ScreenShot
| Created | 2021.09.15 10:38 | Machine | s1_win7_x6401 |
| Filename | anydesk_resolver.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 2 detected (Malicious, HToolLazagne) | ||
| md5 | df701faf88644d68ec3e380f72f432be | ||
| sha256 | aecbf25226c2b78bec1f90d17e25c38b5ea2d72a5abd99d09a80f3708b14cb09 | ||
| ssdeep | 98304:pleMM4CnotnbtFSur2WtdSKqgXuaLBwDhk/U94OO2QaVGetbFObISsG4zTwNJNs:pleWVBAdqd2gXuQBuiYORx1ESsFz8NHs | ||
| imphash | a62ff465f3ead2e578f02d3a2d749b7b | ||
| impfuzzy | 24:daDaODu9Wu9T/2bjar9UM02tMS1hUJnc+pl3rOovbKlvUTfUTlONoEqMo6iMuEZm:akR9xtMS1hEc+ppaRNUT2ONfiQh0 | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| watch | Looks for the Windows Idle Time to determine the uptime |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Expresses interest in specific running processes |
| notice | File has been identified by 2 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (14cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| info | Is_DotNET_DLL | (no description) | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140023000 GetLastError
0x140023008 SetDllDirectoryW
0x140023010 GetModuleFileNameW
0x140023018 GetProcAddress
0x140023020 GetCommandLineW
0x140023028 GetEnvironmentVariableW
0x140023030 SetEnvironmentVariableW
0x140023038 ExpandEnvironmentStringsW
0x140023040 GetTempPathW
0x140023048 WaitForSingleObject
0x140023050 Sleep
0x140023058 GetExitCodeProcess
0x140023060 CreateProcessW
0x140023068 GetStartupInfoW
0x140023070 LoadLibraryExW
0x140023078 GetShortPathNameW
0x140023080 FormatMessageW
0x140023088 LoadLibraryA
0x140023090 MultiByteToWideChar
0x140023098 WideCharToMultiByte
0x1400230a0 SetEndOfFile
0x1400230a8 HeapReAlloc
0x1400230b0 RtlCaptureContext
0x1400230b8 RtlLookupFunctionEntry
0x1400230c0 RtlVirtualUnwind
0x1400230c8 UnhandledExceptionFilter
0x1400230d0 SetUnhandledExceptionFilter
0x1400230d8 GetCurrentProcess
0x1400230e0 TerminateProcess
0x1400230e8 IsProcessorFeaturePresent
0x1400230f0 QueryPerformanceCounter
0x1400230f8 GetCurrentProcessId
0x140023100 GetCurrentThreadId
0x140023108 GetSystemTimeAsFileTime
0x140023110 InitializeSListHead
0x140023118 IsDebuggerPresent
0x140023120 GetModuleHandleW
0x140023128 RtlUnwindEx
0x140023130 SetLastError
0x140023138 EnterCriticalSection
0x140023140 LeaveCriticalSection
0x140023148 DeleteCriticalSection
0x140023150 InitializeCriticalSectionAndSpinCount
0x140023158 TlsAlloc
0x140023160 TlsGetValue
0x140023168 TlsSetValue
0x140023170 TlsFree
0x140023178 FreeLibrary
0x140023180 GetCommandLineA
0x140023188 ReadFile
0x140023190 CreateFileW
0x140023198 GetDriveTypeW
0x1400231a0 GetFileType
0x1400231a8 CloseHandle
0x1400231b0 PeekNamedPipe
0x1400231b8 SystemTimeToTzSpecificLocalTime
0x1400231c0 FileTimeToSystemTime
0x1400231c8 GetFullPathNameW
0x1400231d0 GetFullPathNameA
0x1400231d8 CreateDirectoryW
0x1400231e0 RemoveDirectoryW
0x1400231e8 FindClose
0x1400231f0 FindFirstFileExW
0x1400231f8 FindNextFileW
0x140023200 SetStdHandle
0x140023208 SetConsoleCtrlHandler
0x140023210 DeleteFileW
0x140023218 GetStdHandle
0x140023220 WriteFile
0x140023228 ExitProcess
0x140023230 GetModuleHandleExW
0x140023238 GetACP
0x140023240 HeapFree
0x140023248 HeapAlloc
0x140023250 GetConsoleMode
0x140023258 ReadConsoleW
0x140023260 SetFilePointerEx
0x140023268 GetConsoleCP
0x140023270 CompareStringW
