ScreenShot
| Created | 2021.09.22 10:26 | Machine | s1_win7_x6401 |
| Filename | flfile.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 40 detected (AIDetect, malware1, malicious, high confidence, GenericKD, Stop, Unsafe, Save, confidence, 100%, Kryptik, Eldorado, HMLB, Mdeclass, Chapak, MalwareX, Siggen3, Static AI, Malicious PE, ai score=89, Raccoon, score, CoinMiner, Glupteba, R441249, ZexaF, VuW@aCcF4DlO, BScope, Azorult, CLASSIC, susgen, GenKryptik, HMKY, Genetic) | ||
| md5 | 0ce36f818bd21747d974bd4e01a5d941 | ||
| sha256 | d899fbe8a5312cafff5ab7ef99d9528be0656c1590e1d3eb2c97905a46c480d1 | ||
| ssdeep | 12288:lAcPcwIhasCcUkkAFWBWtJzGbZrHYu0b7PXmX/ClhHuuF3cRbUm:lZjI4V5RBWjzGNrHQPXmqd | ||
| imphash | 8447a74d20f094dcabf63f6ce92f5cf9 | ||
| impfuzzy | 48:COuPK4jwX1bBqdPMEeoITfWaEaftgES+6Hm40oEi:NuiNX1tmPBeogfzEaftgES+F40M | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 40 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 FileTimeToDosDateTime
0x41f004 GetNativeSystemInfo
0x41f008 CopyFileExW
0x41f00c TlsGetValue
0x41f010 SetLocalTime
0x41f014 HeapAlloc
0x41f018 SetDllDirectoryW
0x41f01c InterlockedIncrement
0x41f020 GetCommState
0x41f024 ReadConsoleA
0x41f028 InterlockedDecrement
0x41f02c GlobalSize
0x41f030 GetSystemWindowsDirectoryW
0x41f034 GlobalLock
0x41f038 GetProfileSectionA
0x41f03c CancelWaitableTimer
0x41f040 GetModuleHandleW
0x41f044 GetTickCount
0x41f048 GetPrivateProfileStringW
0x41f04c GetCommandLineA
0x41f050 ActivateActCtx
0x41f054 GlobalAlloc
0x41f058 LoadLibraryW
0x41f05c TerminateThread
0x41f060 GetConsoleAliasExesLengthW
0x41f064 GetCompressedFileSizeA
0x41f068 GetSystemDirectoryA
0x41f06c CompareStringW
0x41f070 lstrlenW
0x41f074 SetThreadPriority
0x41f078 WritePrivateProfileStringW
0x41f07c DeactivateActCtx
0x41f080 GetNamedPipeHandleStateW
0x41f084 LCMapStringA
0x41f088 GetPrivateProfileIntW
0x41f08c VerifyVersionInfoW
0x41f090 CreateDirectoryA
0x41f094 InterlockedExchange
0x41f098 SetCurrentDirectoryA
0x41f09c GetStartupInfoA
0x41f0a0 GetLastError
0x41f0a4 GetThreadLocale
0x41f0a8 ReadConsoleOutputCharacterA
0x41f0ac GetProcAddress
0x41f0b0 GetProcessHeaps
0x41f0b4 SetStdHandle
0x41f0b8 EnterCriticalSection
0x41f0bc DisableThreadLibraryCalls
0x41f0c0 Process32FirstW
0x41f0c4 SetSystemTime
0x41f0c8 SetEnvironmentVariableA
0x41f0cc GetOEMCP
0x41f0d0 FindNextFileA
0x41f0d4 WriteProfileStringA
0x41f0d8 FindFirstChangeNotificationA
0x41f0dc QueryMemoryResourceNotification
0x41f0e0 FreeEnvironmentStringsW
