ScreenShot
| Created | 2021.08.24 09:03 | Machine | s1_win7_x6402 |
| Filename | Ahiles.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetect, malware1, Racealer, malicious, high confidence, Unsafe, Save, confidence, 100%, None, ZexaF, GqW@ae9VK1gK, Kryptik, Eldorado, Attribute, HighConfidence, GenKryptik, FJIV, Brook, CLASSIC, Score, Sabsik, RUQCKI, Static AI, Suspicious PE, susgen, PossibleThreat, PALLAS, PWSX) | ||
| md5 | 823f3cbc0b6ad5ee6f23d1da1a49cdc4 | ||
| sha256 | 5e3fb9f22a412050356e0ea4079847c7969c8aac021f8855404435032a4427e6 | ||
| ssdeep | 12288:a/XEWr9xop/mAOTJA4rtfqDJfbF8IQuUJh:urjo2T4DJbqIvUH | ||
| imphash | 0579ae0629fc2c520498364f1f007f60 | ||
| impfuzzy | 48:5baOCaM1VtmyCkXB8gqzpT3YOYMaEZtQkfcJSoir/g5:5JlyXvS3YfVEZtQkfcJStr/g5 | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e008 FindFirstChangeNotificationW
0x41e00c SetFilePointer
0x41e010 lstrlenA
0x41e014 CopyFileExW
0x41e018 InterlockedIncrement
0x41e01c GetQueuedCompletionStatus
0x41e020 GetCommState
0x41e024 InterlockedDecrement
0x41e028 CompareFileTime
0x41e02c GetSystemWindowsDirectoryW
0x41e030 GetNamedPipeHandleStateA
0x41e034 WaitForSingleObject
0x41e038 OpenSemaphoreA
0x41e03c FreeEnvironmentStringsA
0x41e040 GetTickCount
0x41e044 VirtualFree
0x41e048 GetConsoleAliasesLengthA
0x41e04c GetPrivateProfileStringW
0x41e050 WaitNamedPipeW
0x41e054 WriteFile
0x41e058 GetCommandLineA
0x41e05c GetDriveTypeA
0x41e060 TlsSetValue
0x41e064 GetPriorityClass
0x41e068 GlobalAlloc
0x41e06c LoadLibraryW
0x41e070 GetConsoleMode
0x41e074 TerminateThread
0x41e078 CopyFileW
0x41e07c SetConsoleMode
0x41e080 IsProcessorFeaturePresent
0x41e084 SetThreadContext
0x41e088 GetOverlappedResult
0x41e08c CompareStringW
0x41e090 GetStartupInfoW
0x41e094 GlobalUnlock
0x41e098 CreateDirectoryA
0x41e09c ReleaseActCtx
0x41e0a0 GetFileSizeEx
0x41e0a4 SetCurrentDirectoryA
0x41e0a8 GetCPInfoExW
0x41e0ac OpenMutexW
0x41e0b0 GetLastError
0x41e0b4 IsDBCSLeadByteEx
0x41e0b8 ReadConsoleOutputCharacterA
0x41e0bc GetProcAddress
0x41e0c0 WriteProfileSectionA
0x41e0c4 ResetEvent
0x41e0c8 LoadLibraryA
0x41e0cc CreateSemaphoreW
0x41e0d0 HeapWalk
0x41e0d4 FindAtomA
0x41e0d8 Process32NextW
0x41e0dc WriteProfileStringA
0x41e0e0 GetModuleHandleA
0x41e0e4 EnumResourceNamesA
0x41e0e8 GetConsoleCursorInfo
0x41e0ec FatalAppExitA
0x41e0f0 GetCurrentThreadId
0x41e0f4 GetVersionExA
0x41e0f8 GetSystemTime
0x41e0fc LCMapStringW
0x41e100 DeleteFileA
0x41e104 GetBinaryTypeW
0x41e108 UnregisterWait
0x41e10c FlushFileBuffers
0x41e110 WideCharToMultiByte
0x41e114 GetStartupInfoA
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 TerminateProcess
0x41e128 GetCurrentProcess
0x41e12c UnhandledExceptionFilter
0x41e130 SetUnhandledExceptionFilter
0x41e134 IsDebuggerPresent
0x41e138 GetModuleFileNameW
0x41e13c GetACP
0x41e140 GetOEMCP
0x41e144 GetCPInfo
0x41e148 IsValidCodePage
0x41e14c TlsGetValue
0x41e150 GetModuleHandleW
0x41e154 TlsAlloc
0x41e158 TlsFree
0x41e15c SetLastError
0x41e160 Sleep
0x41e164 ExitProcess
0x41e168 DeleteCriticalSection
0x41e16c EnterCriticalSection
0x41e170 LeaveCriticalSection
0x41e174 QueryPerformanceCounter
0x41e178 GetCurrentProcessId
0x41e17c GetSystemTimeAsFileTime
0x41e180 GetModuleFileNameA
0x41e184 GetEnvironmentStrings
0x41e188 FreeEnvironmentStringsW
0x41e18c GetEnvironmentStringsW
0x41e190 SetHandleCount
0x41e194 GetStdHandle
0x41e198 GetFileType
0x41e19c HeapDestroy
0x41e1a0 HeapCreate
0x41e1a4 HeapFree
0x41e1a8 HeapAlloc
0x41e1ac HeapSize
0x41e1b0 HeapReAlloc
0x41e1b4 VirtualAlloc
0x41e1b8 DebugBreak
0x41e1bc OutputDebugStringA
0x41e1c0 WriteConsoleW
0x41e1c4 OutputDebugStringW
0x41e1c8 RtlUnwind
0x41e1cc MultiByteToWideChar
