ScreenShot
| Created | 2021.08.27 15:53 | Machine | s1_win7_x6402 |
| Filename | 0fd9ce44914b3beda3c86ba2163945e92f035620_2021-08-22_17-56.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 41 detected (AIDetect, malware2, malicious, high confidence, score, Stop, Unsafe, Save, confidence, 100%, ZexaF, GqW@aSMsT4aK, Kryptik, Eldorado, Attribute, HighConfidence, HMEJ, Egguard, Fragtor, CrypterX, StellarStealer, mdqea, Siggen3, Ficker, susgen, ai score=83, Azorult, DQ3JQ1, Static AI, Suspicious PE, MalPE, R438472, BScope, Chapak, CLASSIC, GdSda) | ||
| md5 | 6d3d857dce2ce88c250574619f6a2f0a | ||
| sha256 | 8026d8405b0cd43c956267197fb6f00d6f4c77274911d844a394b7e0897f2f29 | ||
| ssdeep | 12288:vtXl6Yhjq7reLShM8qxuTrQDf6Jf0ZGaRa2qH7vh:z6Yh3bxufmKOY2qb | ||
| imphash | b5f293e51015d9eef9ae7288b63a4f2b | ||
| impfuzzy | 48:cbaOCGk1V6myk7XkDzvMgSOxNJaEZtQZc+JSFHZr/gs:cJ2XXkUgSEQEZtQZc+JSzr/gs | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 41 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f008 SetFilePointer
0x41f00c lstrlenA
0x41f010 CopyFileExW
0x41f014 InterlockedIncrement
0x41f018 GetQueuedCompletionStatus
0x41f01c GetCommState
0x41f020 InterlockedDecrement
0x41f024 CompareFileTime
0x41f028 GetNamedPipeHandleStateA
0x41f02c GlobalLock
0x41f030 WaitForSingleObject
0x41f034 SetEvent
0x41f038 OpenSemaphoreA
0x41f03c FreeEnvironmentStringsA
0x41f040 GetTickCount
0x41f044 VirtualFree
0x41f048 GetConsoleAliasesLengthA
0x41f04c GetPrivateProfileStringW
0x41f050 WaitNamedPipeW
0x41f054 GetCommandLineA
0x41f058 GetDriveTypeA
0x41f05c TlsSetValue
0x41f060 GetPriorityClass
0x41f064 GlobalAlloc
0x41f068 LoadLibraryW
0x41f06c GetConsoleMode
0x41f070 TerminateThread
0x41f074 GetSystemWindowsDirectoryA
0x41f078 SetConsoleMode
0x41f07c IsProcessorFeaturePresent
0x41f080 ReadFile
0x41f084 GetBinaryTypeW
0x41f088 GetOverlappedResult
0x41f08c SetThreadContext
0x41f090 GetStartupInfoW
0x41f094 GetPrivateProfileIntW
0x41f098 CreateDirectoryA
0x41f09c ReleaseActCtx
0x41f0a0 GetFileSizeEx
0x41f0a4 SetCurrentDirectoryA
0x41f0a8 OpenMutexW
0x41f0ac GetLastError
0x41f0b0 IsDBCSLeadByteEx
0x41f0b4 ReadConsoleOutputCharacterA
0x41f0b8 GetProcAddress
0x41f0bc CopyFileA
0x41f0c0 LoadLibraryA
0x41f0c4 CreateSemaphoreW
0x41f0c8 WriteProfileSectionW
0x41f0cc HeapWalk
0x41f0d0 Process32NextW
0x41f0d4 SetConsoleTitleW
0x41f0d8 GetModuleHandleA
0x41f0dc FindFirstChangeNotificationA
0x41f0e0 EnumResourceNamesA
0x41f0e4 WriteProfileStringW
0x41f0e8 GetConsoleCursorInfo
0x41f0ec FatalAppExitA
0x41f0f0 GetCurrentThreadId
0x41f0f4 GetCPInfoExA
0x41f0f8 GetVersionExA