0x41f0e4 EnumResourceNamesA
0x41f0e8 GetStringTypeW
0x41f0ec WriteProfileStringW
0x41f0f0 GetCurrentThreadId
0x41f0f4 GetCPInfoExA
0x41f0f8 FindAtomW
0x41f0fc UnregisterWaitEx
0x41f100 TlsFree
0x41f104 GetVolumeInformationW
0x41f108 CreateFileA
0x41f10c GetConsoleOutputCP
0x41f110 MultiByteToWideChar
0x41f114 GetStartupInfoW
0x41f118 HeapValidate
0x41f11c IsBadReadPtr
0x41f120 RaiseException
0x41f124 LeaveCriticalSection
0x41f128 TerminateProcess
0x41f12c GetCurrentProcess
0x41f130 UnhandledExceptionFilter
0x41f134 SetUnhandledExceptionFilter
0x41f138 IsDebuggerPresent
0x41f13c GetModuleFileNameW
0x41f140 DeleteCriticalSection
0x41f144 GetACP
0x41f148 GetCPInfo
0x41f14c IsValidCodePage
0x41f150 TlsAlloc
0x41f154 TlsSetValue
0x41f158 SetLastError
0x41f15c QueryPerformanceCounter
0x41f160 GetCurrentProcessId
0x41f164 GetSystemTimeAsFileTime
0x41f168 Sleep
0x41f16c ExitProcess
0x41f170 GetEnvironmentStringsW
0x41f174 GetCommandLineW
0x41f178 SetHandleCount
0x41f17c GetStdHandle
0x41f180 GetFileType
0x41f184 HeapDestroy
0x41f188 HeapCreate
0x41f18c HeapFree
0x41f190 VirtualFree
0x41f194 GetModuleFileNameA
0x41f198 WriteFile
0x41f19c HeapSize
0x41f1a0 HeapReAlloc
0x41f1a4 VirtualAlloc
0x41f1a8 RtlUnwind
0x41f1ac WideCharToMultiByte
0x41f1b0 DebugBreak
0x41f1b4 OutputDebugStringA
0x41f1b8 WriteConsoleW
0x41f1bc OutputDebugStringW
0x41f1c0 InitializeCriticalSectionAndSpinCount
0x41f1c4 LCMapStringW
0x41f1c8 GetStringTypeA
0x41f1cc GetLocaleInfoA
0x41f1d0 LoadLibraryA
0x41f1d4 FlushFileBuffers
0x41f1d8 GetConsoleCP
0x41f1dc GetConsoleMode
0x41f1e0 SetFilePointer
0x41f1e4 CloseHandle
0x41f1e8 WriteConsoleA
USER32.dll
0x41f1f0 GetMenuItemID
WINHTTP.dll
0x41f1f8 WinHttpWriteData
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 FileTimeToDosDateTime
0x41f004 GetNativeSystemInfo
0x41f008 CopyFileExW
0x41f00c TlsGetValue
0x41f010 SetLocalTime
0x41f014 HeapAlloc
0x41f018 SetDllDirectoryW
0x41f01c InterlockedIncrement
0x41f020 GetCommState
0x41f024 ReadConsoleA
0x41f028 InterlockedDecrement
0x41f02c GlobalSize
0x41f030 GetSystemWindowsDirectoryW
0x41f034 GlobalLock
0x41f038 GetProfileSectionA
0x41f03c CancelWaitableTimer
0x41f040 GetModuleHandleW
0x41f044 GetTickCount
0x41f048 GetPrivateProfileStringW
0x41f04c GetCommandLineA
0x41f050 ActivateActCtx
0x41f054 GlobalAlloc
0x41f058 LoadLibraryW
0x41f05c TerminateThread
0x41f060 GetConsoleAliasExesLengthW
0x41f064 GetCompressedFileSizeA
0x41f068 GetSystemDirectoryA
0x41f06c CompareStringW
0x41f070 lstrlenW
0x41f074 SetThreadPriority
