0x9aa0c0 SetThreadContext
0x9aa0c8 GetThreadContext
0x9aa0d0 GetSystemInfo
0x9aa0d8 GetSystemDirectoryA
0x9aa0e0 GetStdHandle
0x9aa0e8 GetQueuedCompletionStatusEx
0x9aa0f0 GetProcessAffinityMask
0x9aa0f8 GetProcAddress
0x9aa100 GetEnvironmentStringsW
0x9aa108 GetConsoleMode
0x9aa110 FreeEnvironmentStringsW
0x9aa118 ExitProcess
0x9aa120 DuplicateHandle
0x9aa128 CreateWaitableTimerExW
0x9aa130 CreateThread
0x9aa138 CreateIoCompletionPort
0x9aa140 CreateFileA
0x9aa148 CreateEventA
0x9aa150 CloseHandle
0x9aa158 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x9aa020 WriteFile
0x9aa028 WriteConsoleW
0x9aa030 WaitForMultipleObjects
0x9aa038 WaitForSingleObject
0x9aa040 VirtualQuery
0x9aa048 VirtualFree
0x9aa050 VirtualAlloc
0x9aa058 SwitchToThread
0x9aa060 SuspendThread
0x9aa068 Sleep
0x9aa070 SetWaitableTimer
0x9aa078 SetUnhandledExceptionFilter
0x9aa080 SetProcessPriorityBoost
0x9aa088 SetEvent
0x9aa090 SetErrorMode
0x9aa098 SetConsoleCtrlHandler
0x9aa0a0 ResumeThread
0x9aa0a8 PostQueuedCompletionStatus
0x9aa0b0 LoadLibraryA
0x9aa0b8 LoadLibraryW
0x9aa0c0 SetThreadContext
0x9aa0c8 GetThreadContext
0x9aa0d0 GetSystemInfo
0x9aa0d8 GetSystemDirectoryA
0x9aa0e0 GetStdHandle
0x9aa0e8 GetQueuedCompletionStatusEx
0x9aa0f0 GetProcessAffinityMask
0x9aa0f8 GetProcAddress
0x9aa100 GetEnvironmentStringsW
0x9aa108 GetConsoleMode
0x9aa110 FreeEnvironmentStringsW
0x9aa118 ExitProcess
0x9aa120 DuplicateHandle
0x9aa128 CreateWaitableTimerExW
0x9aa130 CreateThread
0x9aa138 CreateIoCompletionPort
0x9aa140 CreateFileA
0x9aa148 CreateEventA
0x9aa150 CloseHandle
0x9aa158 AddVectoredExceptionHandler
EAT(Export Address Table) is none