0x41e1d0 LCMapStringA
0x41e1d4 GetStringTypeA
0x41e1d8 GetStringTypeW
0x41e1dc GetLocaleInfoA
0x41e1e0 InitializeCriticalSectionAndSpinCount
0x41e1e4 GetConsoleCP
0x41e1e8 SetStdHandle
0x41e1ec WriteConsoleA
0x41e1f0 GetConsoleOutputCP
0x41e1f4 CreateFileA
0x41e1f8 CloseHandle
GDI32.dll
0x41e000 GetCharWidthW
WINHTTP.dll
0x41e200 WinHttpCloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41e008 FindFirstChangeNotificationW
0x41e00c SetFilePointer
0x41e010 lstrlenA
0x41e014 CopyFileExW
0x41e018 InterlockedIncrement
0x41e01c GetQueuedCompletionStatus
0x41e020 GetCommState
0x41e024 InterlockedDecrement
0x41e028 CompareFileTime
0x41e02c GetSystemWindowsDirectoryW
0x41e030 GetNamedPipeHandleStateA
0x41e034 WaitForSingleObject
0x41e038 OpenSemaphoreA
0x41e03c FreeEnvironmentStringsA
0x41e040 GetTickCount
0x41e044 VirtualFree
0x41e048 GetConsoleAliasesLengthA
0x41e04c GetPrivateProfileStringW
0x41e050 WaitNamedPipeW
0x41e054 WriteFile
0x41e058 GetCommandLineA
0x41e05c GetDriveTypeA
0x41e060 TlsSetValue
0x41e064 GetPriorityClass
0x41e068 GlobalAlloc
0x41e06c LoadLibraryW
0x41e070 GetConsoleMode
0x41e074 TerminateThread
0x41e078 CopyFileW
0x41e07c SetConsoleMode
0x41e080 IsProcessorFeaturePresent
0x41e084 SetThreadContext
0x41e088 GetOverlappedResult
0x41e08c CompareStringW
0x41e090 GetStartupInfoW
0x41e094 GlobalUnlock
0x41e098 CreateDirectoryA
0x41e09c ReleaseActCtx
0x41e0a0 GetFileSizeEx
0x41e0a4 SetCurrentDirectoryA
0x41e0a8 GetCPInfoExW
0x41e0ac OpenMutexW
0x41e0b0 GetLastError
0x41e0b4 IsDBCSLeadByteEx
0x41e0b8 ReadConsoleOutputCharacterA
0x41e0bc GetProcAddress
0x41e0c0 WriteProfileSectionA
0x41e0c4 ResetEvent
0x41e0c8 LoadLibraryA
0x41e0cc CreateSemaphoreW
0x41e0d0 HeapWalk
0x41e0d4 FindAtomA
0x41e0d8 Process32NextW
0x41e0dc WriteProfileStringA
0x41e0e0 GetModuleHandleA
0x41e0e4 EnumResourceNamesA
0x41e0e8 GetConsoleCursorInfo
0x41e0ec FatalAppExitA
0x41e0f0 GetCurrentThreadId
0x41e0f4 GetVersionExA
0x41e0f8 GetSystemTime
0x41e0fc LCMapStringW
0x41e100 DeleteFileA
0x41e104 GetBinaryTypeW
0x41e108 UnregisterWait
0x41e10c FlushFileBuffers
0x41e110 WideCharToMultiByte
0x41e114 GetStartupInfoA
0x41e118 HeapValidate
0x41e11c IsBadReadPtr
0x41e120 RaiseException
0x41e124 TerminateProcess
0x41e128 GetCurrentProcess
0x41e12c UnhandledExceptionFilter
0x41e130 SetUnhandledExceptionFilter
0x41e134 IsDebuggerPresent
0x41e138 GetModuleFileNameW
0x41e13c GetACP
0x41e140 GetOEMCP
0x41e144 GetCPInfo
0x41e148 IsValidCodePage
0x41e14c TlsGetValue
0x41e150 GetModuleHandleW
0x41e154 TlsAlloc
0x41e158 TlsFree
0x41e15c SetLastError
0x41e160 Sleep
0x41e164 ExitProcess
0x41e168 DeleteCriticalSection
0x41e16c EnterCriticalSection
0x41e170 LeaveCriticalSection
0x41e174 QueryPerformanceCounter
0x41e178 GetCurrentProcessId
0x41e17c GetSystemTimeAsFileTime
0x41e180 GetModuleFileNameA
0x41e184 GetEnvironmentStrings
0x41e188 FreeEnvironmentStringsW
0x41e18c GetEnvironmentStringsW
0x41e190 SetHandleCount
0x41e194 GetStdHandle
0x41e198 GetFileType
0x41e19c HeapDestroy
0x41e1a0 HeapCreate
0x41e1a4 HeapFree
0x41e1a8 HeapAlloc
0x41e1ac HeapSize
0x41e1b0 HeapReAlloc
0x41e1b4 VirtualAlloc
0x41e1b8 DebugBreak
0x41e1bc OutputDebugStringA
0x41e1c0 WriteConsoleW
0x41e1c4 OutputDebugStringW
0x41e1c8 RtlUnwind
0x41e1cc MultiByteToWideChar
0x41e1d0 LCMapStringA
0x41e1d4 GetStringTypeA
0x41e1d8 GetStringTypeW
0x41e1dc GetLocaleInfoA
0x41e1e0 InitializeCriticalSectionAndSpinCount
0x41e1e4 GetConsoleCP
0x41e1e8 SetStdHandle
0x41e1ec WriteConsoleA
0x41e1f0 GetConsoleOutputCP
0x41e1f4 CreateFileA
0x41e1f8 CloseHandle
GDI32.dll
0x41e000 GetCharWidthW
WINHTTP.dll
0x41e200 WinHttpCloseHandle
EAT(Export Address Table) is none