ScreenShot
| Created | 2021.09.07 18:58 | Machine | s1_win7_x6401 |
| Filename | rollerkind2.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 22 detected (AIDetect, malware2, malicious, high confidence, Stop, Unsafe, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, WinGo, Ranumbot, Score, Wacatac, BScope, Chapak, Generic@ML, RDML, Hx78nZ+JjztfOGwMH+Ya5g, Static AI, Malicious PE) | ||
| md5 | 69e1794d5d6331000ad3d26f6876432f | ||
| sha256 | 7a887c39b8566d5bae7af7e520bc90ffc520d30fd25bf3ae4e7ea21466de5bb8 | ||
| ssdeep | 12288:o16B/RmIwNXQ2E8UZ9BMRbTfEeFK0xJPCz/c3xw:oGJ5T2EhGvtLLhw | ||
| imphash | 35e1a5a67390846ef9c927633accec41 | ||
| impfuzzy | 96:tv6yaX1c0LXEd8B8XO/+fcjt6EG5Uccq2/:YbFcku8eeXq4 | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 22 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 FileTimeToDosDateTime
0x41e004 FindFirstChangeNotificationW
0x41e008 lstrlenA
0x41e00c CopyFileExW
0x41e010 TlsGetValue
0x41e014 GetCPInfo
0x41e018 InterlockedIncrement
0x41e01c GetQueuedCompletionStatus
0x41e020 ReadConsoleA
0x41e024 CompareFileTime
0x41e028 GlobalSize
0x41e02c GetNamedPipeHandleStateA
0x41e030 GlobalLock
0x41e034 CancelWaitableTimer
0x41e038 GetModuleHandleW
0x41e03c GetCurrentThread
0x41e040 GetSystemTimeAsFileTime
0x41e044 WriteFile
0x41e048 SetCommState
0x41e04c GetCommandLineA
0x41e050 GetPrivateProfileIntA
0x41e054 LoadLibraryW
0x41e058 CopyFileW
0x41e05c GetSystemWindowsDirectoryA
0x41e060 GetConsoleAliasExesLengthW
0x41e064 GetVersionExW
0x41e068 IsProcessorFeaturePresent
0x41e06c TerminateProcess
0x41e070 SetThreadPriority
0x41e074 GetStartupInfoW
0x41e078 LCMapStringA
0x41e07c GetPrivateProfileIntW
0x41e080 CreateDirectoryA
0x41e084 InterlockedExchange
0x41e088 GetStartupInfoA
0x41e08c SetThreadLocale
0x41e090 GetCPInfoExW
0x41e094 GetLastError
0x41e098 GetCurrentDirectoryW
0x41e09c GetProcAddress
0x41e0a0 SetFirmwareEnvironmentVariableW
0x41e0a4 SearchPathA
0x41e0a8 GetPrivateProfileStringA
0x41e0ac OpenWaitableTimerA
0x41e0b0 LoadLibraryA
0x41e0b4 Process32FirstW
0x41e0b8 LocalAlloc
0x41e0bc GetFileType
0x41e0c0 CreateFileMappingW
0x41e0c4 SetCurrentDirectoryW
0x41e0c8 SetThreadIdealProcessor
0x41e0cc HeapWalk
0x41e0d0 FindAtomA
0x41e0d4 SetEnvironmentVariableA
0x41e0d8 QueryMemoryResourceNotification
0x41e0dc FreeEnvironmentStringsW
0x41e0e0 EnumResourceNamesA
0x41e0e4 GetStringTypeW
0x41e0e8 RequestWakeupLatency
0x41e0ec FindAtomW
0x41e0f0 ReadConsoleOutputCharacterW
0x41e0f4 GetSystemTime
0x41e0f8 GetProfileSectionW
0x41e0fc DeleteFileA
0x41e100 InterlockedDecrement
0x41e104 Sleep
0x41e108 InitializeCriticalSection
0x41e10c DeleteCriticalSection
0x41e110 EnterCriticalSection
0x41e114 LeaveCriticalSection
0x41e118 UnhandledExceptionFilter
0x41e11c SetUnhandledExceptionFilter
0x41e120 GetModuleFileNameW
0x41e124 HeapValidate
0x41e128 IsBadReadPtr
0x41e12c RaiseException
0x41e130 RtlUnwind
0x41e134 GetCurrentProcess
0x41e138 IsDebuggerPresent
0x41e13c TlsAlloc
0x41e140 TlsSetValue
0x41e144 GetCurrentThreadId
0x41e148 TlsFree
0x41e14c SetLastError
0x41e150 QueryPerformanceCounter
0x41e154 GetTickCount
0x41e158 GetCurrentProcessId
0x41e15c ExitProcess
0x41e160 GetEnvironmentStringsW
0x41e164 GetCommandLineW
0x41e168 SetHandleCount
0x41e16c GetStdHandle
0x41e170 HeapDestroy
0x41e174 HeapCreate
0x41e178 HeapFree
0x41e17c VirtualFree
0x41e180 GetModuleFileNameA
0x41e184 FlushFileBuffers
0x41e188 WideCharToMultiByte
0x41e18c GetConsoleCP
0x41e190 GetConsoleMode
0x41e194 DebugBreak
0x41e198 OutputDebugStringA
0x41e19c WriteConsoleW
0x41e1a0 OutputDebugStringW
0x41e1a4 HeapAlloc
0x41e1a8 HeapSize
0x41e1ac HeapReAlloc
0x41e1b0 VirtualAlloc
0x41e1b4 GetACP
0x41e1b8 GetOEMCP
