ScreenShot
| Created | 2021.09.14 10:01 | Machine | s1_win7_x6402 |
| Filename | sefile3.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | 3258c73b3aec32a97022a3af6f602ad8 | ||
| sha256 | a272917d53b4c63c37138e5402636c32aa544df2b25d2787965b044c200814ee | ||
| ssdeep | 6144:sEMjEKfnG0NBLSSGdh6YNyu9GhI+iG0aDWc1hGcFBDi9Dh9oCBtR:cZO0NBLSp6YYu9GK+iGPv1ocLi9t+C | ||
| imphash | 36c786286bbc25d8ee5ac2239b6c4c04 | ||
| impfuzzy | 48:CiO9fKwX1btdP5CeI6IDSfQaEaftgOc+2m40IPEi:G9fNX1jPQeI6ASfpEaftgOc+t40IR | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 FileTimeToDosDateTime
0x41f008 GetNativeSystemInfo
0x41f00c TlsGetValue
0x41f010 GetStringTypeA
0x41f014 SetLocalTime
0x41f018 HeapAlloc
0x41f01c InterlockedIncrement
0x41f020 GetCommState
0x41f024 ReadConsoleA
0x41f028 GlobalSize
0x41f02c GetSystemWindowsDirectoryW
0x41f030 GlobalLock
0x41f034 SetHandleInformation
0x41f038 CancelWaitableTimer
0x41f03c GetModuleHandleW
0x41f040 ActivateActCtx
0x41f044 LoadLibraryW
0x41f048 TerminateThread
0x41f04c GetConsoleAliasExesLengthW
0x41f050 GetCompressedFileSizeA
0x41f054 GetSystemDirectoryA
0x41f058 CompareStringW
0x41f05c lstrlenW
0x41f060 SetThreadPriority
0x41f064 WritePrivateProfileStringW
0x41f068 DeactivateActCtx
0x41f06c GetNamedPipeHandleStateW
0x41f070 GetPrivateProfileIntW
0x41f074 VerifyVersionInfoW
0x41f078 CreateDirectoryA
0x41f07c InterlockedExchange
0x41f080 SetCurrentDirectoryA
0x41f084 GetStartupInfoA
0x41f088 GetCPInfoExW
0x41f08c GetLastError
0x41f090 GetThreadLocale
0x41f094 GetProcAddress
0x41f098 GetProcessHeaps
0x41f09c SetStdHandle
0x41f0a0 EnterCriticalSection
0x41f0a4 DisableThreadLibraryCalls
0x41f0a8 GetPrivateProfileStringA
0x41f0ac LoadLibraryA
0x41f0b0 LocalAlloc
0x41f0b4 SetSystemTime
0x41f0b8 SetEnvironmentVariableA
0x41f0bc GetOEMCP
0x41f0c0 Process32NextW
0x41f0c4 FindNextFileA
0x41f0c8 WriteProfileStringA
0x41f0cc FindFirstChangeNotificationA
0x41f0d0 QueryMemoryResourceNotification
0x41f0d4 FreeEnvironmentStringsW
0x41f0d8 EnumResourceNamesA
0x41f0dc WriteProfileStringW
0x41f0e0 GetCurrentDirectoryA
0x41f0e4 GetCurrentThreadId
0x41f0e8 GetCPInfoExA
0x41f0ec FindAtomW
0x41f0f0 UnregisterWaitEx
0x41f0f4 GetProfileSectionW
0x41f0f8 LCMapStringW
0x41f0fc CopyFileExA
0x41f100 GetVolumeInformationW
0x41f104 CreateFileA
0x41f108 GetConsoleOutputCP
0x41f10c MultiByteToWideChar
0x41f110 GetStartupInfoW
0x41f114 HeapValidate
0x41f118 IsBadReadPtr
0x41f11c RaiseException
0x41f120 LeaveCriticalSection
0x41f124 TerminateProcess
0x41f128 GetCurrentProcess
0x41f12c UnhandledExceptionFilter
0x41f130 SetUnhandledExceptionFilter
0x41f134 IsDebuggerPresent
0x41f138 GetModuleFileNameW
0x41f13c DeleteCriticalSection
0x41f140 InterlockedDecrement
0x41f144 GetACP
0x41f148 GetCPInfo
0x41f14c IsValidCodePage
0x41f150 TlsAlloc
0x41f154 TlsSetValue
0x41f158 TlsFree
0x41f15c SetLastError
0x41f160 QueryPerformanceCounter
0x41f164 GetTickCount
0x41f168 GetCurrentProcessId
0x41f16c GetSystemTimeAsFileTime
0x41f170 Sleep
0x41f174 ExitProcess
0x41f178 GetEnvironmentStringsW
0x41f17c SetHandleCount
0x41f180 GetStdHandle
0x41f184 GetFileType
0x41f188 HeapDestroy
0x41f18c HeapCreate
0x41f190 HeapFree
0x41f194 VirtualFree
0x41f198 GetModuleFileNameA
0x41f19c WriteFile
0x41f1a0 HeapSize
0x41f1a4 HeapReAlloc
0x41f1a8 VirtualAlloc
0x41f1ac RtlUnwind
0x41f1b0 WideCharToMultiByte
0x41f1b4 DebugBreak
0x41f1b8 OutputDebugStringA
0x41f1bc WriteConsoleW
0x41f1c0 OutputDebugStringW
0x41f1c4 InitializeCriticalSectionAndSpinCount
0x41f1c8 LCMapStringA
0x41f1cc GetStringTypeW
