ScreenShot
| Created | 2021.09.11 15:01 | Machine | s1_win7_x6402 |
| Filename | 82550150ac3397ed391e34aa99d35be4.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 17 detected (AIDetect, malware2, malicious, high confidence, Unsafe, Save, Static AI, Malicious PE, Sabsik, score, ZexaF, @xX@amVghKnO, BScope, Kryptik, CLASSIC, Azorult, susgen) | ||
| md5 | 9d56e1cd866bb657e457e382e0e06682 | ||
| sha256 | a88a186c64f41be1987aeba3715c7e1d3cd7f55b955e8c17def04e2ec70c2e7f | ||
| ssdeep | 98304:7unbAsn5gfvLFHO4H7QWbqEXJy+QqXRYitMWxYiSKo61jyBcxkgtr:7ubAEgbfbQWbqMJyZr2Rl18cx3 | ||
| imphash | 69566d56ce8187d49438dd02ea591694 | ||
| impfuzzy | 48:wuOD0weX13BUdPBugIFopZaE8fcTYhS+tSbLXtT:EMX1REP0gOqAE8fcTYhS+kbLXZ | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 17 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_DarkSide_Ransomware_1_Zero | Darkside Ransomware | binaries (upload) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 EnumResourceNamesW
0x41e004 DosDateTimeToFileTime
0x41e008 FindFirstChangeNotificationW
0x41e00c CopyFileExW
0x41e010 SetLocalTime
0x41e014 GetCPInfo
0x41e018 GetConsoleAliasExesLengthA
0x41e01c HeapAlloc
0x41e020 InterlockedIncrement
0x41e024 ReadConsoleA
0x41e028 InterlockedDecrement
0x41e02c GetSystemWindowsDirectoryW
0x41e030 CreateDirectoryW
0x41e034 GetProfileSectionA
0x41e038 FreeEnvironmentStringsA
0x41e03c GetModuleHandleW
0x41e040 GetTickCount
0x41e044 GetCurrentThread
0x41e048 GetPrivateProfileStringW
0x41e04c SetCommState
0x41e050 GetCommandLineA
0x41e054 SetProcessPriorityBoost
0x41e058 TlsSetValue
0x41e05c ActivateActCtx
0x41e060 GlobalAlloc
0x41e064 GetVolumeInformationA
0x41e068 LoadLibraryW
0x41e06c IsProcessorFeaturePresent
0x41e070 TerminateProcess
0x41e074 GetCompressedFileSizeA
0x41e078 lstrlenW
0x41e07c SetThreadPriority
0x41e080 GetNamedPipeHandleStateW
0x41e084 LCMapStringA
0x41e088 GetPrivateProfileIntW
0x41e08c InterlockedExchange
0x41e090 SetCurrentDirectoryA
0x41e094 GetStartupInfoA
0x41e098 GetStdHandle
0x41e09c GetLastError
0x41e0a0 GetThreadLocale
0x41e0a4 ReadConsoleOutputCharacterA
0x41e0a8 GetProcAddress
0x41e0ac CreateMemoryResourceNotification
0x41e0b0 DisableThreadLibraryCalls
0x41e0b4 Process32FirstW
0x41e0b8 WritePrivateProfileStringA
0x41e0bc HeapWalk
0x41e0c0 FindAtomA
0x41e0c4 SetEnvironmentVariableA
0x41e0c8 FindNextFileA
0x41e0cc GetThreadPriority
0x41e0d0 EnumResourceNamesA
0x41e0d4 GetStringTypeW
0x41e0d8 WriteProfileStringW
0x41e0dc CompareStringA
0x41e0e0 GetCPInfoExA
0x41e0e4 GetVersionExA
0x41e0e8 CopyFileExA
0x41e0ec FlushFileBuffers
0x41e0f0 CloseHandle
0x41e0f4 MultiByteToWideChar
0x41e0f8 HeapValidate
0x41e0fc IsBadReadPtr
0x41e100 RaiseException
0x41e104 DeleteCriticalSection
0x41e108 EnterCriticalSection
0x41e10c LeaveCriticalSection
0x41e110 GetModuleFileNameW
0x41e114 GetACP
0x41e118 GetOEMCP
0x41e11c IsValidCodePage
0x41e120 TlsGetValue
0x41e124 TlsAlloc
0x41e128 GetCurrentThreadId
0x41e12c TlsFree
0x41e130 SetLastError
0x41e134 SetUnhandledExceptionFilter
0x41e138 QueryPerformanceCounter
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 Sleep
0x41e148 ExitProcess
0x41e14c GetModuleFileNameA
0x41e150 GetEnvironmentStrings
0x41e154 FreeEnvironmentStringsW
0x41e158 WideCharToMultiByte
0x41e15c GetEnvironmentStringsW
0x41e160 SetHandleCount
0x41e164 GetFileType
0x41e168 HeapDestroy
0x41e16c HeapCreate
0x41e170 HeapFree
0x41e174 VirtualFree
0x41e178 WriteFile
0x41e17c GetCurrentProcess
0x41e180 UnhandledExceptionFilter
0x41e184 IsDebuggerPresent
0x41e188 HeapSize
0x41e18c HeapReAlloc
0x41e190 VirtualAlloc
0x41e194 RtlUnwind
0x41e198 InitializeCriticalSectionAndSpinCount
