ScreenShot
| Created | 2021.09.22 22:11 | Machine | s1_win7_x6402 |
| Filename | 952392868.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (AIDetect, malware1, malicious, high confidence, GenericKD, Stop, Unsafe, Save, Azorult, confidence, 100%, Kryptik, Eldorado, HMMX, PWSX, Siggen3, VBobfus, Outbreak, MalwareCrypter, tkcqo, ai score=83, StopCrypt, XGXYJ9, score, MalPE, R442026, Artemis, R06CH07IG21, CLASSIC, Static AI, Malicious PE, susgen, HMMS, ZexaF, PvW@aSe4yLdO, GdSda) | ||
| md5 | e7c0b56dd1a23c604dfef02fde250715 | ||
| sha256 | bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a | ||
| ssdeep | 24576:9uLJS4WdZRCVaK3qjJwIcjIjPwmro30z9jaj/W/GGR/M+oNsW87C7QH/VDOBh7:9uPKRiGJbcjuwMoEtGGlMBNFi1H/J0h | ||
| imphash | 3c935a80613bb38675ee523829e64ef7 | ||
| impfuzzy | 48:AOEGiOD06eEdLX/gVZFiSjyyaEZtqocJc+eSV4I:h5i0LX/gVjiSjiEZtqocJc+RV3 | ||
Network IP location
Signature (21cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| danger | Executed a process and injected code into it |
| watch | A process attempted to delay the analysis task. |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a windows hook that monitors keyboard input (keylogger) |
| watch | Installs an hook procedure to monitor for mouse events |
| watch | Looks for the Windows Idle Time to determine the uptime |
| watch | One or more of the buffers contains an embedded PE file |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Foreign language identified in PE resource |
| notice | One or more potentially interesting buffers were extracted |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | This executable has a PDB path |
Rules (11cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f008 GetNativeSystemInfo
0x41f00c FindFirstChangeNotificationW
0x41f010 CopyFileExW
0x41f014 TlsGetValue
0x41f018 GetStringTypeA
0x41f01c CallNamedPipeA
0x41f020 HeapAlloc
0x41f024 SetWaitableTimer
0x41f028 InterlockedIncrement
0x41f02c InterlockedDecrement
0x41f030 GetNamedPipeHandleStateA
0x41f034 GlobalLock
0x41f038 SetHandleInformation
0x41f03c GetProfileStringW
0x41f040 GetProfileSectionA
0x41f044 FreeEnvironmentStringsA
0x41f048 GetModuleHandleW
0x41f04c GetPrivateProfileStringW
0x41f050 ReadConsoleW
0x41f054 GetCompressedFileSizeW
0x41f058 SetCommState
0x41f05c GetCommandLineA
0x41f060 SetProcessPriorityBoost
0x41f064 GetVolumeInformationA
0x41f068 LoadLibraryW
0x41f06c TerminateThread
0x41f070 GetSystemWindowsDirectoryA
0x41f074 VerifyVersionInfoA
0x41f078 EnumResourceLanguagesA
0x41f07c IsDBCSLeadByte
0x41f080 GetSystemDirectoryA
0x41f084 DosDateTimeToFileTime
0x41f088 WritePrivateProfileStringW
0x41f08c DeactivateActCtx
0x41f090 LCMapStringA
0x41f094 GetPrivateProfileIntW
0x41f098 CreateDirectoryA
