ScreenShot
| Created | 2021.09.03 17:14 | Machine | s1_win7_x6402 |
| Filename | 78c06b9a03f2d8fcb86e7e0a8cedb5da.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetect, malware1, malicious, high confidence, Stop, Unsafe, Save, ZexaF, PqW@amcKQxhG, Kryptik, Eldorado, HMIB, Fragtor, WinGo, Ranumbot, Score, kcloud, Phonzy, PSWSteal, 88Y9KH, BScope, Chapak, Obscure, CLASSIC, Static AI, Malicious PE, susgen, confidence, 100%) | ||
| md5 | 78c06b9a03f2d8fcb86e7e0a8cedb5da | ||
| sha256 | aa12ad772adf47f16f71cd07714ee02ed1fddab1fa80551d6dbc5d50589aebfc | ||
| ssdeep | 12288:JNfMXf+jBb4HVz+4qjkUOFcXST7UXIopqqQEygFv1nea:vEPXV+4YkUOQt4U1QUFtea | ||
| imphash | d447818e27b033d337efcc8531718bf1 | ||
| impfuzzy | 48:76ODZBUdX81YK8X3SOZ+fcYtHaEGKUcvGp68e:7l3EX898X3SY+fcYt6EGKUcvO6x | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 EnumResourceNamesW
0x41e004 GetNativeSystemInfo
0x41e008 lstrlenA
0x41e00c GetStringTypeA
0x41e010 InterlockedIncrement
0x41e014 ReadConsoleA
0x41e018 GlobalLock
0x41e01c FreeEnvironmentStringsA
0x41e020 GetModuleHandleW
0x41e024 GetPrivateProfileStringW
0x41e028 WriteFile
0x41e02c SetCommState
0x41e030 GetCommandLineA
0x41e034 GlobalAlloc
0x41e038 GetPrivateProfileIntA
0x41e03c LoadLibraryW
0x41e040 GetSystemWindowsDirectoryA
0x41e044 GetConsoleAliasExesLengthW
0x41e048 GlobalFlags
0x41e04c GetExitCodeProcess
0x41e050 IsDBCSLeadByte
0x41e054 ReadFile
0x41e058 GetNamedPipeHandleStateW
0x41e05c LCMapStringA
0x41e060 GetPrivateProfileIntW
0x41e064 InterlockedExchange
0x41e068 GetStartupInfoA
0x41e06c GetLastError
0x41e070 ReadConsoleOutputCharacterA
0x41e074 GetProcAddress
0x41e078 VirtualAlloc
0x41e07c CopyFileA
0x41e080 GetPrivateProfileStringA
0x41e084 OpenWaitableTimerA
0x41e088 LoadLibraryA
0x41e08c GetFileType
0x41e090 SetCurrentDirectoryW
0x41e094 SetThreadIdealProcessor
0x41e098 HeapWalk
0x41e09c Process32NextW
0x41e0a0 CreateIoCompletionPort
0x41e0a4 QueryMemoryResourceNotification
0x41e0a8 GetCPInfoExA
0x41e0ac TlsAlloc
0x41e0b0 FindAtomW
0x41e0b4 DeleteFileW
0x41e0b8 GetSystemTime
0x41e0bc CopyFileExA
0x41e0c0 InterlockedDecrement
0x41e0c4 Sleep
0x41e0c8 InitializeCriticalSection
0x41e0cc DeleteCriticalSection
0x41e0d0 EnterCriticalSection
0x41e0d4 LeaveCriticalSection
0x41e0d8 MultiByteToWideChar
0x41e0dc GetStartupInfoW
0x41e0e0 UnhandledExceptionFilter
0x41e0e4 SetUnhandledExceptionFilter
0x41e0e8 GetModuleFileNameW
0x41e0ec HeapValidate
0x41e0f0 IsBadReadPtr
0x41e0f4 RaiseException
0x41e0f8 RtlUnwind
0x41e0fc TerminateProcess
0x41e100 GetCurrentProcess
0x41e104 IsDebuggerPresent
0x41e108 GetACP
0x41e10c GetOEMCP
0x41e110 GetCPInfo
0x41e114 IsValidCodePage
0x41e118 TlsGetValue
0x41e11c TlsSetValue
0x41e120 GetCurrentThreadId
0x41e124 TlsFree
0x41e128 SetLastError
0x41e12c QueryPerformanceCounter
0x41e130 GetTickCount
0x41e134 GetCurrentProcessId
0x41e138 GetSystemTimeAsFileTime
0x41e13c ExitProcess
0x41e140 FreeEnvironmentStringsW
0x41e144 GetEnvironmentStringsW
0x41e148 GetCommandLineW
0x41e14c SetHandleCount
0x41e150 GetStdHandle
0x41e154 HeapDestroy
0x41e158 HeapCreate
0x41e15c HeapFree
0x41e160 VirtualFree
0x41e164 GetModuleFileNameA
0x41e168 FlushFileBuffers
0x41e16c WideCharToMultiByte
0x41e170 GetConsoleCP
0x41e174 GetConsoleMode
0x41e178 DebugBreak
0x41e17c OutputDebugStringA
0x41e180 WriteConsoleW
0x41e184 OutputDebugStringW
