ScreenShot
| Created | 2021.08.23 12:23 | Machine | s1_win7_x6401 |
| Filename | 1664879191.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 49 detected (AIDetect, malware2, Brook, malicious, high confidence, GenericKD, Unsafe, Save, Ranumbot, Fragtor, Kryptik, Eldorado, Attribute, HighConfidence, GenKryptik, FJID, Stop, MalwareX, CLASSIC, Siggen14, Static AI, Suspicious PE, RedLineSteal, ygcvg, kcloud, MigratedCloud, Ditertag, score, CoinMiner, Glupteba, R438366, ZexaF, vqW@aOUWHzhK, ai score=89, R002H0CHL21, Hvst, GdSda, confidence, 100%) | ||
| md5 | 96d3ef5ec108f2534df06d39ab70aac1 | ||
| sha256 | ec3defba4407352ff580b14d9b88e34643db2c48dab859099693a636987d0abb | ||
| ssdeep | 6144:I46rxyiaKocc45u7gW+dccaOtzFINcuyFO9uuvELcDb8juZzX:CxyiaTccp7Wdcca45IN3uiloqNX | ||
| imphash | ad1c5bf15a899fcfef408e3485448e67 | ||
| impfuzzy | 48:cSKjaM1VxOD6g/8JXrqzpF1iRytOggaE0GtgfcJSpdsBCY6:cSLyXreoEt1ZE0GtgfcJSPsBCY6 | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e008 SetFilePointer
0x41e00c lstrlenA
0x41e010 GetDriveTypeW
0x41e014 InterlockedIncrement
0x41e018 GetQueuedCompletionStatus
0x41e01c InterlockedDecrement
0x41e020 CompareFileTime
0x41e024 GetSystemWindowsDirectoryW
0x41e028 GetNamedPipeHandleStateA
0x41e02c WaitForSingleObject
0x41e030 OpenSemaphoreA
0x41e034 FreeEnvironmentStringsA
0x41e038 GetTickCount
0x41e03c VirtualFree
0x41e040 GetConsoleAliasesLengthA
0x41e044 GetPrivateProfileStringW
0x41e048 WaitNamedPipeW
0x41e04c WriteFile
0x41e050 SetCommState
0x41e054 GetCommandLineA
0x41e058 TlsSetValue
0x41e05c GetPriorityClass
0x41e060 GlobalAlloc
0x41e064 GetConsoleMode
0x41e068 TerminateThread
0x41e06c CopyFileW
0x41e070 GetVersionExW
0x41e074 SetConsoleMode
0x41e078 IsProcessorFeaturePresent
0x41e07c GetBinaryTypeA
0x41e080 GetOverlappedResult
0x41e084 CompareStringW
0x41e088 SetThreadContext
0x41e08c GlobalUnlock
0x41e090 VerifyVersionInfoW
0x41e094 CreateDirectoryA
0x41e098 ReleaseActCtx
0x41e09c GetFileSizeEx
0x41e0a0 SetCurrentDirectoryA
0x41e0a4 GetCPInfoExW
0x41e0a8 OpenMutexW
0x41e0ac GetLastError
0x41e0b0 IsDBCSLeadByteEx
0x41e0b4 ReadConsoleOutputCharacterA
0x41e0b8 GetProcAddress
0x41e0bc WriteProfileSectionA
0x41e0c0 ResetEvent
0x41e0c4 OpenWaitableTimerA
0x41e0c8 LoadLibraryA
0x41e0cc CreateSemaphoreW
0x41e0d0 WriteProfileSectionW
0x41e0d4 HeapWalk
0x41e0d8 FindAtomA
0x41e0dc Process32NextW
0x41e0e0 WriteProfileStringA
0x41e0e4 GetModuleHandleA
0x41e0e8 FindFirstChangeNotificationA
0x41e0ec EnumResourceNamesA
0x41e0f0 GetConsoleCursorInfo