0x41f09c InterlockedExchange
0x41f0a0 GetStartupInfoA
0x41f0a4 SetThreadLocale
0x41f0a8 GetCPInfoExW
0x41f0ac GetLastError
0x41f0b0 GetProcAddress
0x41f0b4 SetStdHandle
0x41f0b8 EnterCriticalSection
0x41f0bc CreateMemoryResourceNotification
0x41f0c0 DisableThreadLibraryCalls
0x41f0c4 LoadLibraryA
0x41f0c8 LocalAlloc
0x41f0cc FindAtomA
0x41f0d0 GetOEMCP
0x41f0d4 Process32NextW
0x41f0d8 WriteProfileStringA
0x41f0dc GetThreadPriority
0x41f0e0 HeapSetInformation
0x41f0e4 FreeEnvironmentStringsW
0x41f0e8 FindNextFileW
0x41f0ec GetCurrentDirectoryA
0x41f0f0 GetCurrentThreadId
0x41f0f4 LocalSize
0x41f0f8 UnregisterWaitEx
0x41f0fc GetSystemTime
0x41f100 lstrlenW
0x41f104 GetThreadContext
0x41f108 HeapValidate
0x41f10c IsBadReadPtr
0x41f110 RaiseException
0x41f114 TerminateProcess
0x41f118 GetCurrentProcess
0x41f11c UnhandledExceptionFilter
0x41f120 SetUnhandledExceptionFilter
0x41f124 IsDebuggerPresent
0x41f128 GetModuleFileNameW
0x41f12c RtlUnwind
0x41f130 GetACP
0x41f134 GetCPInfo
0x41f138 IsValidCodePage
0x41f13c TlsAlloc
0x41f140 TlsSetValue
0x41f144 TlsFree
0x41f148 SetLastError
0x41f14c DeleteCriticalSection
0x41f150 LeaveCriticalSection
0x41f154 QueryPerformanceCounter
0x41f158 GetTickCount
0x41f15c GetCurrentProcessId
0x41f160 GetSystemTimeAsFileTime
0x41f164 Sleep
0x41f168 ExitProcess
0x41f16c GetModuleFileNameA
0x41f170 GetEnvironmentStrings
0x41f174 WideCharToMultiByte
0x41f178 GetEnvironmentStringsW
0x41f17c SetHandleCount
0x41f180 GetStdHandle
0x41f184 GetFileType
0x41f188 HeapDestroy
0x41f18c HeapCreate
0x41f190 HeapFree
0x41f194 VirtualFree
0x41f198 WriteFile
0x41f19c HeapSize
0x41f1a0 HeapReAlloc
0x41f1a4 VirtualAlloc
0x41f1a8 SetFilePointer
0x41f1ac GetConsoleCP
0x41f1b0 GetConsoleMode
0x41f1b4 DebugBreak
0x41f1b8 OutputDebugStringA
0x41f1bc WriteConsoleW
0x41f1c0 OutputDebugStringW
0x41f1c4 MultiByteToWideChar
0x41f1c8 GetStringTypeW
0x41f1cc GetLocaleInfoA
0x41f1d0 LCMapStringW
0x41f1d4 InitializeCriticalSectionAndSpinCount
0x41f1d8 WriteConsoleA
0x41f1dc GetConsoleOutputCP
0x41f1e0 CreateFileA
0x41f1e4 CloseHandle
0x41f1e8 FlushFileBuffers
ADVAPI32.dll
0x41f000 InitiateSystemShutdownA
WINHTTP.dll
0x41f1f0 WinHttpQueryOption
EAT(Export Address Table) is none
KERNEL32.dll
0x41f008 GetNativeSystemInfo
0x41f00c FindFirstChangeNotificationW
0x41f010 CopyFileExW
0x41f014 TlsGetValue
0x41f018 GetStringTypeA
0x41f01c CallNamedPipeA
0x41f020 HeapAlloc
0x41f024 SetWaitableTimer
0x41f028 InterlockedIncrement
0x41f02c InterlockedDecrement
0x41f030 GetNamedPipeHandleStateA
0x41f034 GlobalLock
0x41f038 SetHandleInformation
0x41f03c GetProfileStringW
0x41f040 GetProfileSectionA
0x41f044 FreeEnvironmentStringsA
0x41f048 GetModuleHandleW
0x41f04c GetPrivateProfileStringW
0x41f050 ReadConsoleW
