ScreenShot
| Created | 2021.08.23 12:21 | Machine | s1_win7_x6401 |
| Filename | file.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetect, malware2, Malicious, high confidence, Fragtor, Unsafe, Save, confidence, 100%, ZexaF, MqW@aCL3zAkK, Kryptik, Eldorado, Attribute, HighConfidence, GenKryptik, FJJM, ai score=82, kcloud, StopCrypt, score, BScope, Chapak, CLASSIC, Static AI, Malicious PE, susgen) | ||
| md5 | d4c03c86b24c6b5a83c0524e1a9af692 | ||
| sha256 | 8253a9b4fa341be7f3c7d3be4a50fd18a9e72afd0cca02053c43262d7f8fe5bd | ||
| ssdeep | 12288:In8lWFmgZCAT+Fnt956lqjzPfeWnyZ0lruANYqju+jEphS:cFmgonthny01fNe0+U | ||
| imphash | 535299e581f29afc654ac18a997959f4 | ||
| impfuzzy | 48:5baOCay1VtmyhXRBqzpYOhTJaEZtQZc+JSFHur/gs:5JDuX36Y4QEZtQZc+JS4r/gs | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f008 FindFirstChangeNotificationW
0x41f00c SetFilePointer
0x41f010 lstrlenA
0x41f014 CopyFileExW
0x41f018 InterlockedIncrement
0x41f01c GetQueuedCompletionStatus
0x41f020 GetCommState
0x41f024 InterlockedDecrement
0x41f028 CompareFileTime
0x41f02c GetSystemWindowsDirectoryW
0x41f030 GetNamedPipeHandleStateA
0x41f034 GlobalLock
0x41f038 WaitForSingleObject
0x41f03c OpenSemaphoreA
0x41f040 FreeEnvironmentStringsA
0x41f044 GetTickCount
0x41f048 VirtualFree
0x41f04c GetConsoleAliasesLengthA
0x41f050 GetPrivateProfileStringW
0x41f054 WaitNamedPipeW
0x41f058 WriteFile
0x41f05c GetCommandLineA
0x41f060 GetDriveTypeA
0x41f064 TlsSetValue
0x41f068 GetPriorityClass
0x41f06c GlobalAlloc
0x41f070 LoadLibraryW
0x41f074 GetConsoleMode
0x41f078 TerminateThread
0x41f07c SetConsoleMode
0x41f080 IsProcessorFeaturePresent
0x41f084 GetBinaryTypeW
0x41f088 SetThreadContext
0x41f08c CompareStringW
0x41f090 GetStartupInfoW
0x41f094 CreateDirectoryA
0x41f098 ReleaseActCtx
0x41f09c GetFileSizeEx
0x41f0a0 SetCurrentDirectoryA
0x41f0a4 GetCPInfoExW
0x41f0a8 OpenMutexW
0x41f0ac GetLastError
0x41f0b0 IsDBCSLeadByteEx
0x41f0b4 ReadConsoleOutputCharacterA
0x41f0b8 GetProcAddress
0x41f0bc CopyFileA
0x41f0c0 ResetEvent
0x41f0c4 LoadLibraryA
0x41f0c8 CreateSemaphoreW
0x41f0cc WriteProfileSectionW
0x41f0d0 HeapWalk
0x41f0d4 FindAtomA
0x41f0d8 Process32NextW
0x41f0dc SetConsoleTitleW
0x41f0e0 GetModuleHandleA
0x41f0e4 EnumResourceNamesA
0x41f0e8 WriteProfileStringW
0x41f0ec GetConsoleCursorInfo
0x41f0f0 FatalAppExitA
0x41f0f4 GetCurrentThreadId
0x41f0f8 GetVersionExA
0x41f0fc GetSystemTime
0x41f100 LCMapStringW
0x41f104 DeleteFileA
