ScreenShot
| Created | 2021.09.13 08:56 | Machine | s1_win7_x6402 |
| Filename | toolspab2.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 9ab045a10142aa46a2c6e3aa01f7b31b | ||
| sha256 | 9ca449b299e7c6d0729a3833d06194ca7ffd3298a41d4d9743f68fee18101b8d | ||
| ssdeep | 3072:QHYXeS1oGu/PNGW510oCQhIjP455twBOQsWvAoiRoVS:Uqo1gW514QMswhAoi+V | ||
| imphash | 65186050f9601ee4db4aa7e9ce7b7062 | ||
| impfuzzy | 24:sVZZZyVkFXDYeOklZ901bQOrOovLt/J3J2dYXpiyv6v8OTAjMc/l9pvRoS:WZZZcNRcZIfa0thcQpbIA/1B | ||
Network IP location
Signature (13cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects Avast Antivirus through the presence of a library |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | One or more potentially interesting buffers were extracted |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | This executable has a PDB path |
Rules (11cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41b014 InterlockedDecrement
0x41b018 GetCurrentProcess
0x41b01c GetSystemWindowsDirectoryW
0x41b020 GetUserDefaultLCID
0x41b024 GetSystemDefaultLCID
0x41b028 ReadConsoleW
0x41b02c GetEnvironmentStrings
0x41b030 GlobalAlloc
0x41b034 GetLocaleInfoW
0x41b038 LeaveCriticalSection
0x41b03c FindNextVolumeW
0x41b040 WriteConsoleW
0x41b044 GetModuleFileNameW
0x41b048 InterlockedIncrement
0x41b04c GetACP
0x41b050 GetConsoleOutputCP
0x41b054 VerifyVersionInfoW
0x41b058 GetProcAddress
0x41b05c EnterCriticalSection
0x41b060 PrepareTape
0x41b064 ResetEvent
0x41b068 GetAtomNameA
0x41b06c SetConsoleTitleW
0x41b070 GetModuleHandleA
0x41b074 Module32Next
0x41b078 GetCurrentProcessId
0x41b07c AddConsoleAliasA
0x41b080 FindActCtxSectionStringW
0x41b084 GetSystemTime
0x41b088 GetProfileSectionW
0x41b08c FindActCtxSectionGuid
0x41b090 GetLocaleInfoA
0x41b094 GetCommandLineW
0x41b098 HeapAlloc
0x41b09c GetCommandLineA
0x41b0a0 GetStartupInfoA
0x41b0a4 TerminateProcess
0x41b0a8 UnhandledExceptionFilter
0x41b0ac SetUnhandledExceptionFilter
0x41b0b0 IsDebuggerPresent
0x41b0b4 GetModuleHandleW
0x41b0b8 TlsGetValue
0x41b0bc TlsAlloc
0x41b0c0 TlsSetValue
0x41b0c4 TlsFree
0x41b0c8 SetLastError
0x41b0cc GetCurrentThreadId
0x41b0d0 GetLastError
0x41b0d4 DeleteCriticalSection
0x41b0d8 HeapFree
0x41b0dc VirtualFree
0x41b0e0 VirtualAlloc
0x41b0e4 HeapReAlloc
0x41b0e8 HeapCreate
0x41b0ec Sleep
0x41b0f0 ExitProcess
0x41b0f4 WriteFile
0x41b0f8 GetStdHandle
0x41b0fc GetModuleFileNameA
0x41b100 HeapSize
0x41b104 RtlUnwind
0x41b108 SetHandleCount
0x41b10c GetFileType
0x41b110 SetFilePointer
0x41b114 CloseHandle
0x41b118 FreeEnvironmentStringsA
0x41b11c FreeEnvironmentStringsW
0x41b120 WideCharToMultiByte
0x41b124 GetEnvironmentStringsW
0x41b128 QueryPerformanceCounter
0x41b12c GetTickCount
0x41b130 GetSystemTimeAsFileTime
0x41b134 GetConsoleCP
0x41b138 GetConsoleMode
0x41b13c GetCPInfo
0x41b140 GetOEMCP
0x41b144 IsValidCodePage
0x41b148 RaiseException
0x41b14c InitializeCriticalSectionAndSpinCount
0x41b150 LoadLibraryA