0x41f054 GetCompressedFileSizeW
0x41f058 SetCommState
0x41f05c GetCommandLineA
0x41f060 SetProcessPriorityBoost
0x41f064 GetVolumeInformationA
0x41f068 LoadLibraryW
0x41f06c TerminateThread
0x41f070 GetSystemWindowsDirectoryA
0x41f074 VerifyVersionInfoA
0x41f078 EnumResourceLanguagesA
0x41f07c IsDBCSLeadByte
0x41f080 GetSystemDirectoryA
0x41f084 DosDateTimeToFileTime
0x41f088 WritePrivateProfileStringW
0x41f08c DeactivateActCtx
0x41f090 LCMapStringA
0x41f094 GetPrivateProfileIntW
0x41f098 CreateDirectoryA
0x41f09c InterlockedExchange
0x41f0a0 GetStartupInfoA
0x41f0a4 SetThreadLocale
0x41f0a8 GetCPInfoExW
0x41f0ac GetLastError
0x41f0b0 GetProcAddress
0x41f0b4 SetStdHandle
0x41f0b8 EnterCriticalSection
0x41f0bc CreateMemoryResourceNotification
0x41f0c0 DisableThreadLibraryCalls
0x41f0c4 LoadLibraryA
0x41f0c8 LocalAlloc
0x41f0cc FindAtomA
0x41f0d0 GetOEMCP
0x41f0d4 Process32NextW
0x41f0d8 WriteProfileStringA
0x41f0dc GetThreadPriority
0x41f0e0 HeapSetInformation
0x41f0e4 FreeEnvironmentStringsW
0x41f0e8 FindNextFileW
0x41f0ec GetCurrentDirectoryA
0x41f0f0 GetCurrentThreadId
0x41f0f4 LocalSize
0x41f0f8 UnregisterWaitEx
0x41f0fc GetSystemTime
0x41f100 lstrlenW
0x41f104 GetThreadContext
0x41f108 HeapValidate
0x41f10c IsBadReadPtr
0x41f110 RaiseException
0x41f114 TerminateProcess
0x41f118 GetCurrentProcess
0x41f11c UnhandledExceptionFilter
0x41f120 SetUnhandledExceptionFilter
0x41f124 IsDebuggerPresent
0x41f128 GetModuleFileNameW
0x41f12c RtlUnwind
0x41f130 GetACP
0x41f134 GetCPInfo
0x41f138 IsValidCodePage
0x41f13c TlsAlloc
0x41f140 TlsSetValue
0x41f144 TlsFree
0x41f148 SetLastError
0x41f14c DeleteCriticalSection
0x41f150 LeaveCriticalSection
0x41f154 QueryPerformanceCounter
0x41f158 GetTickCount
0x41f15c GetCurrentProcessId
0x41f160 GetSystemTimeAsFileTime
0x41f164 Sleep
0x41f168 ExitProcess
0x41f16c GetModuleFileNameA
0x41f170 GetEnvironmentStrings
0x41f174 WideCharToMultiByte
0x41f178 GetEnvironmentStringsW
0x41f17c SetHandleCount
0x41f180 GetStdHandle
0x41f184 GetFileType
0x41f188 HeapDestroy
0x41f18c HeapCreate
0x41f190 HeapFree
0x41f194 VirtualFree
0x41f198 WriteFile
0x41f19c HeapSize
0x41f1a0 HeapReAlloc
0x41f1a4 VirtualAlloc
0x41f1a8 SetFilePointer
0x41f1ac GetConsoleCP
0x41f1b0 GetConsoleMode
0x41f1b4 DebugBreak
0x41f1b8 OutputDebugStringA
0x41f1bc WriteConsoleW
0x41f1c0 OutputDebugStringW
0x41f1c4 MultiByteToWideChar
0x41f1c8 GetStringTypeW
0x41f1cc GetLocaleInfoA
0x41f1d0 LCMapStringW
0x41f1d4 InitializeCriticalSectionAndSpinCount
0x41f1d8 WriteConsoleA
0x41f1dc GetConsoleOutputCP
0x41f1e0 CreateFileA
0x41f1e4 CloseHandle
0x41f1e8 FlushFileBuffers
ADVAPI32.dll
0x41f000 InitiateSystemShutdownA
WINHTTP.dll
0x41f1f0 WinHttpQueryOption
EAT(Export Address Table) is none