0x140023278 LCMapStringW
0x140023280 GetCurrentDirectoryW
0x140023288 FlushFileBuffers
0x140023290 SetEnvironmentVariableA
0x140023298 GetFileAttributesExW
0x1400232a0 IsValidCodePage
0x1400232a8 GetOEMCP
0x1400232b0 GetCPInfo
0x1400232b8 GetEnvironmentStringsW
0x1400232c0 FreeEnvironmentStringsW
0x1400232c8 GetStringTypeW
0x1400232d0 GetProcessHeap
0x1400232d8 WriteConsoleW
0x1400232e0 GetTimeZoneInformation
0x1400232e8 HeapSize
0x1400232f0 RaiseException
WS2_32.dll
0x140023300 ntohl
EAT(Export Address Table) is none
KERNEL32.dll
0x140023000 GetLastError
0x140023008 SetDllDirectoryW
0x140023010 GetModuleFileNameW
0x140023018 GetProcAddress
0x140023020 GetCommandLineW
0x140023028 GetEnvironmentVariableW
0x140023030 SetEnvironmentVariableW
0x140023038 ExpandEnvironmentStringsW
0x140023040 GetTempPathW
0x140023048 WaitForSingleObject
0x140023050 Sleep
0x140023058 GetExitCodeProcess
0x140023060 CreateProcessW
0x140023068 GetStartupInfoW
0x140023070 LoadLibraryExW
0x140023078 GetShortPathNameW
0x140023080 FormatMessageW
0x140023088 LoadLibraryA
0x140023090 MultiByteToWideChar
0x140023098 WideCharToMultiByte
0x1400230a0 SetEndOfFile
0x1400230a8 HeapReAlloc
0x1400230b0 RtlCaptureContext
0x1400230b8 RtlLookupFunctionEntry
0x1400230c0 RtlVirtualUnwind
0x1400230c8 UnhandledExceptionFilter
0x1400230d0 SetUnhandledExceptionFilter
0x1400230d8 GetCurrentProcess
0x1400230e0 TerminateProcess
0x1400230e8 IsProcessorFeaturePresent
0x1400230f0 QueryPerformanceCounter
0x1400230f8 GetCurrentProcessId
0x140023100 GetCurrentThreadId
0x140023108 GetSystemTimeAsFileTime
0x140023110 InitializeSListHead
0x140023118 IsDebuggerPresent
0x140023120 GetModuleHandleW
0x140023128 RtlUnwindEx
0x140023130 SetLastError
0x140023138 EnterCriticalSection
0x140023140 LeaveCriticalSection
0x140023148 DeleteCriticalSection
0x140023150 InitializeCriticalSectionAndSpinCount
0x140023158 TlsAlloc
0x140023160 TlsGetValue
0x140023168 TlsSetValue
0x140023170 TlsFree
0x140023178 FreeLibrary
0x140023180 GetCommandLineA
0x140023188 ReadFile
0x140023190 CreateFileW
0x140023198 GetDriveTypeW
0x1400231a0 GetFileType
0x1400231a8 CloseHandle
0x1400231b0 PeekNamedPipe
0x1400231b8 SystemTimeToTzSpecificLocalTime
0x1400231c0 FileTimeToSystemTime
0x1400231c8 GetFullPathNameW
0x1400231d0 GetFullPathNameA
0x1400231d8 CreateDirectoryW
0x1400231e0 RemoveDirectoryW
0x1400231e8 FindClose
0x1400231f0 FindFirstFileExW
0x1400231f8 FindNextFileW
0x140023200 SetStdHandle
0x140023208 SetConsoleCtrlHandler
0x140023210 DeleteFileW
0x140023218 GetStdHandle
0x140023220 WriteFile
0x140023228 ExitProcess
0x140023230 GetModuleHandleExW
0x140023238 GetACP
0x140023240 HeapFree
0x140023248 HeapAlloc
0x140023250 GetConsoleMode
0x140023258 ReadConsoleW
0x140023260 SetFilePointerEx
0x140023268 GetConsoleCP
0x140023270 CompareStringW
0x140023278 LCMapStringW
0x140023280 GetCurrentDirectoryW
0x140023288 FlushFileBuffers
0x140023290 SetEnvironmentVariableA
0x140023298 GetFileAttributesExW
0x1400232a0 IsValidCodePage
0x1400232a8 GetOEMCP
0x1400232b0 GetCPInfo
0x1400232b8 GetEnvironmentStringsW
0x1400232c0 FreeEnvironmentStringsW
0x1400232c8 GetStringTypeW
0x1400232d0 GetProcessHeap
0x1400232d8 WriteConsoleW
0x1400232e0 GetTimeZoneInformation
0x1400232e8 HeapSize
0x1400232f0 RaiseException
WS2_32.dll
0x140023300 ntohl
EAT(Export Address Table) is none