ScreenShot
| Created | 2021.09.28 14:05 | Machine | s1_win7_x6401 |
| Filename | raccon.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 27 detected (AIDetect, malware1, malicious, high confidence, Ulise, Stop, Unsafe, Save, confidence, 100%, ZexaF, HuW@aK1hFCjO, MultiPlug, Static AI, Malicious PE, ai score=83, StopCrypt, score, Generic@ML, RDML, z+fsfoMEPb8L5WF163iyoA) | ||
| md5 | 576a11fa707efc78fd342f28c6fadebf | ||
| sha256 | 39d4676e1909c1aa57643e300758a2b4af79f1cb621f81ed50f329ae9e4ee911 | ||
| ssdeep | 12288:dnD+nZfXV3TxTIHCzT+0JMbufGSRHiOviR:9EZfF5IHeT+AdeROqR | ||
| imphash | f43d32468f3d02d6bc45f98f703cafd2 | ||
| impfuzzy | 48:CORcxX02inFXsYBfjObztXHacyIK9Jc+lfk:NaxXNuFXsCfjQtX6cyIQJc+lfk | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 27 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41c008 CopyFileExW
0x41c00c TlsGetValue
0x41c010 InterlockedIncrement
0x41c014 GetCommState
0x41c018 GetProfileStringW
0x41c01c UnlockFile
0x41c020 CallNamedPipeW
0x41c024 FreeEnvironmentStringsA
0x41c028 GetNumberFormatA
0x41c02c FindResourceExA
0x41c030 GlobalAlloc
0x41c034 GetPrivateProfileIntA
0x41c038 GetConsoleAliasExesLengthW
0x41c03c HeapDestroy
0x41c040 CreateSemaphoreA
0x41c044 EnumResourceLanguagesA
0x41c048 GetModuleFileNameW
0x41c04c GetCompressedFileSizeA
0x41c050 GetSystemDirectoryA
0x41c054 CreateActCtxA
0x41c058 GetBinaryTypeW
0x41c05c lstrlenW
0x41c060 LCMapStringA
0x41c064 GetStartupInfoA
0x41c068 SetThreadLocale
0x41c06c GetStdHandle
0x41c070 GetThreadContext
0x41c074 FreeLibraryAndExitThread
0x41c078 GetLastError
0x41c07c GetProcAddress
0x41c080 CreateNamedPipeA
0x41c084 EnterCriticalSection
0x41c088 LoadLibraryA
0x41c08c OpenMutexA
0x41c090 WritePrivateProfileStringA
0x41c094 SetThreadIdealProcessor
0x41c098 FindAtomA
0x41c09c SetSystemTime
0x41c0a0 FindNextFileA
0x41c0a4 CreateIoCompletionPort
0x41c0a8 GetModuleHandleA
0x41c0ac FindFirstChangeNotificationA
0x41c0b0 HeapSetInformation
0x41c0b4 WriteProfileStringW
0x41c0b8 GetCurrentDirectoryA
0x41c0bc SetFileShortNameA
0x41c0c0 FindAtomW
0x41c0c4 UnregisterWaitEx
0x41c0c8 GetSystemTime
0x41c0cc DeleteFileA
0x41c0d0 GetVolumeInformationW
0x41c0d4 LocalFileTimeToFileTime
0x41c0d8 GetCPInfoExW
0x41c0dc GetCommandLineW
0x41c0e0 WideCharToMultiByte
0x41c0e4 EncodePointer
0x41c0e8 DecodePointer
0x41c0ec GetStartupInfoW
0x41c0f0 TerminateProcess
0x41c0f4 GetCurrentProcess
0x41c0f8 UnhandledExceptionFilter
0x41c0fc SetUnhandledExceptionFilter
0x41c100 IsDebuggerPresent
0x41c104 InterlockedDecrement
0x41c108 GetACP
0x41c10c GetOEMCP
0x41c110 GetCPInfo
0x41c114 IsValidCodePage
0x41c118 TlsAlloc
0x41c11c TlsSetValue
0x41c120 GetCurrentThreadId
0x41c124 TlsFree
0x41c128 GetModuleHandleW
0x41c12c SetLastError
0x41c130 HeapValidate
0x41c134 IsBadReadPtr
0x41c138 ExitProcess
0x41c13c LeaveCriticalSection
0x41c140 SetHandleCount
0x41c144 InitializeCriticalSectionAndSpinCount
0x41c148 GetFileType
0x41c14c DeleteCriticalSection
0x41c150 QueryPerformanceCounter
0x41c154 GetTickCount
0x41c158 GetCurrentProcessId
0x41c15c GetSystemTimeAsFileTime
0x41c160 FreeEnvironmentStringsW
0x41c164 GetEnvironmentStringsW
0x41c168 HeapCreate
0x41c16c WriteFile
0x41c170 IsProcessorFeaturePresent
0x41c174 OutputDebugStringA
0x41c178 WriteConsoleW
0x41c17c OutputDebugStringW
0x41c180 LoadLibraryW
0x41c184 RtlUnwind
0x41c188 LCMapStringW
0x41c18c MultiByteToWideChar
