ScreenShot
| Created | 2021.09.09 09:53 | Machine | s1_win7_x6401 |
| Filename | sufile.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 21 detected (malicious, high confidence, Unsafe, Save, Hacktool, confidence, 100%, ZexaF, kq0@aeyV5PU, Kryptik, Eldorado, Attribute, HighConfidence, Generic@ML, RDML, ZTuTR9FmaItfDdpxRzkZLw, Score, Sabsik, Static AI, Malicious PE, susgen) | ||
| md5 | f8a663ba086d55062bd727777b7cb02c | ||
| sha256 | f3caecffb11faf28d31a3f30e39511ab1dbbce621259b73172d94f9a75962d1c | ||
| ssdeep | 1536:krAWHeQZBS/67oWD6kJ9tHrHP945aNG3U9G/fVGpXG5/y3B0rjPaR9GG49Omw5H+:gBtqerGej9wfVCX3BEiSLkmw5orQ1n | ||
| imphash | d4051887ae6f6a87571778f979cd61ef | ||
| impfuzzy | 24:qec0Z9oOoviIDSxxD19DSY8zHU/jt/J3J8X5vQyv9kRTAjM0ipluL9N:xZZTG7z0/jthK/9gQWsxN | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 21 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 SetLocalTime
0x41e004 lstrcpynA
0x41e008 InterlockedIncrement
0x41e00c ReadConsoleA
0x41e010 InterlockedDecrement
0x41e014 GetCurrentProcess
0x41e018 GetEnvironmentStringsW
0x41e01c GetUserDefaultLCID
0x41e020 AddConsoleAliasW
0x41e024 SetEvent
0x41e028 GetCommandLineA
0x41e02c GetEnvironmentStrings
0x41e030 ReadConsoleInputA
0x41e034 GetSystemWindowsDirectoryA
0x41e038 DeleteVolumeMountPointW
0x41e03c LeaveCriticalSection
0x41e040 GetComputerNameExA
0x41e044 FindNextVolumeW
0x41e048 GetLocaleInfoA
0x41e04c ReadFile
0x41e050 SetConsoleTitleA
0x41e054 GetLongPathNameW
0x41e058 GetProcAddress
0x41e05c PeekConsoleInputW
0x41e060 VerLanguageNameA
0x41e064 CopyFileA
0x41e068 EnterCriticalSection
0x41e06c GetAtomNameA
0x41e070 WriteConsoleA
0x41e074 LocalAlloc
0x41e078 CreateTapePartition
0x41e07c SetConsoleOutputCP
0x41e080 GetModuleFileNameA
0x41e084 GetOEMCP
0x41e088 GetModuleHandleA
0x41e08c GetFileAttributesExW
0x41e090 GetCPInfoExA
0x41e094 Module32Next
0x41e098 ReadConsoleInputW
0x41e09c GetCurrentProcessId
0x41e0a0 VerifyVersionInfoA
0x41e0a4 GetStartupInfoA
0x41e0a8 TerminateProcess
0x41e0ac UnhandledExceptionFilter
0x41e0b0 SetUnhandledExceptionFilter
0x41e0b4 IsDebuggerPresent
0x41e0b8 GetModuleHandleW
0x41e0bc TlsGetValue
0x41e0c0 TlsAlloc
0x41e0c4 TlsSetValue
0x41e0c8 TlsFree
0x41e0cc SetLastError
0x41e0d0 GetCurrentThreadId
0x41e0d4 GetLastError
0x41e0d8 Sleep
0x41e0dc HeapSize
0x41e0e0 ExitProcess
0x41e0e4 HeapFree
0x41e0e8 SetFilePointer
0x41e0ec WriteFile
0x41e0f0 GetStdHandle
0x41e0f4 FreeEnvironmentStringsA
0x41e0f8 FreeEnvironmentStringsW
0x41e0fc WideCharToMultiByte
0x41e100 SetHandleCount
0x41e104 GetFileType
0x41e108 DeleteCriticalSection
0x41e10c HeapCreate
0x41e110 VirtualFree
0x41e114 QueryPerformanceCounter
0x41e118 GetTickCount
0x41e11c GetSystemTimeAsFileTime
0x41e120 GetConsoleCP
0x41e124 GetConsoleMode
0x41e128 GetCPInfo
0x41e12c GetACP
0x41e130 IsValidCodePage
0x41e134 RaiseException
