ScreenShot
| Created | 2021.09.02 10:10 | Machine | s1_win7_x6402 |
| Filename | udptest.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 21 detected (malicious, high confidence, Unsafe, Save, confidence, 100%, ZexaF, tqW@aWANvoeG, Kryptik, Eldorado, Attribute, HighConfidence, Obscure, CLASSIC, Racoon, score, Static AI, Malicious PE) | ||
| md5 | 0f7b6037afdc508b17dd99eb1610ef49 | ||
| sha256 | a17d32cc61b54b318b29d3d89ef9fd4f925cb828b2510b3c411bfb0e9f2c8637 | ||
| ssdeep | 6144:ue30UkkCp5wJr2s2Tsp2HODPIgLO0F5SBU/QE5TmGSXDoevju8:t0FkCp5wJEowOzO0TpXwdDNvR | ||
| imphash | 5c93c97e908d457a11b98f665a319008 | ||
| impfuzzy | 48:CEI8OUBUdfKmGXyOZ+fc3UtHaEG1SvC6d:lS8EimGXyY+fcEt6EG1SvC6d | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 GetNativeSystemInfo
0x41f008 lstrlenA
0x41f00c TlsGetValue
0x41f010 GetStringTypeA
0x41f014 InterlockedIncrement
0x41f018 GetQueuedCompletionStatus
0x41f01c ReadConsoleA
0x41f020 GlobalLock
0x41f024 FreeEnvironmentStringsA
0x41f028 GetModuleHandleW
0x41f02c GetTickCount
0x41f030 GetPrivateProfileStringW
0x41f034 WriteFile
0x41f038 SetCommState
0x41f03c GlobalAlloc
0x41f040 LoadLibraryW
0x41f044 GetSystemWindowsDirectoryA
0x41f048 GetConsoleAliasExesLengthW
0x41f04c GetExitCodeProcess
0x41f050 IsDBCSLeadByte
0x41f054 ReadFile
0x41f058 GetStartupInfoW
0x41f05c GlobalUnlock
0x41f060 GetNamedPipeHandleStateW
0x41f064 LCMapStringA
0x41f068 GetPrivateProfileIntW
0x41f06c InterlockedExchange
0x41f070 GetStartupInfoA
0x41f074 GetLastError
0x41f078 ReadConsoleOutputCharacterA
0x41f07c GetProcAddress
0x41f080 VirtualAlloc
0x41f084 CopyFileA
0x41f088 LoadLibraryA
0x41f08c CreateSemaphoreW
0x41f090 GetFileType
0x41f094 SetCurrentDirectoryW
0x41f098 HeapWalk
0x41f09c FindAtomA
0x41f0a0 Process32NextW
0x41f0a4 FreeEnvironmentStringsW
0x41f0a8 EnumResourceNamesA
0x41f0ac GetCurrentThreadId
0x41f0b0 GetCPInfoExA
0x41f0b4 SetThreadAffinityMask
0x41f0b8 FindAtomW
0x41f0bc DeleteFileW
0x41f0c0 GetSystemTime
0x41f0c4 CopyFileExA
0x41f0c8 InterlockedDecrement
0x41f0cc Sleep
0x41f0d0 InitializeCriticalSection
0x41f0d4 DeleteCriticalSection
0x41f0d8 EnterCriticalSection
0x41f0dc LeaveCriticalSection
0x41f0e0 MultiByteToWideChar
0x41f0e4 GetCommandLineA
0x41f0e8 UnhandledExceptionFilter
0x41f0ec SetUnhandledExceptionFilter
0x41f0f0 GetModuleFileNameW
0x41f0f4 HeapValidate
0x41f0f8 IsBadReadPtr
0x41f0fc RaiseException
0x41f100 RtlUnwind
0x41f104 TerminateProcess
0x41f108 GetCurrentProcess
0x41f10c IsDebuggerPresent
0x41f110 SetStdHandle
0x41f114 WideCharToMultiByte
0x41f118 GetConsoleCP
0x41f11c GetConsoleMode
0x41f120 GetACP
0x41f124 GetOEMCP
0x41f128 GetCPInfo
0x41f12c IsValidCodePage
0x41f130 TlsAlloc
0x41f134 TlsSetValue
0x41f138 TlsFree
0x41f13c SetLastError
0x41f140 QueryPerformanceCounter
0x41f144 GetCurrentProcessId
0x41f148 GetSystemTimeAsFileTime
0x41f14c ExitProcess
0x41f150 GetModuleFileNameA
0x41f154 GetEnvironmentStrings
0x41f158 GetEnvironmentStringsW
0x41f15c SetHandleCount
0x41f160 GetStdHandle
0x41f164 HeapDestroy
0x41f168 HeapCreate
0x41f16c HeapFree
0x41f170 VirtualFree
0x41f174 FlushFileBuffers
0x41f178 DebugBreak
0x41f17c OutputDebugStringA