0x41c190 GetStringTypeW
0x41c194 SetFilePointer
0x41c198 GetConsoleCP
0x41c19c GetConsoleMode
0x41c1a0 HeapAlloc
0x41c1a4 GetModuleFileNameA
0x41c1a8 HeapReAlloc
0x41c1ac HeapSize
0x41c1b0 HeapQueryInformation
0x41c1b4 HeapFree
0x41c1b8 SetStdHandle
0x41c1bc FlushFileBuffers
0x41c1c0 RaiseException
0x41c1c4 CreateFileW
0x41c1c8 CloseHandle
GDI32.dll
0x41c000 GetCharWidthW
EAT(Export Address Table) is none
KERNEL32.dll
0x41c008 CopyFileExW
0x41c00c TlsGetValue
0x41c010 InterlockedIncrement
0x41c014 GetCommState
0x41c018 GetProfileStringW
0x41c01c UnlockFile
0x41c020 CallNamedPipeW
0x41c024 FreeEnvironmentStringsA
0x41c028 GetNumberFormatA
0x41c02c FindResourceExA
0x41c030 GlobalAlloc
0x41c034 GetPrivateProfileIntA
0x41c038 GetConsoleAliasExesLengthW
0x41c03c HeapDestroy
0x41c040 CreateSemaphoreA
0x41c044 EnumResourceLanguagesA
0x41c048 GetModuleFileNameW
0x41c04c GetCompressedFileSizeA
0x41c050 GetSystemDirectoryA
0x41c054 CreateActCtxA
0x41c058 GetBinaryTypeW
0x41c05c lstrlenW
0x41c060 LCMapStringA
0x41c064 GetStartupInfoA
0x41c068 SetThreadLocale
0x41c06c GetStdHandle
0x41c070 GetThreadContext
0x41c074 FreeLibraryAndExitThread
0x41c078 GetLastError
0x41c07c GetProcAddress
0x41c080 CreateNamedPipeA
0x41c084 EnterCriticalSection
0x41c088 LoadLibraryA
0x41c08c OpenMutexA
0x41c090 WritePrivateProfileStringA
0x41c094 SetThreadIdealProcessor
0x41c098 FindAtomA
0x41c09c SetSystemTime
0x41c0a0 FindNextFileA
0x41c0a4 CreateIoCompletionPort
0x41c0a8 GetModuleHandleA
0x41c0ac FindFirstChangeNotificationA
0x41c0b0 HeapSetInformation
0x41c0b4 WriteProfileStringW
0x41c0b8 GetCurrentDirectoryA
0x41c0bc SetFileShortNameA
0x41c0c0 FindAtomW
0x41c0c4 UnregisterWaitEx
0x41c0c8 GetSystemTime
0x41c0cc DeleteFileA
0x41c0d0 GetVolumeInformationW
0x41c0d4 LocalFileTimeToFileTime
0x41c0d8 GetCPInfoExW
0x41c0dc GetCommandLineW
0x41c0e0 WideCharToMultiByte
0x41c0e4 EncodePointer
0x41c0e8 DecodePointer
0x41c0ec GetStartupInfoW
0x41c0f0 TerminateProcess
0x41c0f4 GetCurrentProcess
0x41c0f8 UnhandledExceptionFilter
0x41c0fc SetUnhandledExceptionFilter
0x41c100 IsDebuggerPresent
0x41c104 InterlockedDecrement
0x41c108 GetACP
0x41c10c GetOEMCP
0x41c110 GetCPInfo
0x41c114 IsValidCodePage
0x41c118 TlsAlloc
0x41c11c TlsSetValue
0x41c120 GetCurrentThreadId
0x41c124 TlsFree
0x41c128 GetModuleHandleW
0x41c12c SetLastError
0x41c130 HeapValidate
0x41c134 IsBadReadPtr
0x41c138 ExitProcess
0x41c13c LeaveCriticalSection
0x41c140 SetHandleCount
0x41c144 InitializeCriticalSectionAndSpinCount
0x41c148 GetFileType
0x41c14c DeleteCriticalSection
0x41c150 QueryPerformanceCounter
0x41c154 GetTickCount
0x41c158 GetCurrentProcessId
0x41c15c GetSystemTimeAsFileTime
0x41c160 FreeEnvironmentStringsW
0x41c164 GetEnvironmentStringsW
0x41c168 HeapCreate
0x41c16c WriteFile
0x41c170 IsProcessorFeaturePresent
0x41c174 OutputDebugStringA
0x41c178 WriteConsoleW
0x41c17c OutputDebugStringW
0x41c180 LoadLibraryW
0x41c184 RtlUnwind
0x41c188 LCMapStringW
0x41c18c MultiByteToWideChar
0x41c190 GetStringTypeW
0x41c194 SetFilePointer
0x41c198 GetConsoleCP
0x41c19c GetConsoleMode
0x41c1a0 HeapAlloc
0x41c1a4 GetModuleFileNameA
0x41c1a8 HeapReAlloc
0x41c1ac HeapSize
0x41c1b0 HeapQueryInformation
0x41c1b4 HeapFree
0x41c1b8 SetStdHandle
0x41c1bc FlushFileBuffers
0x41c1c0 RaiseException
0x41c1c4 CreateFileW
0x41c1c8 CloseHandle
GDI32.dll
0x41c000 GetCharWidthW
EAT(Export Address Table) is none