ScreenShot
| Created | 2021.08.20 09:54 | Machine | s1_win7_x6402 |
| Filename | 2084414845.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 50 detected (AIDetect, malware2, Malicious, high confidence, Siggen3, GenericKD, Unsafe, Save, GenKryptik, ZexaF, rq0@a4blo4hG, Kryptik, Eldorado, Attribute, HighConfidence, HMCH, RansomX, Jaik, HPGen, Emotet, S + Troj, Krypt, RedLineSteal, qhsrs, ai score=89, PSWTroj, kcloud, Mokes, QGYM9G, score, CoinMiner, Glupteba, R437490, BScope, CLASSIC, Static AI, Malicious PE, FJEX, GdSda, confidence, HgIASacA) | ||
| md5 | af23965c3e2673940b70f436bb45f766 | ||
| sha256 | e6271d738fc78602abc8916fb4742638b2b4c4205882f6db24eb361694c67503 | ||
| ssdeep | 6144:YLNPIeg2xzIZ7T+0lNNdMW1sP+Zc/mjCz:Y6HYzc7i011sx | ||
| imphash | 675f985c31bb43cb925f7664d8fe06b7 | ||
| impfuzzy | 48:kQPEcr5LEWdooiPFWY+rJtOPQc7kuHcnH2c:k0rdJooiP+rJtOPQc7pcnHj | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 50 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42e008 EnumDateFormatsExW
0x42e00c MoveFileExA
0x42e010 EndUpdateResourceW
0x42e014 InterlockedIncrement
0x42e018 GetConsoleAliasA
0x42e01c InterlockedDecrement
0x42e020 WritePrivateProfileSectionA
0x42e024 GetSystemWindowsDirectoryW
0x42e028 GetEnvironmentStringsW
0x42e02c WaitForSingleObject
0x42e030 SetConsoleScreenBufferSize
0x42e034 GetComputerNameW
0x42e038 SetEvent
0x42e03c GetConsoleAliasesLengthA
0x42e040 GetConsoleTitleA
0x42e044 ReadConsoleOutputA
0x42e048 GetUserDefaultLangID
0x42e04c CreateActCtxW
0x42e050 GetConsoleCP
0x42e054 LocalShrink
0x42e058 GetVersionExW
0x42e05c GetFileAttributesA
0x42e060 DnsHostnameToComputerNameW
0x42e064 lstrcpynW
0x42e068 VerifyVersionInfoA
0x42e06c IsBadWritePtr
0x42e070 GetModuleFileNameW
0x42e074 GetCompressedFileSizeA
0x42e078 GetSystemDirectoryA
0x42e07c lstrcatA
0x42e080 GetACP
0x42e084 GetVolumePathNameA
0x42e088 lstrlenW
0x42e08c SetConsoleTitleA
0x42e090 FlushFileBuffers
0x42e094 InterlockedExchange
0x42e098 GetLastError
0x42e09c GetProcAddress
0x42e0a0 BeginUpdateResourceW
0x42e0a4 LocalLock
0x42e0a8 EnterCriticalSection
0x42e0ac GetLocalTime
0x42e0b0 WriteConsoleA
0x42e0b4 GetProcessId
0x42e0b8 LocalAlloc
0x42e0bc SetCalendarInfoW
0x42e0c0 CreateTapePartition
0x42e0c4 SetConsoleDisplayMode
0x42e0c8 GlobalGetAtomNameW
0x42e0cc SetEnvironmentVariableA
0x42e0d0 GetModuleHandleA
0x42e0d4 CancelTimerQueueTimer
0x42e0d8 BuildCommDCBA
0x42e0dc VirtualProtect
0x42e0e0 PeekConsoleInputA
0x42e0e4 WriteConsoleOutputAttribute
0x42e0e8 FindFirstVolumeW
0x42e0ec AreFileApisANSI
0x42e0f0 LCMapStringW
0x42e0f4 CreateFileW
0x42e0f8 GetSystemDefaultLangID
0x42e0fc UnhandledExceptionFilter
0x42e100 SetUnhandledExceptionFilter
0x42e104 GetModuleHandleW
0x42e108 Sleep
0x42e10c ExitProcess
0x42e110 GetStartupInfoW
0x42e114 WriteFile
0x42e118 GetStdHandle
0x42e11c GetModuleFileNameA
0x42e120 HeapAlloc
0x42e124 TlsGetValue
0x42e128 TlsAlloc
0x42e12c TlsSetValue
0x42e130 TlsFree
0x42e134 SetLastError
0x42e138 GetCurrentThreadId
0x42e13c DeleteCriticalSection
0x42e140 LeaveCriticalSection
0x42e144 TerminateProcess
0x42e148 GetCurrentProcess
0x42e14c IsDebuggerPresent
0x42e150 LoadLibraryA
0x42e154 InitializeCriticalSectionAndSpinCount
0x42e158 FreeEnvironmentStringsW
0x42e15c GetCommandLineW
0x42e160 SetHandleCount
0x42e164 GetFileType
0x42e168 GetStartupInfoA
0x42e16c HeapCreate
0x42e170 VirtualFree
0x42e174 HeapFree
0x42e178 QueryPerformanceCounter
0x42e17c GetTickCount
0x42e180 GetCurrentProcessId
0x42e184 GetSystemTimeAsFileTime
