ScreenShot
| Created | 2021.09.24 09:21 | Machine | s1_win7_x6402 |
| Filename | file.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 25 detected (AIDetect, malware1, malicious, high confidence, Save, Hacktool, confidence, 100%, ZexaF, oq0@ayfj6wjO, Kryptik, Eldorado, Attribute, HighConfidence, GenKryptik, FLCE, Emotet, Static AI, Malicious PE, Wacatac, score, BScope, Androm, Unsafe, Genetic) | ||
| md5 | c8aa942d50814189f92ca4a01620b4ed | ||
| sha256 | eb9aba41f979b8da5bd42d7e7d248daaa23014db0ad5593bbf4967327cd651ae | ||
| ssdeep | 3072:t6nvzh7T3Oj1tXS80EBuxgztanuqgdbENxHBnmgQLgk52Bb7CRG8e:t6vzh7Tejf74uCqbWH4eB6R | ||
| imphash | 5fbfc74c3ddccb96d094c58debd98462 | ||
| impfuzzy | 24:3crjrZtMc6DYRROsaElcOG3rANOovQdYA+yv9tyFQh/J3vT42luZwjMwnNp1tsn:kZq4OWDarZnNH9trvc2sGnhts | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 25 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42e014 EndUpdateResourceW
0x42e018 InterlockedDecrement
0x42e01c GetCurrentProcess
0x42e020 GetEnvironmentStringsW
0x42e024 WaitForSingleObject
0x42e028 SetEvent
0x42e02c GetSystemDefaultLCID
0x42e030 GetWindowsDirectoryA
0x42e034 GlobalAlloc
0x42e038 GetLocaleInfoW
0x42e03c SizeofResource
0x42e040 LeaveCriticalSection
0x42e044 WriteConsoleW
0x42e048 ReadFile
0x42e04c GetProcAddress
0x42e050 EnterCriticalSection
0x42e054 VerLanguageNameW
0x42e058 GlobalGetAtomNameA
0x42e05c PrepareTape
0x42e060 RemoveDirectoryW
0x42e064 BeginUpdateResourceA
0x42e068 EnumResourceTypesW
0x42e06c GetModuleFileNameA
0x42e070 GetModuleHandleA
0x42e074 ReleaseMutex
0x42e078 LocalSize
0x42e07c FindFirstVolumeW
0x42e080 AddConsoleAliasA
0x42e084 FindActCtxSectionStringW
0x42e088 FindNextVolumeA
0x42e08c GetSystemTime
0x42e090 lstrcpyW
0x42e094 GetLocaleInfoA
0x42e098 GetCommandLineW
0x42e09c GetConsoleOutputCP
0x42e0a0 GetSystemDefaultLangID
0x42e0a4 HeapAlloc
0x42e0a8 GetLastError
0x42e0ac HeapReAlloc
0x42e0b0 GetCommandLineA
0x42e0b4 GetStartupInfoA
0x42e0b8 DeleteCriticalSection
0x42e0bc HeapFree
0x42e0c0 VirtualFree
0x42e0c4 VirtualAlloc
0x42e0c8 HeapCreate
0x42e0cc GetModuleHandleW
0x42e0d0 Sleep
0x42e0d4 ExitProcess
0x42e0d8 WriteFile
0x42e0dc GetStdHandle
0x42e0e0 SetHandleCount
0x42e0e4 GetFileType
0x42e0e8 SetFilePointer
0x42e0ec TerminateProcess
0x42e0f0 UnhandledExceptionFilter
0x42e0f4 SetUnhandledExceptionFilter
0x42e0f8 IsDebuggerPresent
0x42e0fc FreeEnvironmentStringsA
0x42e100 GetEnvironmentStrings
0x42e104 FreeEnvironmentStringsW
0x42e108 WideCharToMultiByte
0x42e10c TlsGetValue
0x42e110 TlsAlloc
0x42e114 TlsSetValue
0x42e118 TlsFree
0x42e11c InterlockedIncrement
0x42e120 SetLastError
0x42e124 GetCurrentThreadId
0x42e128 QueryPerformanceCounter
0x42e12c GetTickCount
0x42e130 GetCurrentProcessId
0x42e134 GetSystemTimeAsFileTime
0x42e138 InitializeCriticalSectionAndSpinCount
0x42e13c RtlUnwind
0x42e140 LoadLibraryA
0x42e144 SetStdHandle
0x42e148 GetConsoleCP
0x42e14c GetConsoleMode
0x42e150 FlushFileBuffers
0x42e154 GetCPInfo