0x41e19c DebugBreak
0x41e1a0 OutputDebugStringA
0x41e1a4 WriteConsoleW
0x41e1a8 OutputDebugStringW
0x41e1ac LCMapStringW
0x41e1b0 GetStringTypeA
0x41e1b4 GetLocaleInfoA
0x41e1b8 LoadLibraryA
0x41e1bc SetFilePointer
0x41e1c0 GetConsoleCP
0x41e1c4 GetConsoleMode
0x41e1c8 SetStdHandle
0x41e1cc WriteConsoleA
0x41e1d0 GetConsoleOutputCP
0x41e1d4 CreateFileA
USER32.dll
0x41e1dc GetMessageTime
WINHTTP.dll
0x41e1e4 WinHttpCloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 EnumResourceNamesW
0x41e004 DosDateTimeToFileTime
0x41e008 FindFirstChangeNotificationW
0x41e00c CopyFileExW
0x41e010 SetLocalTime
0x41e014 GetCPInfo
0x41e018 GetConsoleAliasExesLengthA
0x41e01c HeapAlloc
0x41e020 InterlockedIncrement
0x41e024 ReadConsoleA
0x41e028 InterlockedDecrement
0x41e02c GetSystemWindowsDirectoryW
0x41e030 CreateDirectoryW
0x41e034 GetProfileSectionA
0x41e038 FreeEnvironmentStringsA
0x41e03c GetModuleHandleW
0x41e040 GetTickCount
0x41e044 GetCurrentThread
0x41e048 GetPrivateProfileStringW
0x41e04c SetCommState
0x41e050 GetCommandLineA
0x41e054 SetProcessPriorityBoost
0x41e058 TlsSetValue
0x41e05c ActivateActCtx
0x41e060 GlobalAlloc
0x41e064 GetVolumeInformationA
0x41e068 LoadLibraryW
0x41e06c IsProcessorFeaturePresent
0x41e070 TerminateProcess
0x41e074 GetCompressedFileSizeA
0x41e078 lstrlenW
0x41e07c SetThreadPriority
0x41e080 GetNamedPipeHandleStateW
0x41e084 LCMapStringA
0x41e088 GetPrivateProfileIntW
0x41e08c InterlockedExchange
0x41e090 SetCurrentDirectoryA
0x41e094 GetStartupInfoA
0x41e098 GetStdHandle
0x41e09c GetLastError
0x41e0a0 GetThreadLocale
0x41e0a4 ReadConsoleOutputCharacterA
0x41e0a8 GetProcAddress
0x41e0ac CreateMemoryResourceNotification
0x41e0b0 DisableThreadLibraryCalls
0x41e0b4 Process32FirstW
0x41e0b8 WritePrivateProfileStringA
0x41e0bc HeapWalk
0x41e0c0 FindAtomA
0x41e0c4 SetEnvironmentVariableA
0x41e0c8 FindNextFileA
0x41e0cc GetThreadPriority
0x41e0d0 EnumResourceNamesA
0x41e0d4 GetStringTypeW
0x41e0d8 WriteProfileStringW
0x41e0dc CompareStringA
0x41e0e0 GetCPInfoExA
0x41e0e4 GetVersionExA
0x41e0e8 CopyFileExA
0x41e0ec FlushFileBuffers
0x41e0f0 CloseHandle
0x41e0f4 MultiByteToWideChar
0x41e0f8 HeapValidate
0x41e0fc IsBadReadPtr
0x41e100 RaiseException
0x41e104 DeleteCriticalSection
0x41e108 EnterCriticalSection
0x41e10c LeaveCriticalSection
0x41e110 GetModuleFileNameW
0x41e114 GetACP
0x41e118 GetOEMCP
0x41e11c IsValidCodePage
0x41e120 TlsGetValue
0x41e124 TlsAlloc
0x41e128 GetCurrentThreadId
0x41e12c TlsFree
0x41e130 SetLastError
0x41e134 SetUnhandledExceptionFilter
0x41e138 QueryPerformanceCounter
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 Sleep
0x41e148 ExitProcess
0x41e14c GetModuleFileNameA
0x41e150 GetEnvironmentStrings
0x41e154 FreeEnvironmentStringsW
0x41e158 WideCharToMultiByte
0x41e15c GetEnvironmentStringsW
0x41e160 SetHandleCount
0x41e164 GetFileType
0x41e168 HeapDestroy
0x41e16c HeapCreate
0x41e170 HeapFree
0x41e174 VirtualFree
0x41e178 WriteFile
0x41e17c GetCurrentProcess
0x41e180 UnhandledExceptionFilter
0x41e184 IsDebuggerPresent
0x41e188 HeapSize
0x41e18c HeapReAlloc
0x41e190 VirtualAlloc
0x41e194 RtlUnwind
0x41e198 InitializeCriticalSectionAndSpinCount
0x41e19c DebugBreak
0x41e1a0 OutputDebugStringA
0x41e1a4 WriteConsoleW
0x41e1a8 OutputDebugStringW
0x41e1ac LCMapStringW
0x41e1b0 GetStringTypeA
0x41e1b4 GetLocaleInfoA
0x41e1b8 LoadLibraryA
0x41e1bc SetFilePointer
0x41e1c0 GetConsoleCP
0x41e1c4 GetConsoleMode
0x41e1c8 SetStdHandle
0x41e1cc WriteConsoleA
0x41e1d0 GetConsoleOutputCP
0x41e1d4 CreateFileA
USER32.dll
0x41e1dc GetMessageTime
WINHTTP.dll
0x41e1e4 WinHttpCloseHandle
EAT(Export Address Table) is none