0x41e0f4 FatalAppExitA
0x41e0f8 GetCurrentThreadId
0x41e0fc GetSystemTime
0x41e100 LCMapStringW
0x41e104 CopyFileExA
0x41e108 DeleteFileA
0x41e10c GetStartupInfoW
0x41e110 UnregisterWait
0x41e114 GetStartupInfoA
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 GetModuleHandleW
0x41e128 Sleep
0x41e12c ExitProcess
0x41e130 TlsGetValue
0x41e134 TlsAlloc
0x41e138 TlsFree
0x41e13c SetLastError
0x41e140 TerminateProcess
0x41e144 GetCurrentProcess
0x41e148 UnhandledExceptionFilter
0x41e14c SetUnhandledExceptionFilter
0x41e150 IsDebuggerPresent
0x41e154 GetModuleFileNameW
0x41e158 DeleteCriticalSection
0x41e15c EnterCriticalSection
0x41e160 LeaveCriticalSection
0x41e164 QueryPerformanceCounter
0x41e168 GetCurrentProcessId
0x41e16c GetSystemTimeAsFileTime
0x41e170 GetModuleFileNameA
0x41e174 GetEnvironmentStrings
0x41e178 FreeEnvironmentStringsW
0x41e17c WideCharToMultiByte
0x41e180 GetEnvironmentStringsW
0x41e184 SetHandleCount
0x41e188 GetStdHandle
0x41e18c GetFileType
0x41e190 HeapDestroy
0x41e194 HeapCreate
0x41e198 HeapFree
0x41e19c HeapAlloc
0x41e1a0 HeapSize
0x41e1a4 HeapReAlloc
0x41e1a8 VirtualAlloc
0x41e1ac GetACP
0x41e1b0 GetOEMCP
0x41e1b4 GetCPInfo
0x41e1b8 IsValidCodePage
0x41e1bc InitializeCriticalSectionAndSpinCount
0x41e1c0 RtlUnwind
0x41e1c4 GetConsoleCP
0x41e1c8 DebugBreak
0x41e1cc OutputDebugStringA
0x41e1d0 WriteConsoleW
0x41e1d4 OutputDebugStringW
0x41e1d8 LoadLibraryW
0x41e1dc MultiByteToWideChar
0x41e1e0 LCMapStringA
0x41e1e4 GetStringTypeA
0x41e1e8 GetStringTypeW
0x41e1ec GetLocaleInfoA
0x41e1f0 SetStdHandle
0x41e1f4 WriteConsoleA
0x41e1f8 GetConsoleOutputCP
0x41e1fc CreateFileA
0x41e200 CloseHandle
0x41e204 FlushFileBuffers
GDI32.dll
0x41e000 GetCharWidthW
EAT(Export Address Table) is none
KERNEL32.dll
0x41e008 SetFilePointer
0x41e00c lstrlenA
0x41e010 GetDriveTypeW
0x41e014 InterlockedIncrement
0x41e018 GetQueuedCompletionStatus
0x41e01c InterlockedDecrement
0x41e020 CompareFileTime
0x41e024 GetSystemWindowsDirectoryW
0x41e028 GetNamedPipeHandleStateA
0x41e02c WaitForSingleObject
0x41e030 OpenSemaphoreA
0x41e034 FreeEnvironmentStringsA
0x41e038 GetTickCount
0x41e03c VirtualFree
0x41e040 GetConsoleAliasesLengthA
0x41e044 GetPrivateProfileStringW
0x41e048 WaitNamedPipeW
0x41e04c WriteFile
0x41e050 SetCommState
0x41e054 GetCommandLineA
0x41e058 TlsSetValue
0x41e05c GetPriorityClass
0x41e060 GlobalAlloc
0x41e064 GetConsoleMode
0x41e068 TerminateThread
0x41e06c CopyFileW
0x41e070 GetVersionExW
0x41e074 SetConsoleMode
0x41e078 IsProcessorFeaturePresent