0x41b154 CreateFileA
0x41b158 SetStdHandle
0x41b15c FlushFileBuffers
0x41b160 WriteConsoleA
0x41b164 MultiByteToWideChar
0x41b168 LCMapStringA
0x41b16c LCMapStringW
0x41b170 GetStringTypeA
0x41b174 GetStringTypeW
0x41b178 SetEndOfFile
0x41b17c GetProcessHeap
0x41b180 ReadFile
GDI32.dll
0x41b00c GetCharWidthFloatA
ADVAPI32.dll
0x41b000 BackupEventLogA
0x41b004 BackupEventLogW
EAT(Export Address Table) Library
0x401000 @GetAnotherVice@12
KERNEL32.dll
0x41b014 InterlockedDecrement
0x41b018 GetCurrentProcess
0x41b01c GetSystemWindowsDirectoryW
0x41b020 GetUserDefaultLCID
0x41b024 GetSystemDefaultLCID
0x41b028 ReadConsoleW
0x41b02c GetEnvironmentStrings
0x41b030 GlobalAlloc
0x41b034 GetLocaleInfoW
0x41b038 LeaveCriticalSection
0x41b03c FindNextVolumeW
0x41b040 WriteConsoleW
0x41b044 GetModuleFileNameW
0x41b048 InterlockedIncrement
0x41b04c GetACP
0x41b050 GetConsoleOutputCP
0x41b054 VerifyVersionInfoW
0x41b058 GetProcAddress
0x41b05c EnterCriticalSection
0x41b060 PrepareTape
0x41b064 ResetEvent
0x41b068 GetAtomNameA
0x41b06c SetConsoleTitleW
0x41b070 GetModuleHandleA
0x41b074 Module32Next
0x41b078 GetCurrentProcessId
0x41b07c AddConsoleAliasA
0x41b080 FindActCtxSectionStringW
0x41b084 GetSystemTime
0x41b088 GetProfileSectionW
0x41b08c FindActCtxSectionGuid
0x41b090 GetLocaleInfoA
0x41b094 GetCommandLineW
0x41b098 HeapAlloc
0x41b09c GetCommandLineA
0x41b0a0 GetStartupInfoA
0x41b0a4 TerminateProcess
0x41b0a8 UnhandledExceptionFilter
0x41b0ac SetUnhandledExceptionFilter
0x41b0b0 IsDebuggerPresent
0x41b0b4 GetModuleHandleW
0x41b0b8 TlsGetValue
0x41b0bc TlsAlloc
0x41b0c0 TlsSetValue
0x41b0c4 TlsFree
0x41b0c8 SetLastError
0x41b0cc GetCurrentThreadId
0x41b0d0 GetLastError
0x41b0d4 DeleteCriticalSection
0x41b0d8 HeapFree
0x41b0dc VirtualFree
0x41b0e0 VirtualAlloc
0x41b0e4 HeapReAlloc
0x41b0e8 HeapCreate
0x41b0ec Sleep
0x41b0f0 ExitProcess
0x41b0f4 WriteFile
0x41b0f8 GetStdHandle
0x41b0fc GetModuleFileNameA
0x41b100 HeapSize
0x41b104 RtlUnwind
0x41b108 SetHandleCount
0x41b10c GetFileType
0x41b110 SetFilePointer
0x41b114 CloseHandle
0x41b118 FreeEnvironmentStringsA
0x41b11c FreeEnvironmentStringsW
0x41b120 WideCharToMultiByte
0x41b124 GetEnvironmentStringsW
0x41b128 QueryPerformanceCounter
0x41b12c GetTickCount
0x41b130 GetSystemTimeAsFileTime
0x41b134 GetConsoleCP
0x41b138 GetConsoleMode
0x41b13c GetCPInfo
0x41b140 GetOEMCP
0x41b144 IsValidCodePage
0x41b148 RaiseException
0x41b14c InitializeCriticalSectionAndSpinCount
0x41b150 LoadLibraryA
0x41b154 CreateFileA
0x41b158 SetStdHandle
0x41b15c FlushFileBuffers
0x41b160 WriteConsoleA
0x41b164 MultiByteToWideChar
0x41b168 LCMapStringA
0x41b16c LCMapStringW
0x41b170 GetStringTypeA
0x41b174 GetStringTypeW
0x41b178 SetEndOfFile
0x41b17c GetProcessHeap
0x41b180 ReadFile
GDI32.dll
0x41b00c GetCharWidthFloatA
ADVAPI32.dll
0x41b000 BackupEventLogA
0x41b004 BackupEventLogW
EAT(Export Address Table) Library
0x401000 @GetAnotherVice@12