ScreenShot
| Created | 2021.09.09 09:09 | Machine | s1_win7_x6402 |
| Filename | BIN.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 31 detected (malicious, high confidence, GenericKD, confidence, 100%, Attribute, HighConfidence, GenKryptik, FKCH, Mucc, UMal, qetvq@0, Krypt, ai score=86, VBObfuse, Unsafe, ZevbaF, gm1@aal7@5nb, RnkBend, susgen) | ||
| md5 | 4103a2b04ede0d36e5079f6799cdfa14 | ||
| sha256 | b923011216d37106f2f497f12097ecd3412caca89edee1a49e8090b94344a310 | ||
| ssdeep | 1536:ND6lvtwb+xf5+DHztjos4Jmmq9vwzYxaIVUDqeMk3:N+twbk5+ZYmmqRnVU2eMk3 | ||
| imphash | 000ed791bfecbc3bb69fb230428c55f9 | ||
| impfuzzy | 24:n9wwgOSwOVy83YolTT/ESFNwvSTSwMSwC:nqwgPweR3YGTTlFNwKTSwMSwC | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 31 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Foreign language identified in PE resource |
| info | One or more processes crashed |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
MSVBVM60.DLL
0x401000 _CIcos
0x401004 _adj_fptan
0x401008 __vbaFreeVarList
0x40100c _adj_fdiv_m64
0x401010 __vbaFreeObjList
0x401014 _adj_fprem1
0x401018 __vbaHresultCheckObj
0x40101c _adj_fdiv_m32
0x401020 __vbaObjSet
0x401024 None
0x401028 _adj_fdiv_m16i
0x40102c _adj_fdivr_m16i
0x401030 _CIsin
0x401034 __vbaChkstk
0x401038 EVENT_SINK_AddRef
0x40103c _adj_fpatan
0x401040 EVENT_SINK_Release
0x401044 _CIsqrt
0x401048 EVENT_SINK_QueryInterface
0x40104c __vbaExceptHandler
0x401050 _adj_fprem
0x401054 _adj_fdivr_m64
0x401058 __vbaFPException
0x40105c _CIlog
0x401060 __vbaNew2
0x401064 _adj_fdiv_m32i
0x401068 _adj_fdivr_m32i
0x40106c _adj_fdivr_m32
0x401070 _adj_fdiv_r
0x401074 None
0x401078 _CIatan
0x40107c _allmul
0x401080 _CItan
0x401084 _CIexp
0x401088 __vbaFreeObj
0x40108c __vbaFreeStr
EAT(Export Address Table) is none
MSVBVM60.DLL
0x401000 _CIcos
0x401004 _adj_fptan
0x401008 __vbaFreeVarList
0x40100c _adj_fdiv_m64
0x401010 __vbaFreeObjList
0x401014 _adj_fprem1
0x401018 __vbaHresultCheckObj
0x40101c _adj_fdiv_m32
0x401020 __vbaObjSet
0x401024 None
0x401028 _adj_fdiv_m16i
0x40102c _adj_fdivr_m16i
0x401030 _CIsin
0x401034 __vbaChkstk
0x401038 EVENT_SINK_AddRef
0x40103c _adj_fpatan
0x401040 EVENT_SINK_Release
0x401044 _CIsqrt
0x401048 EVENT_SINK_QueryInterface
0x40104c __vbaExceptHandler
0x401050 _adj_fprem
0x401054 _adj_fdivr_m64
0x401058 __vbaFPException
0x40105c _CIlog
0x401060 __vbaNew2
0x401064 _adj_fdiv_m32i
0x401068 _adj_fdivr_m32i
0x40106c _adj_fdivr_m32
0x401070 _adj_fdiv_r
0x401074 None
0x401078 _CIatan
0x40107c _allmul
0x401080 _CItan
0x401084 _CIexp
0x401088 __vbaFreeObj
0x40108c __vbaFreeStr
EAT(Export Address Table) is none