0x41f108 GetOverlappedResult
0x41f10c UnregisterWait
0x41f110 WideCharToMultiByte
0x41f114 HeapValidate
0x41f118 IsBadReadPtr
0x41f11c RaiseException
0x41f120 TerminateProcess
0x41f124 GetCurrentProcess
0x41f128 UnhandledExceptionFilter
0x41f12c SetUnhandledExceptionFilter
0x41f130 IsDebuggerPresent
0x41f134 GetModuleFileNameW
0x41f138 GetACP
0x41f13c GetOEMCP
0x41f140 GetCPInfo
0x41f144 IsValidCodePage
0x41f148 TlsGetValue
0x41f14c GetModuleHandleW
0x41f150 TlsAlloc
0x41f154 TlsFree
0x41f158 SetLastError
0x41f15c Sleep
0x41f160 ExitProcess
0x41f164 EnterCriticalSection
0x41f168 LeaveCriticalSection
0x41f16c DeleteCriticalSection
0x41f170 QueryPerformanceCounter
0x41f174 GetCurrentProcessId
0x41f178 GetSystemTimeAsFileTime
0x41f17c FreeEnvironmentStringsW
0x41f180 GetEnvironmentStringsW
0x41f184 GetCommandLineW
0x41f188 SetHandleCount
0x41f18c GetStdHandle
0x41f190 GetFileType
0x41f194 GetStartupInfoA
0x41f198 HeapDestroy
0x41f19c HeapCreate
0x41f1a0 HeapFree
0x41f1a4 GetModuleFileNameA
0x41f1a8 HeapAlloc
0x41f1ac HeapSize
0x41f1b0 HeapReAlloc
0x41f1b4 VirtualAlloc
0x41f1b8 DebugBreak
0x41f1bc OutputDebugStringA
0x41f1c0 WriteConsoleW
0x41f1c4 OutputDebugStringW
0x41f1c8 RtlUnwind
0x41f1cc MultiByteToWideChar
0x41f1d0 LCMapStringA
0x41f1d4 GetStringTypeA
0x41f1d8 GetStringTypeW
0x41f1dc GetLocaleInfoA
0x41f1e0 InitializeCriticalSectionAndSpinCount
0x41f1e4 GetConsoleCP
0x41f1e8 SetStdHandle
0x41f1ec WriteConsoleA
0x41f1f0 GetConsoleOutputCP
0x41f1f4 FlushFileBuffers
0x41f1f8 CreateFileA
0x41f1fc CloseHandle
GDI32.dll
0x41f000 GetCharWidthW
WINHTTP.dll
0x41f204 WinHttpCloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41f008 FindFirstChangeNotificationW
0x41f00c SetFilePointer
0x41f010 lstrlenA
0x41f014 CopyFileExW
0x41f018 InterlockedIncrement
0x41f01c GetQueuedCompletionStatus
0x41f020 GetCommState
0x41f024 InterlockedDecrement
0x41f028 CompareFileTime
0x41f02c GetSystemWindowsDirectoryW
0x41f030 GetNamedPipeHandleStateA
0x41f034 GlobalLock
0x41f038 WaitForSingleObject
0x41f03c OpenSemaphoreA
0x41f040 FreeEnvironmentStringsA
0x41f044 GetTickCount
0x41f048 VirtualFree
0x41f04c GetConsoleAliasesLengthA
0x41f050 GetPrivateProfileStringW
0x41f054 WaitNamedPipeW
0x41f058 WriteFile
0x41f05c GetCommandLineA
0x41f060 GetDriveTypeA
0x41f064 TlsSetValue
0x41f068 GetPriorityClass
0x41f06c GlobalAlloc
0x41f070 LoadLibraryW
0x41f074 GetConsoleMode
0x41f078 TerminateThread
0x41f07c SetConsoleMode
0x41f080 IsProcessorFeaturePresent
