ScreenShot
| Created | 2021.09.04 14:02 | Machine | s1_win7_x6402 |
| Filename | Real01_1.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 41 detected (AIDetect, malware2, Convagent, malicious, high confidence, Fragtor, Unsafe, Save, confidence, 100%, GenKryptik, Kryptik, Eldorado, Attribute, HighConfidence, HMHM, Chapak, MalwareX, Krypt, kcloud, StopCrypt, score, Artemis, ai score=88, Obscure, CLASSIC, Static AI, Malicious PE, FJVV, ZexaF, RqW@aenyiriG, GdSda, susgen) | ||
| md5 | 5cde4a5c2fad12bc819ccc89b6baae53 | ||
| sha256 | 76e0252ac375659fb9f2c3acc53856a21cf414ed0890f32bcbded816bad9220f | ||
| ssdeep | 12288:VZ+QFv+CZ77eFqPTEy2sf8WlxICDjdEQ4E2WqTyDCxGtNB2twCXjgWG:/+QFlDPTSsf881Dj2Q4E2Wiy+7emUWG | ||
| imphash | 235315ed783e15a9f0262d40cb1ad6da | ||
| impfuzzy | 24:jOhOokirnXV4WPsOoMckXGB+V4vKdzUbDuaBgWZ0cO8OovFaEafPvPjM1udJbthJ:ChTHMOUBUdGmcOjKaEafnAAthS7xOdZ | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 41 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 GetCommandLineW
0x41e004 GetFileSize
0x41e008 GetNativeSystemInfo
0x41e00c lstrlenA
0x41e010 TlsGetValue
0x41e014 GetStringTypeA
0x41e018 SetLocalTime
0x41e01c FindResourceExW
0x41e020 InterlockedIncrement
0x41e024 GetQueuedCompletionStatus
0x41e028 ReadConsoleA
0x41e02c GetNamedPipeHandleStateA
0x41e030 GlobalLock
0x41e034 FreeEnvironmentStringsA
0x41e038 GetModuleHandleW
0x41e03c GetTickCount
0x41e040 GetSystemTimeAsFileTime
0x41e044 GetPrivateProfileStringW
0x41e048 WriteFile
0x41e04c SetCommState
0x41e050 GlobalAlloc
0x41e054 LoadLibraryW
0x41e058 GetSystemWindowsDirectoryA
0x41e05c GetConsoleAliasExesLengthW
0x41e060 GetExitCodeProcess
0x41e064 IsDBCSLeadByte
0x41e068 ReadFile
0x41e06c GetStartupInfoW
0x41e070 GlobalUnlock
0x41e074 GetNamedPipeHandleStateW
0x41e078 LCMapStringA
0x41e07c GetPrivateProfileIntW
0x41e080 InterlockedExchange
0x41e084 GetStartupInfoA
0x41e088 GetLastError
0x41e08c ReadConsoleOutputCharacterA
0x41e090 GetProcAddress
0x41e094 VirtualAlloc
0x41e098 CopyFileA
0x41e09c LoadLibraryA
0x41e0a0 CreateSemaphoreW
0x41e0a4 SetCurrentDirectoryW
0x41e0a8 HeapWalk
0x41e0ac FindAtomA
0x41e0b0 Process32NextW
0x41e0b4 FreeEnvironmentStringsW
0x41e0b8 EnumResourceNamesA
0x41e0bc GetCurrentThreadId
0x41e0c0 GetCPInfoExA
0x41e0c4 DeleteFileW
0x41e0c8 CopyFileExA
0x41e0cc MultiByteToWideChar
0x41e0d0 GetCommandLineA
0x41e0d4 HeapValidate
0x41e0d8 IsBadReadPtr
0x41e0dc RaiseException
0x41e0e0 LeaveCriticalSection
0x41e0e4 EnterCriticalSection
0x41e0e8 SetStdHandle
0x41e0ec GetFileType
0x41e0f0 WideCharToMultiByte
0x41e0f4 GetConsoleCP
0x41e0f8 GetConsoleMode
0x41e0fc DeleteCriticalSection
0x41e100 GetModuleFileNameW
0x41e104 InterlockedDecrement
0x41e108 GetACP
0x41e10c GetOEMCP
0x41e110 GetCPInfo
0x41e114 IsValidCodePage
0x41e118 TlsAlloc
0x41e11c TlsSetValue
0x41e120 TlsFree
0x41e124 SetLastError
0x41e128 UnhandledExceptionFilter
0x41e12c SetUnhandledExceptionFilter
0x41e130 QueryPerformanceCounter
0x41e134 GetCurrentProcessId
0x41e138 Sleep
0x41e13c ExitProcess
0x41e140 GetModuleFileNameA
0x41e144 GetEnvironmentStrings
0x41e148 GetEnvironmentStringsW
0x41e14c SetHandleCount
0x41e150 GetStdHandle
0x41e154 HeapDestroy
0x41e158 HeapCreate
0x41e15c HeapFree
0x41e160 VirtualFree
0x41e164 HeapAlloc
0x41e168 TerminateProcess
0x41e16c GetCurrentProcess