0x41e188 HeapAlloc
0x41e18c HeapSize
0x41e190 HeapReAlloc
0x41e194 InitializeCriticalSectionAndSpinCount
0x41e198 LCMapStringW
0x41e19c GetStringTypeW
0x41e1a0 GetLocaleInfoA
0x41e1a4 SetStdHandle
0x41e1a8 WriteConsoleA
0x41e1ac GetConsoleOutputCP
0x41e1b0 SetFilePointer
0x41e1b4 CloseHandle
0x41e1b8 CreateFileA
USER32.dll
0x41e1c0 GetComboBoxInfo
WINHTTP.dll
0x41e1c8 WinHttpOpen
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 EnumResourceNamesW
0x41e004 GetNativeSystemInfo
0x41e008 lstrlenA
0x41e00c GetStringTypeA
0x41e010 InterlockedIncrement
0x41e014 ReadConsoleA
0x41e018 GlobalLock
0x41e01c FreeEnvironmentStringsA
0x41e020 GetModuleHandleW
0x41e024 GetPrivateProfileStringW
0x41e028 WriteFile
0x41e02c SetCommState
0x41e030 GetCommandLineA
0x41e034 GlobalAlloc
0x41e038 GetPrivateProfileIntA
0x41e03c LoadLibraryW
0x41e040 GetSystemWindowsDirectoryA
0x41e044 GetConsoleAliasExesLengthW
0x41e048 GlobalFlags
0x41e04c GetExitCodeProcess
0x41e050 IsDBCSLeadByte
0x41e054 ReadFile
0x41e058 GetNamedPipeHandleStateW
0x41e05c LCMapStringA
0x41e060 GetPrivateProfileIntW
0x41e064 InterlockedExchange
0x41e068 GetStartupInfoA
0x41e06c GetLastError
0x41e070 ReadConsoleOutputCharacterA
0x41e074 GetProcAddress
0x41e078 VirtualAlloc
0x41e07c CopyFileA
0x41e080 GetPrivateProfileStringA
0x41e084 OpenWaitableTimerA
0x41e088 LoadLibraryA
0x41e08c GetFileType
0x41e090 SetCurrentDirectoryW
0x41e094 SetThreadIdealProcessor
0x41e098 HeapWalk
0x41e09c Process32NextW
0x41e0a0 CreateIoCompletionPort
0x41e0a4 QueryMemoryResourceNotification
0x41e0a8 GetCPInfoExA
0x41e0ac TlsAlloc
0x41e0b0 FindAtomW
0x41e0b4 DeleteFileW
0x41e0b8 GetSystemTime
0x41e0bc CopyFileExA
0x41e0c0 InterlockedDecrement
0x41e0c4 Sleep
0x41e0c8 InitializeCriticalSection
0x41e0cc DeleteCriticalSection
0x41e0d0 EnterCriticalSection
0x41e0d4 LeaveCriticalSection
0x41e0d8 MultiByteToWideChar
0x41e0dc GetStartupInfoW
0x41e0e0 UnhandledExceptionFilter
0x41e0e4 SetUnhandledExceptionFilter
0x41e0e8 GetModuleFileNameW
0x41e0ec HeapValidate
0x41e0f0 IsBadReadPtr
0x41e0f4 RaiseException
0x41e0f8 RtlUnwind
0x41e0fc TerminateProcess
0x41e100 GetCurrentProcess
0x41e104 IsDebuggerPresent
0x41e108 GetACP
0x41e10c GetOEMCP
0x41e110 GetCPInfo
0x41e114 IsValidCodePage
0x41e118 TlsGetValue
0x41e11c TlsSetValue
0x41e120 GetCurrentThreadId
0x41e124 TlsFree
0x41e128 SetLastError
0x41e12c QueryPerformanceCounter
0x41e130 GetTickCount
0x41e134 GetCurrentProcessId
0x41e138 GetSystemTimeAsFileTime
0x41e13c ExitProcess
0x41e140 FreeEnvironmentStringsW
0x41e144 GetEnvironmentStringsW
0x41e148 GetCommandLineW
0x41e14c SetHandleCount
0x41e150 GetStdHandle
0x41e154 HeapDestroy
0x41e158 HeapCreate
0x41e15c HeapFree
0x41e160 VirtualFree
0x41e164 GetModuleFileNameA
0x41e168 FlushFileBuffers
0x41e16c WideCharToMultiByte
0x41e170 GetConsoleCP
0x41e174 GetConsoleMode
0x41e178 DebugBreak
0x41e17c OutputDebugStringA
0x41e180 WriteConsoleW
0x41e184 OutputDebugStringW
0x41e188 HeapAlloc
0x41e18c HeapSize
0x41e190 HeapReAlloc
0x41e194 InitializeCriticalSectionAndSpinCount
0x41e198 LCMapStringW
0x41e19c GetStringTypeW
0x41e1a0 GetLocaleInfoA
0x41e1a4 SetStdHandle
0x41e1a8 WriteConsoleA
0x41e1ac GetConsoleOutputCP
0x41e1b0 SetFilePointer
0x41e1b4 CloseHandle
0x41e1b8 CreateFileA
USER32.dll
0x41e1c0 GetComboBoxInfo
WINHTTP.dll
0x41e1c8 WinHttpOpen
EAT(Export Address Table) is none