0x42e158 GetACP
0x42e15c GetOEMCP
0x42e160 IsValidCodePage
0x42e164 HeapSize
0x42e168 WriteConsoleA
0x42e16c MultiByteToWideChar
0x42e170 LCMapStringA
0x42e174 LCMapStringW
0x42e178 GetStringTypeA
0x42e17c GetStringTypeW
0x42e180 CloseHandle
0x42e184 CreateFileA
USER32.dll
0x42e18c RealChildWindowFromPoint
GDI32.dll
0x42e00c GetCharWidthFloatW
ADVAPI32.dll
0x42e000 DeregisterEventSource
0x42e004 CloseEventLog
EAT(Export Address Table) is none
KERNEL32.dll
0x42e014 EndUpdateResourceW
0x42e018 InterlockedDecrement
0x42e01c GetCurrentProcess
0x42e020 GetEnvironmentStringsW
0x42e024 WaitForSingleObject
0x42e028 SetEvent
0x42e02c GetSystemDefaultLCID
0x42e030 GetWindowsDirectoryA
0x42e034 GlobalAlloc
0x42e038 GetLocaleInfoW
0x42e03c SizeofResource
0x42e040 LeaveCriticalSection
0x42e044 WriteConsoleW
0x42e048 ReadFile
0x42e04c GetProcAddress
0x42e050 EnterCriticalSection
0x42e054 VerLanguageNameW
0x42e058 GlobalGetAtomNameA
0x42e05c PrepareTape
0x42e060 RemoveDirectoryW
0x42e064 BeginUpdateResourceA
0x42e068 EnumResourceTypesW
0x42e06c GetModuleFileNameA
0x42e070 GetModuleHandleA
0x42e074 ReleaseMutex
0x42e078 LocalSize
0x42e07c FindFirstVolumeW
0x42e080 AddConsoleAliasA
0x42e084 FindActCtxSectionStringW
0x42e088 FindNextVolumeA
0x42e08c GetSystemTime
0x42e090 lstrcpyW
0x42e094 GetLocaleInfoA
0x42e098 GetCommandLineW
0x42e09c GetConsoleOutputCP
0x42e0a0 GetSystemDefaultLangID
0x42e0a4 HeapAlloc
0x42e0a8 GetLastError
0x42e0ac HeapReAlloc
0x42e0b0 GetCommandLineA
0x42e0b4 GetStartupInfoA
0x42e0b8 DeleteCriticalSection
0x42e0bc HeapFree
0x42e0c0 VirtualFree
0x42e0c4 VirtualAlloc
0x42e0c8 HeapCreate
0x42e0cc GetModuleHandleW
0x42e0d0 Sleep
0x42e0d4 ExitProcess
0x42e0d8 WriteFile
0x42e0dc GetStdHandle
0x42e0e0 SetHandleCount
0x42e0e4 GetFileType
0x42e0e8 SetFilePointer
0x42e0ec TerminateProcess
0x42e0f0 UnhandledExceptionFilter
0x42e0f4 SetUnhandledExceptionFilter
0x42e0f8 IsDebuggerPresent
0x42e0fc FreeEnvironmentStringsA
0x42e100 GetEnvironmentStrings
0x42e104 FreeEnvironmentStringsW
0x42e108 WideCharToMultiByte
0x42e10c TlsGetValue
0x42e110 TlsAlloc
0x42e114 TlsSetValue
0x42e118 TlsFree
0x42e11c InterlockedIncrement
0x42e120 SetLastError
0x42e124 GetCurrentThreadId
0x42e128 QueryPerformanceCounter
0x42e12c GetTickCount
0x42e130 GetCurrentProcessId
0x42e134 GetSystemTimeAsFileTime
0x42e138 InitializeCriticalSectionAndSpinCount
0x42e13c RtlUnwind
0x42e140 LoadLibraryA
0x42e144 SetStdHandle
0x42e148 GetConsoleCP
0x42e14c GetConsoleMode
0x42e150 FlushFileBuffers
0x42e154 GetCPInfo
0x42e158 GetACP
0x42e15c GetOEMCP
0x42e160 IsValidCodePage
0x42e164 HeapSize
0x42e168 WriteConsoleA
0x42e16c MultiByteToWideChar
0x42e170 LCMapStringA
0x42e174 LCMapStringW
0x42e178 GetStringTypeA
0x42e17c GetStringTypeW
0x42e180 CloseHandle
0x42e184 CreateFileA
USER32.dll
0x42e18c RealChildWindowFromPoint
GDI32.dll
0x42e00c GetCharWidthFloatW
ADVAPI32.dll
0x42e000 DeregisterEventSource
0x42e004 CloseEventLog
EAT(Export Address Table) is none