0x41e170 IsDebuggerPresent
0x41e174 HeapSize
0x41e178 HeapReAlloc
0x41e17c InitializeCriticalSectionAndSpinCount
0x41e180 WriteConsoleA
0x41e184 GetConsoleOutputCP
0x41e188 WriteConsoleW
0x41e18c SetFilePointer
0x41e190 RtlUnwind
0x41e194 DebugBreak
0x41e198 OutputDebugStringA
0x41e19c OutputDebugStringW
0x41e1a0 LCMapStringW
0x41e1a4 GetStringTypeW
0x41e1a8 GetLocaleInfoA
0x41e1ac CreateFileA
0x41e1b0 CloseHandle
0x41e1b4 FlushFileBuffers
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 GetCommandLineW
0x41e004 GetFileSize
0x41e008 GetNativeSystemInfo
0x41e00c lstrlenA
0x41e010 TlsGetValue
0x41e014 GetStringTypeA
0x41e018 SetLocalTime
0x41e01c FindResourceExW
0x41e020 InterlockedIncrement
0x41e024 GetQueuedCompletionStatus
0x41e028 ReadConsoleA
0x41e02c GetNamedPipeHandleStateA
0x41e030 GlobalLock
0x41e034 FreeEnvironmentStringsA
0x41e038 GetModuleHandleW
0x41e03c GetTickCount
0x41e040 GetSystemTimeAsFileTime
0x41e044 GetPrivateProfileStringW
0x41e048 WriteFile
0x41e04c SetCommState
0x41e050 GlobalAlloc
0x41e054 LoadLibraryW
0x41e058 GetSystemWindowsDirectoryA
0x41e05c GetConsoleAliasExesLengthW
0x41e060 GetExitCodeProcess
0x41e064 IsDBCSLeadByte
0x41e068 ReadFile
0x41e06c GetStartupInfoW
0x41e070 GlobalUnlock
0x41e074 GetNamedPipeHandleStateW
0x41e078 LCMapStringA
0x41e07c GetPrivateProfileIntW
0x41e080 InterlockedExchange
0x41e084 GetStartupInfoA
0x41e088 GetLastError
0x41e08c ReadConsoleOutputCharacterA
0x41e090 GetProcAddress
0x41e094 VirtualAlloc
0x41e098 CopyFileA
0x41e09c LoadLibraryA
0x41e0a0 CreateSemaphoreW
0x41e0a4 SetCurrentDirectoryW
0x41e0a8 HeapWalk
0x41e0ac FindAtomA
0x41e0b0 Process32NextW
0x41e0b4 FreeEnvironmentStringsW
0x41e0b8 EnumResourceNamesA
0x41e0bc GetCurrentThreadId
0x41e0c0 GetCPInfoExA
0x41e0c4 DeleteFileW
0x41e0c8 CopyFileExA
0x41e0cc MultiByteToWideChar
0x41e0d0 GetCommandLineA
0x41e0d4 HeapValidate
0x41e0d8 IsBadReadPtr
0x41e0dc RaiseException
0x41e0e0 LeaveCriticalSection
0x41e0e4 EnterCriticalSection
0x41e0e8 SetStdHandle
0x41e0ec GetFileType
0x41e0f0 WideCharToMultiByte
0x41e0f4 GetConsoleCP
0x41e0f8 GetConsoleMode
0x41e0fc DeleteCriticalSection
0x41e100 GetModuleFileNameW
0x41e104 InterlockedDecrement
0x41e108 GetACP
0x41e10c GetOEMCP
0x41e110 GetCPInfo
0x41e114 IsValidCodePage
0x41e118 TlsAlloc
0x41e11c TlsSetValue
0x41e120 TlsFree
0x41e124 SetLastError
0x41e128 UnhandledExceptionFilter
0x41e12c SetUnhandledExceptionFilter
0x41e130 QueryPerformanceCounter
0x41e134 GetCurrentProcessId
0x41e138 Sleep
0x41e13c ExitProcess
0x41e140 GetModuleFileNameA
0x41e144 GetEnvironmentStrings
0x41e148 GetEnvironmentStringsW
0x41e14c SetHandleCount
0x41e150 GetStdHandle
0x41e154 HeapDestroy
0x41e158 HeapCreate
0x41e15c HeapFree
0x41e160 VirtualFree
0x41e164 HeapAlloc
0x41e168 TerminateProcess
0x41e16c GetCurrentProcess
0x41e170 IsDebuggerPresent
0x41e174 HeapSize
0x41e178 HeapReAlloc
0x41e17c InitializeCriticalSectionAndSpinCount
0x41e180 WriteConsoleA
0x41e184 GetConsoleOutputCP
0x41e188 WriteConsoleW
0x41e18c SetFilePointer
0x41e190 RtlUnwind
0x41e194 DebugBreak
0x41e198 OutputDebugStringA
0x41e19c OutputDebugStringW
0x41e1a0 LCMapStringW
0x41e1a4 GetStringTypeW
0x41e1a8 GetLocaleInfoA
0x41e1ac CreateFileA
0x41e1b0 CloseHandle
0x41e1b4 FlushFileBuffers
EAT(Export Address Table) is none