0x41f0fc FindAtomW
0x41f100 FindActCtxSectionStringW
0x41f104 UnregisterWaitEx
0x41f108 GetSystemTime
0x41f10c LCMapStringW
0x41f110 DeleteFileA
0x41f114 CompareStringW
0x41f118 UnregisterWait
0x41f11c WideCharToMultiByte
0x41f120 HeapValidate
0x41f124 IsBadReadPtr
0x41f128 RaiseException
0x41f12c TerminateProcess
0x41f130 GetCurrentProcess
0x41f134 UnhandledExceptionFilter
0x41f138 SetUnhandledExceptionFilter
0x41f13c IsDebuggerPresent
0x41f140 GetModuleFileNameW
0x41f144 GetACP
0x41f148 GetOEMCP
0x41f14c GetCPInfo
0x41f150 IsValidCodePage
0x41f154 TlsGetValue
0x41f158 GetModuleHandleW
0x41f15c TlsAlloc
0x41f160 TlsFree
0x41f164 SetLastError
0x41f168 Sleep
0x41f16c ExitProcess
0x41f170 EnterCriticalSection
0x41f174 LeaveCriticalSection
0x41f178 DeleteCriticalSection
0x41f17c QueryPerformanceCounter
0x41f180 GetCurrentProcessId
0x41f184 GetSystemTimeAsFileTime
0x41f188 FreeEnvironmentStringsW
0x41f18c GetEnvironmentStringsW
0x41f190 GetCommandLineW
0x41f194 SetHandleCount
0x41f198 GetStdHandle
0x41f19c GetFileType
0x41f1a0 GetStartupInfoA
0x41f1a4 HeapDestroy
0x41f1a8 HeapCreate
0x41f1ac HeapFree
0x41f1b0 GetModuleFileNameA
0x41f1b4 WriteFile
0x41f1b8 HeapAlloc
0x41f1bc HeapSize
0x41f1c0 HeapReAlloc
0x41f1c4 VirtualAlloc
0x41f1c8 DebugBreak
0x41f1cc OutputDebugStringA
0x41f1d0 WriteConsoleW
0x41f1d4 OutputDebugStringW
0x41f1d8 RtlUnwind
0x41f1dc MultiByteToWideChar
0x41f1e0 LCMapStringA
0x41f1e4 GetStringTypeA
0x41f1e8 GetStringTypeW
0x41f1ec GetLocaleInfoA
0x41f1f0 InitializeCriticalSectionAndSpinCount
0x41f1f4 GetConsoleCP
0x41f1f8 SetStdHandle
0x41f1fc WriteConsoleA
0x41f200 GetConsoleOutputCP
0x41f204 FlushFileBuffers
0x41f208 CreateFileA
0x41f20c CloseHandle
GDI32.dll
0x41f000 GetCharWidthW
WINHTTP.dll
0x41f214 WinHttpCloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41f008 SetFilePointer
0x41f00c lstrlenA
0x41f010 CopyFileExW
0x41f014 InterlockedIncrement
0x41f018 GetQueuedCompletionStatus
0x41f01c GetCommState
0x41f020 InterlockedDecrement
0x41f024 CompareFileTime
0x41f028 GetNamedPipeHandleStateA
0x41f02c GlobalLock
0x41f030 WaitForSingleObject
0x41f034 SetEvent
0x41f038 OpenSemaphoreA
0x41f03c FreeEnvironmentStringsA
0x41f040 GetTickCount
0x41f044 VirtualFree
0x41f048 GetConsoleAliasesLengthA
0x41f04c GetPrivateProfileStringW
0x41f050 WaitNamedPipeW
0x41f054 GetCommandLineA
0x41f058 GetDriveTypeA
0x41f05c TlsSetValue
0x41f060 GetPriorityClass
0x41f064 GlobalAlloc
0x41f068 LoadLibraryW
0x41f06c GetConsoleMode
0x41f070 TerminateThread
0x41f074 GetSystemWindowsDirectoryA
0x41f078 SetConsoleMode
0x41f07c IsProcessorFeaturePresent