0x41e1bc IsValidCodePage
0x41e1c0 InitializeCriticalSectionAndSpinCount
0x41e1c4 SetStdHandle
0x41e1c8 WriteConsoleA
0x41e1cc GetConsoleOutputCP
0x41e1d0 MultiByteToWideChar
0x41e1d4 SetFilePointer
0x41e1d8 LCMapStringW
0x41e1dc GetStringTypeA
0x41e1e0 GetLocaleInfoA
0x41e1e4 CloseHandle
0x41e1e8 CreateFileA
USER32.dll
0x41e1f8 GetComboBoxInfo
MSIMG32.dll
0x41e1f0 AlphaBlend
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 FileTimeToDosDateTime
0x41e004 FindFirstChangeNotificationW
0x41e008 lstrlenA
0x41e00c CopyFileExW
0x41e010 TlsGetValue
0x41e014 GetCPInfo
0x41e018 InterlockedIncrement
0x41e01c GetQueuedCompletionStatus
0x41e020 ReadConsoleA
0x41e024 CompareFileTime
0x41e028 GlobalSize
0x41e02c GetNamedPipeHandleStateA
0x41e030 GlobalLock
0x41e034 CancelWaitableTimer
0x41e038 GetModuleHandleW
0x41e03c GetCurrentThread
0x41e040 GetSystemTimeAsFileTime
0x41e044 WriteFile
0x41e048 SetCommState
0x41e04c GetCommandLineA
0x41e050 GetPrivateProfileIntA
0x41e054 LoadLibraryW
0x41e058 CopyFileW
0x41e05c GetSystemWindowsDirectoryA
0x41e060 GetConsoleAliasExesLengthW
0x41e064 GetVersionExW
0x41e068 IsProcessorFeaturePresent
0x41e06c TerminateProcess
0x41e070 SetThreadPriority
0x41e074 GetStartupInfoW
0x41e078 LCMapStringA
0x41e07c GetPrivateProfileIntW
0x41e080 CreateDirectoryA
0x41e084 InterlockedExchange
0x41e088 GetStartupInfoA
0x41e08c SetThreadLocale
0x41e090 GetCPInfoExW
0x41e094 GetLastError
0x41e098 GetCurrentDirectoryW
0x41e09c GetProcAddress
0x41e0a0 SetFirmwareEnvironmentVariableW
0x41e0a4 SearchPathA
0x41e0a8 GetPrivateProfileStringA
0x41e0ac OpenWaitableTimerA
0x41e0b0 LoadLibraryA
0x41e0b4 Process32FirstW
0x41e0b8 LocalAlloc
0x41e0bc GetFileType
0x41e0c0 CreateFileMappingW
0x41e0c4 SetCurrentDirectoryW
0x41e0c8 SetThreadIdealProcessor
0x41e0cc HeapWalk
0x41e0d0 FindAtomA
0x41e0d4 SetEnvironmentVariableA
0x41e0d8 QueryMemoryResourceNotification
0x41e0dc FreeEnvironmentStringsW
0x41e0e0 EnumResourceNamesA
0x41e0e4 GetStringTypeW
0x41e0e8 RequestWakeupLatency
0x41e0ec FindAtomW
0x41e0f0 ReadConsoleOutputCharacterW
0x41e0f4 GetSystemTime
0x41e0f8 GetProfileSectionW
0x41e0fc DeleteFileA
0x41e100 InterlockedDecrement
0x41e104 Sleep
0x41e108 InitializeCriticalSection
0x41e10c DeleteCriticalSection
0x41e110 EnterCriticalSection
0x41e114 LeaveCriticalSection
0x41e118 UnhandledExceptionFilter
0x41e11c SetUnhandledExceptionFilter
0x41e120 GetModuleFileNameW
0x41e124 HeapValidate
0x41e128 IsBadReadPtr
0x41e12c RaiseException
0x41e130 RtlUnwind
0x41e134 GetCurrentProcess
0x41e138 IsDebuggerPresent
0x41e13c TlsAlloc
0x41e140 TlsSetValue
0x41e144 GetCurrentThreadId
0x41e148 TlsFree
0x41e14c SetLastError
0x41e150 QueryPerformanceCounter
0x41e154 GetTickCount
0x41e158 GetCurrentProcessId
0x41e15c ExitProcess
0x41e160 GetEnvironmentStringsW
0x41e164 GetCommandLineW
0x41e168 SetHandleCount
0x41e16c GetStdHandle
0x41e170 HeapDestroy
0x41e174 HeapCreate
0x41e178 HeapFree
0x41e17c VirtualFree
0x41e180 GetModuleFileNameA
0x41e184 FlushFileBuffers
0x41e188 WideCharToMultiByte
0x41e18c GetConsoleCP
0x41e190 GetConsoleMode
0x41e194 DebugBreak
0x41e198 OutputDebugStringA
0x41e19c WriteConsoleW
0x41e1a0 OutputDebugStringW
0x41e1a4 HeapAlloc
0x41e1a8 HeapSize
0x41e1ac HeapReAlloc
0x41e1b0 VirtualAlloc
0x41e1b4 GetACP
0x41e1b8 GetOEMCP
0x41e1bc IsValidCodePage
0x41e1c0 InitializeCriticalSectionAndSpinCount
0x41e1c4 SetStdHandle
0x41e1c8 WriteConsoleA
0x41e1cc GetConsoleOutputCP
0x41e1d0 MultiByteToWideChar
0x41e1d4 SetFilePointer
0x41e1d8 LCMapStringW
0x41e1dc GetStringTypeA
0x41e1e0 GetLocaleInfoA
0x41e1e4 CloseHandle
0x41e1e8 CreateFileA
USER32.dll
0x41e1f8 GetComboBoxInfo
MSIMG32.dll
0x41e1f0 AlphaBlend
EAT(Export Address Table) is none