0x41f1d0 GetLocaleInfoA
0x41f1d4 FlushFileBuffers
0x41f1d8 GetConsoleCP
0x41f1dc GetConsoleMode
0x41f1e0 SetFilePointer
0x41f1e4 CloseHandle
0x41f1e8 WriteConsoleA
USER32.dll
0x41f1f0 GetMenuItemID
WINHTTP.dll
0x41f1f8 WinHttpWriteData
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 GetCommandLineW
0x41f004 FileTimeToDosDateTime
0x41f008 GetNativeSystemInfo
0x41f00c TlsGetValue
0x41f010 GetStringTypeA
0x41f014 SetLocalTime
0x41f018 HeapAlloc
0x41f01c InterlockedIncrement
0x41f020 GetCommState
0x41f024 ReadConsoleA
0x41f028 GlobalSize
0x41f02c GetSystemWindowsDirectoryW
0x41f030 GlobalLock
0x41f034 SetHandleInformation
0x41f038 CancelWaitableTimer
0x41f03c GetModuleHandleW
0x41f040 ActivateActCtx
0x41f044 LoadLibraryW
0x41f048 TerminateThread
0x41f04c GetConsoleAliasExesLengthW
0x41f050 GetCompressedFileSizeA
0x41f054 GetSystemDirectoryA
0x41f058 CompareStringW
0x41f05c lstrlenW
0x41f060 SetThreadPriority
0x41f064 WritePrivateProfileStringW
0x41f068 DeactivateActCtx
0x41f06c GetNamedPipeHandleStateW
0x41f070 GetPrivateProfileIntW
0x41f074 VerifyVersionInfoW
0x41f078 CreateDirectoryA
0x41f07c InterlockedExchange
0x41f080 SetCurrentDirectoryA
0x41f084 GetStartupInfoA
0x41f088 GetCPInfoExW
0x41f08c GetLastError
0x41f090 GetThreadLocale
0x41f094 GetProcAddress
0x41f098 GetProcessHeaps
0x41f09c SetStdHandle
0x41f0a0 EnterCriticalSection
0x41f0a4 DisableThreadLibraryCalls
0x41f0a8 GetPrivateProfileStringA
0x41f0ac LoadLibraryA
0x41f0b0 LocalAlloc
0x41f0b4 SetSystemTime
0x41f0b8 SetEnvironmentVariableA
0x41f0bc GetOEMCP
0x41f0c0 Process32NextW
0x41f0c4 FindNextFileA
0x41f0c8 WriteProfileStringA
0x41f0cc FindFirstChangeNotificationA
0x41f0d0 QueryMemoryResourceNotification
0x41f0d4 FreeEnvironmentStringsW
0x41f0d8 EnumResourceNamesA
0x41f0dc WriteProfileStringW
0x41f0e0 GetCurrentDirectoryA
0x41f0e4 GetCurrentThreadId
0x41f0e8 GetCPInfoExA
0x41f0ec FindAtomW
0x41f0f0 UnregisterWaitEx
0x41f0f4 GetProfileSectionW
0x41f0f8 LCMapStringW
0x41f0fc CopyFileExA
0x41f100 GetVolumeInformationW
0x41f104 CreateFileA
0x41f108 GetConsoleOutputCP
0x41f10c MultiByteToWideChar
0x41f110 GetStartupInfoW
0x41f114 HeapValidate
0x41f118 IsBadReadPtr
0x41f11c RaiseException
0x41f120 LeaveCriticalSection
0x41f124 TerminateProcess
0x41f128 GetCurrentProcess
0x41f12c UnhandledExceptionFilter
0x41f130 SetUnhandledExceptionFilter
0x41f134 IsDebuggerPresent
0x41f138 GetModuleFileNameW
0x41f13c DeleteCriticalSection
0x41f140 InterlockedDecrement
0x41f144 GetACP
0x41f148 GetCPInfo
0x41f14c IsValidCodePage
0x41f150 TlsAlloc
0x41f154 TlsSetValue
0x41f158 TlsFree
0x41f15c SetLastError
0x41f160 QueryPerformanceCounter
0x41f164 GetTickCount
0x41f168 GetCurrentProcessId
0x41f16c GetSystemTimeAsFileTime
0x41f170 Sleep
0x41f174 ExitProcess
0x41f178 GetEnvironmentStringsW
0x41f17c SetHandleCount
0x41f180 GetStdHandle
0x41f184 GetFileType
0x41f188 HeapDestroy
0x41f18c HeapCreate
0x41f190 HeapFree
0x41f194 VirtualFree
0x41f198 GetModuleFileNameA
0x41f19c WriteFile
0x41f1a0 HeapSize
0x41f1a4 HeapReAlloc
0x41f1a8 VirtualAlloc
0x41f1ac RtlUnwind
0x41f1b0 WideCharToMultiByte
0x41f1b4 DebugBreak
0x41f1b8 OutputDebugStringA
0x41f1bc WriteConsoleW
0x41f1c0 OutputDebugStringW
0x41f1c4 InitializeCriticalSectionAndSpinCount
0x41f1c8 LCMapStringA
0x41f1cc GetStringTypeW
0x41f1d0 GetLocaleInfoA
0x41f1d4 FlushFileBuffers
0x41f1d8 GetConsoleCP
0x41f1dc GetConsoleMode
0x41f1e0 SetFilePointer
0x41f1e4 CloseHandle
0x41f1e8 WriteConsoleA
USER32.dll
0x41f1f0 GetMenuItemID
WINHTTP.dll
0x41f1f8 WinHttpWriteData
EAT(Export Address Table) is none