0x41f080 ReadFile
0x41f084 GetBinaryTypeW
0x41f088 GetOverlappedResult
0x41f08c SetThreadContext
0x41f090 GetStartupInfoW
0x41f094 GetPrivateProfileIntW
0x41f098 CreateDirectoryA
0x41f09c ReleaseActCtx
0x41f0a0 GetFileSizeEx
0x41f0a4 SetCurrentDirectoryA
0x41f0a8 OpenMutexW
0x41f0ac GetLastError
0x41f0b0 IsDBCSLeadByteEx
0x41f0b4 ReadConsoleOutputCharacterA
0x41f0b8 GetProcAddress
0x41f0bc CopyFileA
0x41f0c0 LoadLibraryA
0x41f0c4 CreateSemaphoreW
0x41f0c8 WriteProfileSectionW
0x41f0cc HeapWalk
0x41f0d0 Process32NextW
0x41f0d4 SetConsoleTitleW
0x41f0d8 GetModuleHandleA
0x41f0dc FindFirstChangeNotificationA
0x41f0e0 EnumResourceNamesA
0x41f0e4 WriteProfileStringW
0x41f0e8 GetConsoleCursorInfo
0x41f0ec FatalAppExitA
0x41f0f0 GetCurrentThreadId
0x41f0f4 GetCPInfoExA
0x41f0f8 GetVersionExA
0x41f0fc FindAtomW
0x41f100 FindActCtxSectionStringW
0x41f104 UnregisterWaitEx
0x41f108 GetSystemTime
0x41f10c LCMapStringW
0x41f110 DeleteFileA
0x41f114 CompareStringW
0x41f118 UnregisterWait
0x41f11c WideCharToMultiByte
0x41f120 HeapValidate
0x41f124 IsBadReadPtr
0x41f128 RaiseException
0x41f12c TerminateProcess
0x41f130 GetCurrentProcess
0x41f134 UnhandledExceptionFilter
0x41f138 SetUnhandledExceptionFilter
0x41f13c IsDebuggerPresent
0x41f140 GetModuleFileNameW
0x41f144 GetACP
0x41f148 GetOEMCP
0x41f14c GetCPInfo
0x41f150 IsValidCodePage
0x41f154 TlsGetValue
0x41f158 GetModuleHandleW
0x41f15c TlsAlloc
0x41f160 TlsFree
0x41f164 SetLastError
0x41f168 Sleep
0x41f16c ExitProcess
0x41f170 EnterCriticalSection
0x41f174 LeaveCriticalSection
0x41f178 DeleteCriticalSection
0x41f17c QueryPerformanceCounter
0x41f180 GetCurrentProcessId
0x41f184 GetSystemTimeAsFileTime
0x41f188 FreeEnvironmentStringsW
0x41f18c GetEnvironmentStringsW
0x41f190 GetCommandLineW
0x41f194 SetHandleCount
0x41f198 GetStdHandle
0x41f19c GetFileType
0x41f1a0 GetStartupInfoA
0x41f1a4 HeapDestroy
0x41f1a8 HeapCreate
0x41f1ac HeapFree
0x41f1b0 GetModuleFileNameA
0x41f1b4 WriteFile
0x41f1b8 HeapAlloc
0x41f1bc HeapSize
0x41f1c0 HeapReAlloc
0x41f1c4 VirtualAlloc
0x41f1c8 DebugBreak
0x41f1cc OutputDebugStringA
0x41f1d0 WriteConsoleW
0x41f1d4 OutputDebugStringW
0x41f1d8 RtlUnwind
0x41f1dc MultiByteToWideChar
0x41f1e0 LCMapStringA
0x41f1e4 GetStringTypeA
0x41f1e8 GetStringTypeW
0x41f1ec GetLocaleInfoA
0x41f1f0 InitializeCriticalSectionAndSpinCount
0x41f1f4 GetConsoleCP
0x41f1f8 SetStdHandle
0x41f1fc WriteConsoleA
0x41f200 GetConsoleOutputCP
0x41f204 FlushFileBuffers
0x41f208 CreateFileA
0x41f20c CloseHandle
GDI32.dll
0x41f000 GetCharWidthW
WINHTTP.dll
0x41f214 WinHttpCloseHandle
EAT(Export Address Table) is none