0x41e07c GetBinaryTypeA
0x41e080 GetOverlappedResult
0x41e084 CompareStringW
0x41e088 SetThreadContext
0x41e08c GlobalUnlock
0x41e090 VerifyVersionInfoW
0x41e094 CreateDirectoryA
0x41e098 ReleaseActCtx
0x41e09c GetFileSizeEx
0x41e0a0 SetCurrentDirectoryA
0x41e0a4 GetCPInfoExW
0x41e0a8 OpenMutexW
0x41e0ac GetLastError
0x41e0b0 IsDBCSLeadByteEx
0x41e0b4 ReadConsoleOutputCharacterA
0x41e0b8 GetProcAddress
0x41e0bc WriteProfileSectionA
0x41e0c0 ResetEvent
0x41e0c4 OpenWaitableTimerA
0x41e0c8 LoadLibraryA
0x41e0cc CreateSemaphoreW
0x41e0d0 WriteProfileSectionW
0x41e0d4 HeapWalk
0x41e0d8 FindAtomA
0x41e0dc Process32NextW
0x41e0e0 WriteProfileStringA
0x41e0e4 GetModuleHandleA
0x41e0e8 FindFirstChangeNotificationA
0x41e0ec EnumResourceNamesA
0x41e0f0 GetConsoleCursorInfo
0x41e0f4 FatalAppExitA
0x41e0f8 GetCurrentThreadId
0x41e0fc GetSystemTime
0x41e100 LCMapStringW
0x41e104 CopyFileExA
0x41e108 DeleteFileA
0x41e10c GetStartupInfoW
0x41e110 UnregisterWait
0x41e114 GetStartupInfoA
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 GetModuleHandleW
0x41e128 Sleep
0x41e12c ExitProcess
0x41e130 TlsGetValue
0x41e134 TlsAlloc
0x41e138 TlsFree
0x41e13c SetLastError
0x41e140 TerminateProcess
0x41e144 GetCurrentProcess
0x41e148 UnhandledExceptionFilter
0x41e14c SetUnhandledExceptionFilter
0x41e150 IsDebuggerPresent
0x41e154 GetModuleFileNameW
0x41e158 DeleteCriticalSection
0x41e15c EnterCriticalSection
0x41e160 LeaveCriticalSection
0x41e164 QueryPerformanceCounter
0x41e168 GetCurrentProcessId
0x41e16c GetSystemTimeAsFileTime
0x41e170 GetModuleFileNameA
0x41e174 GetEnvironmentStrings
0x41e178 FreeEnvironmentStringsW
0x41e17c WideCharToMultiByte
0x41e180 GetEnvironmentStringsW
0x41e184 SetHandleCount
0x41e188 GetStdHandle
0x41e18c GetFileType
0x41e190 HeapDestroy
0x41e194 HeapCreate
0x41e198 HeapFree
0x41e19c HeapAlloc
0x41e1a0 HeapSize
0x41e1a4 HeapReAlloc
0x41e1a8 VirtualAlloc
0x41e1ac GetACP
0x41e1b0 GetOEMCP
0x41e1b4 GetCPInfo
0x41e1b8 IsValidCodePage
0x41e1bc InitializeCriticalSectionAndSpinCount
0x41e1c0 RtlUnwind
0x41e1c4 GetConsoleCP
0x41e1c8 DebugBreak
0x41e1cc OutputDebugStringA
0x41e1d0 WriteConsoleW
0x41e1d4 OutputDebugStringW
0x41e1d8 LoadLibraryW
0x41e1dc MultiByteToWideChar
0x41e1e0 LCMapStringA
0x41e1e4 GetStringTypeA
0x41e1e8 GetStringTypeW
0x41e1ec GetLocaleInfoA
0x41e1f0 SetStdHandle
0x41e1f4 WriteConsoleA
0x41e1f8 GetConsoleOutputCP
0x41e1fc CreateFileA
0x41e200 CloseHandle
0x41e204 FlushFileBuffers
GDI32.dll
0x41e000 GetCharWidthW
EAT(Export Address Table) is none