0x41f084 GetBinaryTypeW
0x41f088 SetThreadContext
0x41f08c CompareStringW
0x41f090 GetStartupInfoW
0x41f094 CreateDirectoryA
0x41f098 ReleaseActCtx
0x41f09c GetFileSizeEx
0x41f0a0 SetCurrentDirectoryA
0x41f0a4 GetCPInfoExW
0x41f0a8 OpenMutexW
0x41f0ac GetLastError
0x41f0b0 IsDBCSLeadByteEx
0x41f0b4 ReadConsoleOutputCharacterA
0x41f0b8 GetProcAddress
0x41f0bc CopyFileA
0x41f0c0 ResetEvent
0x41f0c4 LoadLibraryA
0x41f0c8 CreateSemaphoreW
0x41f0cc WriteProfileSectionW
0x41f0d0 HeapWalk
0x41f0d4 FindAtomA
0x41f0d8 Process32NextW
0x41f0dc SetConsoleTitleW
0x41f0e0 GetModuleHandleA
0x41f0e4 EnumResourceNamesA
0x41f0e8 WriteProfileStringW
0x41f0ec GetConsoleCursorInfo
0x41f0f0 FatalAppExitA
0x41f0f4 GetCurrentThreadId
0x41f0f8 GetVersionExA
0x41f0fc GetSystemTime
0x41f100 LCMapStringW
0x41f104 DeleteFileA
0x41f108 GetOverlappedResult
0x41f10c UnregisterWait
0x41f110 WideCharToMultiByte
0x41f114 HeapValidate
0x41f118 IsBadReadPtr
0x41f11c RaiseException
0x41f120 TerminateProcess
0x41f124 GetCurrentProcess
0x41f128 UnhandledExceptionFilter
0x41f12c SetUnhandledExceptionFilter
0x41f130 IsDebuggerPresent
0x41f134 GetModuleFileNameW
0x41f138 GetACP
0x41f13c GetOEMCP
0x41f140 GetCPInfo
0x41f144 IsValidCodePage
0x41f148 TlsGetValue
0x41f14c GetModuleHandleW
0x41f150 TlsAlloc
0x41f154 TlsFree
0x41f158 SetLastError
0x41f15c Sleep
0x41f160 ExitProcess
0x41f164 EnterCriticalSection
0x41f168 LeaveCriticalSection
0x41f16c DeleteCriticalSection
0x41f170 QueryPerformanceCounter
0x41f174 GetCurrentProcessId
0x41f178 GetSystemTimeAsFileTime
0x41f17c FreeEnvironmentStringsW
0x41f180 GetEnvironmentStringsW
0x41f184 GetCommandLineW
0x41f188 SetHandleCount
0x41f18c GetStdHandle
0x41f190 GetFileType
0x41f194 GetStartupInfoA
0x41f198 HeapDestroy
0x41f19c HeapCreate
0x41f1a0 HeapFree
0x41f1a4 GetModuleFileNameA
0x41f1a8 HeapAlloc
0x41f1ac HeapSize
0x41f1b0 HeapReAlloc
0x41f1b4 VirtualAlloc
0x41f1b8 DebugBreak
0x41f1bc OutputDebugStringA
0x41f1c0 WriteConsoleW
0x41f1c4 OutputDebugStringW
0x41f1c8 RtlUnwind
0x41f1cc MultiByteToWideChar
0x41f1d0 LCMapStringA
0x41f1d4 GetStringTypeA
0x41f1d8 GetStringTypeW
0x41f1dc GetLocaleInfoA
0x41f1e0 InitializeCriticalSectionAndSpinCount
0x41f1e4 GetConsoleCP
0x41f1e8 SetStdHandle
0x41f1ec WriteConsoleA
0x41f1f0 GetConsoleOutputCP
0x41f1f4 FlushFileBuffers
0x41f1f8 CreateFileA
0x41f1fc CloseHandle
GDI32.dll
0x41f000 GetCharWidthW
WINHTTP.dll
0x41f204 WinHttpCloseHandle
EAT(Export Address Table) is none