0x41e138 HeapAlloc
0x41e13c HeapReAlloc
0x41e140 VirtualAlloc
0x41e144 LoadLibraryA
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c RtlUnwind
0x41e150 SetStdHandle
0x41e154 FlushFileBuffers
0x41e158 GetConsoleOutputCP
0x41e15c WriteConsoleW
0x41e160 MultiByteToWideChar
0x41e164 LCMapStringA
0x41e168 LCMapStringW
0x41e16c GetStringTypeA
0x41e170 GetStringTypeW
0x41e174 CreateFileA
0x41e178 CloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 SetLocalTime
0x41e004 lstrcpynA
0x41e008 InterlockedIncrement
0x41e00c ReadConsoleA
0x41e010 InterlockedDecrement
0x41e014 GetCurrentProcess
0x41e018 GetEnvironmentStringsW
0x41e01c GetUserDefaultLCID
0x41e020 AddConsoleAliasW
0x41e024 SetEvent
0x41e028 GetCommandLineA
0x41e02c GetEnvironmentStrings
0x41e030 ReadConsoleInputA
0x41e034 GetSystemWindowsDirectoryA
0x41e038 DeleteVolumeMountPointW
0x41e03c LeaveCriticalSection
0x41e040 GetComputerNameExA
0x41e044 FindNextVolumeW
0x41e048 GetLocaleInfoA
0x41e04c ReadFile
0x41e050 SetConsoleTitleA
0x41e054 GetLongPathNameW
0x41e058 GetProcAddress
0x41e05c PeekConsoleInputW
0x41e060 VerLanguageNameA
0x41e064 CopyFileA
0x41e068 EnterCriticalSection
0x41e06c GetAtomNameA
0x41e070 WriteConsoleA
0x41e074 LocalAlloc
0x41e078 CreateTapePartition
0x41e07c SetConsoleOutputCP
0x41e080 GetModuleFileNameA
0x41e084 GetOEMCP
0x41e088 GetModuleHandleA
0x41e08c GetFileAttributesExW
0x41e090 GetCPInfoExA
0x41e094 Module32Next
0x41e098 ReadConsoleInputW
0x41e09c GetCurrentProcessId
0x41e0a0 VerifyVersionInfoA
0x41e0a4 GetStartupInfoA
0x41e0a8 TerminateProcess
0x41e0ac UnhandledExceptionFilter
0x41e0b0 SetUnhandledExceptionFilter
0x41e0b4 IsDebuggerPresent
0x41e0b8 GetModuleHandleW
0x41e0bc TlsGetValue
0x41e0c0 TlsAlloc
0x41e0c4 TlsSetValue
0x41e0c8 TlsFree
0x41e0cc SetLastError
0x41e0d0 GetCurrentThreadId
0x41e0d4 GetLastError
0x41e0d8 Sleep
0x41e0dc HeapSize
0x41e0e0 ExitProcess
0x41e0e4 HeapFree
0x41e0e8 SetFilePointer
0x41e0ec WriteFile
0x41e0f0 GetStdHandle
0x41e0f4 FreeEnvironmentStringsA
0x41e0f8 FreeEnvironmentStringsW
0x41e0fc WideCharToMultiByte
0x41e100 SetHandleCount
0x41e104 GetFileType
0x41e108 DeleteCriticalSection
0x41e10c HeapCreate
0x41e110 VirtualFree
0x41e114 QueryPerformanceCounter
0x41e118 GetTickCount
0x41e11c GetSystemTimeAsFileTime
0x41e120 GetConsoleCP
0x41e124 GetConsoleMode
0x41e128 GetCPInfo
0x41e12c GetACP
0x41e130 IsValidCodePage
0x41e134 RaiseException
0x41e138 HeapAlloc
0x41e13c HeapReAlloc
0x41e140 VirtualAlloc
0x41e144 LoadLibraryA
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c RtlUnwind
0x41e150 SetStdHandle
0x41e154 FlushFileBuffers
0x41e158 GetConsoleOutputCP
0x41e15c WriteConsoleW
0x41e160 MultiByteToWideChar
0x41e164 LCMapStringA
0x41e168 LCMapStringW
0x41e16c GetStringTypeA
0x41e170 GetStringTypeW
0x41e174 CreateFileA
0x41e178 CloseHandle
EAT(Export Address Table) is none