ScreenShot
| Created | 2021.09.28 14:00 | Machine | s1_win7_x6402 |
| Filename | apines1.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 48 detected (AIDetect, malware1, malicious, high confidence, Unsafe, Save, Glupteba, Kryptik, Eldorado, Attribute, HighConfidence, HMPP, Injuke, PWSX, CLASSIC, 4DHQ2P, RedLineSteal, llojm, ai score=100, kcloud, StopCrypt, score, BeamWinHTTP, R442678, Azorult, Ehj6dlDDQ, Static AI, Malicious PE, HMPE, ZexaF, wu0@a0S0MKlO, GdSda, confidence, 100%) | ||
| md5 | 1ca5f33ffb87f631cf17e4fcd06eafc1 | ||
| sha256 | 922295fc8e35b0c40119f965ae4f9f00a4d585ec0fbccd14c34b4c1a3f012cd7 | ||
| ssdeep | 6144:52b7z0RjfglbbQLgqMLoujb4iz9coRdgQe1bIXAhkf:52b7ejfgl4LCLFj9gQe9IXEkf | ||
| imphash | 968069613992074265463fec272c56c9 | ||
| impfuzzy | 48:CkiOtQArXZwinFX3GYxjOqEaKxtmIK9JV87I1:7BrXZwuFX3GwjfKxtmIQJV87I1 | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 48 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41b000 GetCommandLineW
0x41b004 GetThreadContext
0x41b008 CopyFileExW
0x41b00c TlsGetValue
0x41b010 GetCommState
0x41b014 InterlockedDecrement
0x41b018 GetProfileStringW
0x41b01c UnlockFile
0x41b020 FreeEnvironmentStringsA
0x41b024 GetConsoleAliasesLengthA
0x41b028 GetNumberFormatA
0x41b02c FindResourceExA
0x41b030 GlobalAlloc
0x41b034 LoadLibraryW
0x41b038 GetConsoleAliasExesLengthW
0x41b03c HeapDestroy
0x41b040 CreateSemaphoreA
0x41b044 GetBinaryTypeA
0x41b048 GetModuleFileNameW
0x41b04c GetSystemDirectoryA
0x41b050 CreateActCtxA
0x41b054 lstrlenW
0x41b058 LCMapStringA
0x41b05c GetPrivateProfileIntW
0x41b060 GetStartupInfoA
0x41b064 SetThreadLocale
0x41b068 GetStdHandle
0x41b06c GetCPInfoExW
0x41b070 FreeLibraryAndExitThread
0x41b074 GetLastError
0x41b078 GetCurrentDirectoryW
0x41b07c GetProcAddress
0x41b080 CreateNamedPipeA
0x41b084 EnterCriticalSection
0x41b088 LoadLibraryA
0x41b08c OpenMutexA
0x41b090 WritePrivateProfileStringA
0x41b094 SetThreadIdealProcessor
0x41b098 HeapWalk
0x41b09c SetSystemTime
0x41b0a0 GlobalWire
0x41b0a4 FindNextFileA
0x41b0a8 CreateIoCompletionPort
0x41b0ac GetModuleHandleA
0x41b0b0 FindFirstChangeNotificationA
0x41b0b4 WriteProfileStringW
0x41b0b8 SetFileShortNameA
0x41b0bc FindAtomW
0x41b0c0 EnumResourceLanguagesW
0x41b0c4 UnregisterWaitEx
0x41b0c8 GetSystemTime
0x41b0cc DeleteFileA
0x41b0d0 GetVolumeInformationW
0x41b0d4 LocalFileTimeToFileTime
0x41b0d8 EncodePointer
0x41b0dc DecodePointer
0x41b0e0 GetCommandLineA
0x41b0e4 HeapSetInformation
0x41b0e8 GetStartupInfoW
0x41b0ec HeapValidate
0x41b0f0 IsBadReadPtr
0x41b0f4 InterlockedIncrement
0x41b0f8 GetModuleHandleW
0x41b0fc ExitProcess
0x41b100 TerminateProcess
0x41b104 GetCurrentProcess
0x41b108 UnhandledExceptionFilter
0x41b10c SetUnhandledExceptionFilter
0x41b110 IsDebuggerPresent
0x41b114 LeaveCriticalSection
0x41b118 SetHandleCount
0x41b11c InitializeCriticalSectionAndSpinCount
0x41b120 GetFileType
0x41b124 DeleteCriticalSection
0x41b128 QueryPerformanceCounter
0x41b12c GetTickCount
0x41b130 GetCurrentThreadId
0x41b134 GetCurrentProcessId
0x41b138 GetSystemTimeAsFileTime
0x41b13c GetModuleFileNameA
0x41b140 FreeEnvironmentStringsW
0x41b144 WideCharToMultiByte
0x41b148 GetEnvironmentStringsW
0x41b14c TlsAlloc
0x41b150 TlsSetValue
0x41b154 TlsFree
0x41b158 SetLastError
0x41b15c HeapCreate
0x41b160 WriteFile
0x41b164 HeapAlloc
0x41b168 HeapReAlloc
0x41b16c HeapSize
0x41b170 HeapQueryInformation
0x41b174 HeapFree
0x41b178 GetACP
0x41b17c GetOEMCP
