ScreenShot
| Created | 2021.10.01 09:47 | Machine | s1_win7_x6401 |
| Filename | SalmonFlora.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 36 detected (AIDetect, malware2, malicious, high confidence, EasyRansom, Artemis, Unsafe, Save, VMProtBad, confidence, ZexaF, @FW@aCEvxlii, Attribute, HighConfidence, Static AI, Malicious PE, AGEN, Tnega, score, ai score=80, Generic@ML, RDML, 547ujYJ3WIZLAnkiwiodgQ, ADER, susgen) | ||
| md5 | e277207bfd455a387fe52aaa65f4e9b0 | ||
| sha256 | a4c3d60102ff72d89963df742fd50a4b7dc32a23ea3cf7a78dd3a4685397d270 | ||
| ssdeep | 98304:J0lzpavFrqTjdroC9Sjt99e4ZSF9pFPHlzbQCY:gFmadoDg4Zs979Q | ||
| imphash | 5cc235dd606b429af749bcc4d7982503 | ||
| impfuzzy | 12:9OKR3cyVnSSWihQ5kBZGoQtXJxZGb9AJcDfA5kLfP9m:9O3ASSWihQ58QtXJHc9NDI5Q8 | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 36 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is likely packed with VMProtect |
| info | Checks amount of memory in system |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | VMProtect_Zero | VMProtect packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x74f000 DeleteFileA
ADVAPI32.dll
0x74f008 SetServiceStatus
ole32.dll
0x74f010 CoUninitialize
USERENV.dll
0x74f018 CreateEnvironmentBlock
WTSAPI32.dll
0x74f020 WTSQueryUserToken
WININET.dll
0x74f028 DeleteUrlCacheEntry
urlmon.dll
0x74f030 URLDownloadToFileA
PSAPI.DLL
0x74f038 EnumProcesses
WTSAPI32.dll
0x74f040 WTSSendMessageW
KERNEL32.dll
0x74f048 VirtualQuery
USER32.dll
0x74f050 GetProcessWindowStation
KERNEL32.dll
0x74f058 LocalAlloc
0x74f05c LocalFree
0x74f060 GetModuleFileNameW
0x74f064 GetProcessAffinityMask
0x74f068 SetProcessAffinityMask
0x74f06c SetThreadAffinityMask
0x74f070 Sleep
0x74f074 ExitProcess
0x74f078 FreeLibrary
0x74f07c LoadLibraryA
0x74f080 GetModuleHandleA
0x74f084 GetProcAddress
USER32.dll
0x74f08c GetProcessWindowStation
0x74f090 GetUserObjectInformationW
EAT(Export Address Table) is none
KERNEL32.dll
0x74f000 DeleteFileA
ADVAPI32.dll
0x74f008 SetServiceStatus
ole32.dll
0x74f010 CoUninitialize
USERENV.dll
0x74f018 CreateEnvironmentBlock
WTSAPI32.dll
0x74f020 WTSQueryUserToken
WININET.dll
0x74f028 DeleteUrlCacheEntry
urlmon.dll
0x74f030 URLDownloadToFileA
PSAPI.DLL
0x74f038 EnumProcesses
WTSAPI32.dll
0x74f040 WTSSendMessageW
KERNEL32.dll
0x74f048 VirtualQuery
USER32.dll
0x74f050 GetProcessWindowStation
KERNEL32.dll
0x74f058 LocalAlloc
0x74f05c LocalFree
0x74f060 GetModuleFileNameW
0x74f064 GetProcessAffinityMask
0x74f068 SetProcessAffinityMask
0x74f06c SetThreadAffinityMask
0x74f070 Sleep
0x74f074 ExitProcess
0x74f078 FreeLibrary
0x74f07c LoadLibraryA
0x74f080 GetModuleHandleA
0x74f084 GetProcAddress
USER32.dll
0x74f08c GetProcessWindowStation
0x74f090 GetUserObjectInformationW
EAT(Export Address Table) is none