0x41f180 WriteConsoleW
0x41f184 OutputDebugStringW
0x41f188 HeapAlloc
0x41f18c HeapSize
0x41f190 HeapReAlloc
0x41f194 InitializeCriticalSectionAndSpinCount
0x41f198 WriteConsoleA
0x41f19c GetConsoleOutputCP
0x41f1a0 SetFilePointer
0x41f1a4 LCMapStringW
0x41f1a8 GetStringTypeW
0x41f1ac GetLocaleInfoA
0x41f1b0 CreateFileA
0x41f1b4 CloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 GetNativeSystemInfo
0x41f008 lstrlenA
0x41f00c TlsGetValue
0x41f010 GetStringTypeA
0x41f014 InterlockedIncrement
0x41f018 GetQueuedCompletionStatus
0x41f01c ReadConsoleA
0x41f020 GlobalLock
0x41f024 FreeEnvironmentStringsA
0x41f028 GetModuleHandleW
0x41f02c GetTickCount
0x41f030 GetPrivateProfileStringW
0x41f034 WriteFile
0x41f038 SetCommState
0x41f03c GlobalAlloc
0x41f040 LoadLibraryW
0x41f044 GetSystemWindowsDirectoryA
0x41f048 GetConsoleAliasExesLengthW
0x41f04c GetExitCodeProcess
0x41f050 IsDBCSLeadByte
0x41f054 ReadFile
0x41f058 GetStartupInfoW
0x41f05c GlobalUnlock
0x41f060 GetNamedPipeHandleStateW
0x41f064 LCMapStringA
0x41f068 GetPrivateProfileIntW
0x41f06c InterlockedExchange
0x41f070 GetStartupInfoA
0x41f074 GetLastError
0x41f078 ReadConsoleOutputCharacterA
0x41f07c GetProcAddress
0x41f080 VirtualAlloc
0x41f084 CopyFileA
0x41f088 LoadLibraryA
0x41f08c CreateSemaphoreW
0x41f090 GetFileType
0x41f094 SetCurrentDirectoryW
0x41f098 HeapWalk
0x41f09c FindAtomA
0x41f0a0 Process32NextW
0x41f0a4 FreeEnvironmentStringsW
0x41f0a8 EnumResourceNamesA
0x41f0ac GetCurrentThreadId
0x41f0b0 GetCPInfoExA
0x41f0b4 SetThreadAffinityMask
0x41f0b8 FindAtomW
0x41f0bc DeleteFileW
0x41f0c0 GetSystemTime
0x41f0c4 CopyFileExA
0x41f0c8 InterlockedDecrement
0x41f0cc Sleep
0x41f0d0 InitializeCriticalSection
0x41f0d4 DeleteCriticalSection
0x41f0d8 EnterCriticalSection
0x41f0dc LeaveCriticalSection
0x41f0e0 MultiByteToWideChar
0x41f0e4 GetCommandLineA
0x41f0e8 UnhandledExceptionFilter
0x41f0ec SetUnhandledExceptionFilter
0x41f0f0 GetModuleFileNameW
0x41f0f4 HeapValidate
0x41f0f8 IsBadReadPtr
0x41f0fc RaiseException
0x41f100 RtlUnwind
0x41f104 TerminateProcess
0x41f108 GetCurrentProcess
0x41f10c IsDebuggerPresent
0x41f110 SetStdHandle
0x41f114 WideCharToMultiByte
0x41f118 GetConsoleCP
0x41f11c GetConsoleMode
0x41f120 GetACP
0x41f124 GetOEMCP
0x41f128 GetCPInfo
0x41f12c IsValidCodePage
0x41f130 TlsAlloc
0x41f134 TlsSetValue
0x41f138 TlsFree
0x41f13c SetLastError
0x41f140 QueryPerformanceCounter
0x41f144 GetCurrentProcessId
0x41f148 GetSystemTimeAsFileTime
0x41f14c ExitProcess
0x41f150 GetModuleFileNameA
0x41f154 GetEnvironmentStrings
0x41f158 GetEnvironmentStringsW
0x41f15c SetHandleCount
0x41f160 GetStdHandle
0x41f164 HeapDestroy
0x41f168 HeapCreate
0x41f16c HeapFree
0x41f170 VirtualFree
0x41f174 FlushFileBuffers
0x41f178 DebugBreak
0x41f17c OutputDebugStringA
0x41f180 WriteConsoleW
0x41f184 OutputDebugStringW
0x41f188 HeapAlloc
0x41f18c HeapSize
0x41f190 HeapReAlloc
0x41f194 InitializeCriticalSectionAndSpinCount
0x41f198 WriteConsoleA
0x41f19c GetConsoleOutputCP
0x41f1a0 SetFilePointer
0x41f1a4 LCMapStringW
0x41f1a8 GetStringTypeW
0x41f1ac GetLocaleInfoA
0x41f1b0 CreateFileA
0x41f1b4 CloseHandle
EAT(Export Address Table) is none