0x41f078 WritePrivateProfileStringW
0x41f07c DeactivateActCtx
0x41f080 GetNamedPipeHandleStateW
0x41f084 LCMapStringA
0x41f088 GetPrivateProfileIntW
0x41f08c VerifyVersionInfoW
0x41f090 CreateDirectoryA
0x41f094 InterlockedExchange
0x41f098 SetCurrentDirectoryA
0x41f09c GetStartupInfoA
0x41f0a0 GetLastError
0x41f0a4 GetThreadLocale
0x41f0a8 ReadConsoleOutputCharacterA
0x41f0ac GetProcAddress
0x41f0b0 GetProcessHeaps
0x41f0b4 SetStdHandle
0x41f0b8 EnterCriticalSection
0x41f0bc DisableThreadLibraryCalls
0x41f0c0 Process32FirstW
0x41f0c4 SetSystemTime
0x41f0c8 SetEnvironmentVariableA
0x41f0cc GetOEMCP
0x41f0d0 FindNextFileA
0x41f0d4 WriteProfileStringA
0x41f0d8 FindFirstChangeNotificationA
0x41f0dc QueryMemoryResourceNotification
0x41f0e0 FreeEnvironmentStringsW
0x41f0e4 EnumResourceNamesA
0x41f0e8 GetStringTypeW
0x41f0ec WriteProfileStringW
0x41f0f0 GetCurrentThreadId
0x41f0f4 GetCPInfoExA
0x41f0f8 FindAtomW
0x41f0fc UnregisterWaitEx
0x41f100 TlsFree
0x41f104 GetVolumeInformationW
0x41f108 CreateFileA
0x41f10c GetConsoleOutputCP
0x41f110 MultiByteToWideChar
0x41f114 GetStartupInfoW
0x41f118 HeapValidate
0x41f11c IsBadReadPtr
0x41f120 RaiseException
0x41f124 LeaveCriticalSection
0x41f128 TerminateProcess
0x41f12c GetCurrentProcess
0x41f130 UnhandledExceptionFilter
0x41f134 SetUnhandledExceptionFilter
0x41f138 IsDebuggerPresent
0x41f13c GetModuleFileNameW
0x41f140 DeleteCriticalSection
0x41f144 GetACP
0x41f148 GetCPInfo
0x41f14c IsValidCodePage
0x41f150 TlsAlloc
0x41f154 TlsSetValue
0x41f158 SetLastError
0x41f15c QueryPerformanceCounter
0x41f160 GetCurrentProcessId
0x41f164 GetSystemTimeAsFileTime
0x41f168 Sleep
0x41f16c ExitProcess
0x41f170 GetEnvironmentStringsW
0x41f174 GetCommandLineW
0x41f178 SetHandleCount
0x41f17c GetStdHandle
0x41f180 GetFileType
0x41f184 HeapDestroy
0x41f188 HeapCreate
0x41f18c HeapFree
0x41f190 VirtualFree
0x41f194 GetModuleFileNameA
0x41f198 WriteFile
0x41f19c HeapSize
0x41f1a0 HeapReAlloc
0x41f1a4 VirtualAlloc
0x41f1a8 RtlUnwind
0x41f1ac WideCharToMultiByte
0x41f1b0 DebugBreak
0x41f1b4 OutputDebugStringA
0x41f1b8 WriteConsoleW
0x41f1bc OutputDebugStringW
0x41f1c0 InitializeCriticalSectionAndSpinCount
0x41f1c4 LCMapStringW
0x41f1c8 GetStringTypeA
0x41f1cc GetLocaleInfoA
0x41f1d0 LoadLibraryA
0x41f1d4 FlushFileBuffers
0x41f1d8 GetConsoleCP
0x41f1dc GetConsoleMode
0x41f1e0 SetFilePointer
0x41f1e4 CloseHandle
0x41f1e8 WriteConsoleA
USER32.dll
0x41f1f0 GetMenuItemID
WINHTTP.dll
0x41f1f8 WinHttpWriteData
EAT(Export Address Table) is none