0x41b180 GetCPInfo
0x41b184 IsValidCodePage
0x41b188 RtlUnwind
0x41b18c SetFilePointer
0x41b190 GetConsoleCP
0x41b194 GetConsoleMode
0x41b198 OutputDebugStringA
0x41b19c WriteConsoleW
0x41b1a0 OutputDebugStringW
0x41b1a4 MultiByteToWideChar
0x41b1a8 IsProcessorFeaturePresent
0x41b1ac LCMapStringW
0x41b1b0 GetStringTypeW
0x41b1b4 SetStdHandle
0x41b1b8 FlushFileBuffers
0x41b1bc CreateFileW
0x41b1c0 CloseHandle
0x41b1c4 RaiseException
EAT(Export Address Table) is none
KERNEL32.dll
0x41b000 GetCommandLineW
0x41b004 GetThreadContext
0x41b008 CopyFileExW
0x41b00c TlsGetValue
0x41b010 GetCommState
0x41b014 InterlockedDecrement
0x41b018 GetProfileStringW
0x41b01c UnlockFile
0x41b020 FreeEnvironmentStringsA
0x41b024 GetConsoleAliasesLengthA
0x41b028 GetNumberFormatA
0x41b02c FindResourceExA
0x41b030 GlobalAlloc
0x41b034 LoadLibraryW
0x41b038 GetConsoleAliasExesLengthW
0x41b03c HeapDestroy
0x41b040 CreateSemaphoreA
0x41b044 GetBinaryTypeA
0x41b048 GetModuleFileNameW
0x41b04c GetSystemDirectoryA
0x41b050 CreateActCtxA
0x41b054 lstrlenW
0x41b058 LCMapStringA
0x41b05c GetPrivateProfileIntW
0x41b060 GetStartupInfoA
0x41b064 SetThreadLocale
0x41b068 GetStdHandle
0x41b06c GetCPInfoExW
0x41b070 FreeLibraryAndExitThread
0x41b074 GetLastError
0x41b078 GetCurrentDirectoryW
0x41b07c GetProcAddress
0x41b080 CreateNamedPipeA
0x41b084 EnterCriticalSection
0x41b088 LoadLibraryA
0x41b08c OpenMutexA
0x41b090 WritePrivateProfileStringA
0x41b094 SetThreadIdealProcessor
0x41b098 HeapWalk
0x41b09c SetSystemTime
0x41b0a0 GlobalWire
0x41b0a4 FindNextFileA
0x41b0a8 CreateIoCompletionPort
0x41b0ac GetModuleHandleA
0x41b0b0 FindFirstChangeNotificationA
0x41b0b4 WriteProfileStringW
0x41b0b8 SetFileShortNameA
0x41b0bc FindAtomW
0x41b0c0 EnumResourceLanguagesW
0x41b0c4 UnregisterWaitEx
0x41b0c8 GetSystemTime
0x41b0cc DeleteFileA
0x41b0d0 GetVolumeInformationW
0x41b0d4 LocalFileTimeToFileTime
0x41b0d8 EncodePointer
0x41b0dc DecodePointer
0x41b0e0 GetCommandLineA
0x41b0e4 HeapSetInformation
0x41b0e8 GetStartupInfoW
0x41b0ec HeapValidate
0x41b0f0 IsBadReadPtr
0x41b0f4 InterlockedIncrement
0x41b0f8 GetModuleHandleW
0x41b0fc ExitProcess
0x41b100 TerminateProcess
0x41b104 GetCurrentProcess
0x41b108 UnhandledExceptionFilter
0x41b10c SetUnhandledExceptionFilter
0x41b110 IsDebuggerPresent
0x41b114 LeaveCriticalSection
0x41b118 SetHandleCount
0x41b11c InitializeCriticalSectionAndSpinCount
0x41b120 GetFileType
0x41b124 DeleteCriticalSection
0x41b128 QueryPerformanceCounter
0x41b12c GetTickCount
0x41b130 GetCurrentThreadId
0x41b134 GetCurrentProcessId
0x41b138 GetSystemTimeAsFileTime
0x41b13c GetModuleFileNameA
0x41b140 FreeEnvironmentStringsW
0x41b144 WideCharToMultiByte
0x41b148 GetEnvironmentStringsW
0x41b14c TlsAlloc
0x41b150 TlsSetValue
0x41b154 TlsFree
0x41b158 SetLastError
0x41b15c HeapCreate
0x41b160 WriteFile
0x41b164 HeapAlloc
0x41b168 HeapReAlloc
0x41b16c HeapSize
0x41b170 HeapQueryInformation
0x41b174 HeapFree
0x41b178 GetACP
0x41b17c GetOEMCP
0x41b180 GetCPInfo
0x41b184 IsValidCodePage
0x41b188 RtlUnwind
0x41b18c SetFilePointer
0x41b190 GetConsoleCP
0x41b194 GetConsoleMode
0x41b198 OutputDebugStringA
0x41b19c WriteConsoleW
0x41b1a0 OutputDebugStringW
0x41b1a4 MultiByteToWideChar
0x41b1a8 IsProcessorFeaturePresent
0x41b1ac LCMapStringW
0x41b1b0 GetStringTypeW
0x41b1b4 SetStdHandle
0x41b1b8 FlushFileBuffers
0x41b1bc CreateFileW
0x41b1c0 CloseHandle
0x41b1c4 RaiseException
EAT(Export Address Table) is none