0x42e188 RaiseException
0x42e18c VirtualAlloc
0x42e190 HeapReAlloc
0x42e194 GetCPInfo
0x42e198 GetOEMCP
0x42e19c IsValidCodePage
0x42e1a0 RtlUnwind
0x42e1a4 HeapSize
0x42e1a8 GetLocaleInfoA
0x42e1ac WideCharToMultiByte
0x42e1b0 GetStringTypeA
0x42e1b4 MultiByteToWideChar
0x42e1b8 GetStringTypeW
0x42e1bc LCMapStringA
USER32.dll
0x42e1c4 RealGetWindowClassA
ADVAPI32.dll
0x42e000 AdjustTokenPrivileges
EAT(Export Address Table) Library
0x401003 @GetAnotherVice@12
0x401000 @SetFirstEverVice@4
KERNEL32.dll
0x42e008 EnumDateFormatsExW
0x42e00c MoveFileExA
0x42e010 EndUpdateResourceW
0x42e014 InterlockedIncrement
0x42e018 GetConsoleAliasA
0x42e01c InterlockedDecrement
0x42e020 WritePrivateProfileSectionA
0x42e024 GetSystemWindowsDirectoryW
0x42e028 GetEnvironmentStringsW
0x42e02c WaitForSingleObject
0x42e030 SetConsoleScreenBufferSize
0x42e034 GetComputerNameW
0x42e038 SetEvent
0x42e03c GetConsoleAliasesLengthA
0x42e040 GetConsoleTitleA
0x42e044 ReadConsoleOutputA
0x42e048 GetUserDefaultLangID
0x42e04c CreateActCtxW
0x42e050 GetConsoleCP
0x42e054 LocalShrink
0x42e058 GetVersionExW
0x42e05c GetFileAttributesA
0x42e060 DnsHostnameToComputerNameW
0x42e064 lstrcpynW
0x42e068 VerifyVersionInfoA
0x42e06c IsBadWritePtr
0x42e070 GetModuleFileNameW
0x42e074 GetCompressedFileSizeA
0x42e078 GetSystemDirectoryA
0x42e07c lstrcatA
0x42e080 GetACP
0x42e084 GetVolumePathNameA
0x42e088 lstrlenW
0x42e08c SetConsoleTitleA
0x42e090 FlushFileBuffers
0x42e094 InterlockedExchange
0x42e098 GetLastError
0x42e09c GetProcAddress
0x42e0a0 BeginUpdateResourceW
0x42e0a4 LocalLock
0x42e0a8 EnterCriticalSection
0x42e0ac GetLocalTime
0x42e0b0 WriteConsoleA
0x42e0b4 GetProcessId
0x42e0b8 LocalAlloc
0x42e0bc SetCalendarInfoW
0x42e0c0 CreateTapePartition
0x42e0c4 SetConsoleDisplayMode
0x42e0c8 GlobalGetAtomNameW
0x42e0cc SetEnvironmentVariableA
0x42e0d0 GetModuleHandleA
0x42e0d4 CancelTimerQueueTimer
0x42e0d8 BuildCommDCBA
0x42e0dc VirtualProtect
0x42e0e0 PeekConsoleInputA
0x42e0e4 WriteConsoleOutputAttribute
0x42e0e8 FindFirstVolumeW
0x42e0ec AreFileApisANSI
0x42e0f0 LCMapStringW
0x42e0f4 CreateFileW
0x42e0f8 GetSystemDefaultLangID
0x42e0fc UnhandledExceptionFilter
0x42e100 SetUnhandledExceptionFilter
0x42e104 GetModuleHandleW
0x42e108 Sleep
0x42e10c ExitProcess
0x42e110 GetStartupInfoW
0x42e114 WriteFile
0x42e118 GetStdHandle
0x42e11c GetModuleFileNameA
0x42e120 HeapAlloc
0x42e124 TlsGetValue
0x42e128 TlsAlloc
0x42e12c TlsSetValue
0x42e130 TlsFree
0x42e134 SetLastError
0x42e138 GetCurrentThreadId
0x42e13c DeleteCriticalSection
0x42e140 LeaveCriticalSection
0x42e144 TerminateProcess
0x42e148 GetCurrentProcess
0x42e14c IsDebuggerPresent
0x42e150 LoadLibraryA
0x42e154 InitializeCriticalSectionAndSpinCount
0x42e158 FreeEnvironmentStringsW
0x42e15c GetCommandLineW
0x42e160 SetHandleCount
0x42e164 GetFileType
0x42e168 GetStartupInfoA
0x42e16c HeapCreate
0x42e170 VirtualFree
0x42e174 HeapFree
0x42e178 QueryPerformanceCounter
0x42e17c GetTickCount
0x42e180 GetCurrentProcessId
0x42e184 GetSystemTimeAsFileTime
0x42e188 RaiseException
0x42e18c VirtualAlloc
0x42e190 HeapReAlloc
0x42e194 GetCPInfo
0x42e198 GetOEMCP
0x42e19c IsValidCodePage
0x42e1a0 RtlUnwind
0x42e1a4 HeapSize
0x42e1a8 GetLocaleInfoA
0x42e1ac WideCharToMultiByte
0x42e1b0 GetStringTypeA
0x42e1b4 MultiByteToWideChar
0x42e1b8 GetStringTypeW
0x42e1bc LCMapStringA
USER32.dll
0x42e1c4 RealGetWindowClassA
ADVAPI32.dll
0x42e000 AdjustTokenPrivileges
EAT(Export Address Table) Library
0x401003 @GetAnotherVice@12
0x401000 @SetFirstEverVice@4