ScreenShot
| Created | 2021.10.02 12:54 | Machine | s1_win7_x6401 |
| Filename | 270bb2b722b4260011.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 33 detected (malicious, high confidence, Fragtor, Stop, Unsafe, Save, ZexaF, GuW@aej, ThiO, Eldorado, Attribute, HighConfidence, PWSX, ai score=89, kcloud, Azorult, score, Kryptik, CLASSIC, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 4d0f90fb39427a8bf7072403f5e0d746 | ||
| sha256 | 89b3ed9d4b3daa09b18db0ee62d8c7b652f3101299a6fc9ca0245bb6a6ded9b9 | ||
| ssdeep | 12288:7xQdo66fP7KxupQZ2HqpSlAEgz5gs7PW9P791QTFsK2cqurOAz:SL6WEJPeNgsj8791QTqL5o | ||
| imphash | 56224a64339684be7c7ed8cfa70e9258 | ||
| impfuzzy | 48:CkaQaOGpdsoLd7G/O/xt4cMQvK9JcEa1I:o4qnLNG/wxt4cMQvQJct1I | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 33 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Foreign language identified in PE resource |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 GetCommandLineW
0x41e004 GetThreadContext
0x41e008 lstrlenA
0x41e00c InterlockedIncrement
0x41e010 GetQueuedCompletionStatus
0x41e014 GetCommState
0x41e018 GetSystemWindowsDirectoryW
0x41e01c GetProfileStringW
0x41e020 SetConsoleScreenBufferSize
0x41e024 CallNamedPipeW
0x41e028 FreeEnvironmentStringsA
0x41e02c SetTapeParameters
0x41e030 CreateNamedPipeW
0x41e034 GetCompressedFileSizeW
0x41e038 CreateActCtxW
0x41e03c FindResourceExA
0x41e040 GetPrivateProfileIntA
0x41e044 GetSystemDirectoryW
0x41e048 SetFileShortNameW
0x41e04c LoadLibraryW
0x41e050 GetSystemWow64DirectoryW
0x41e054 HeapDestroy
0x41e058 CreateSemaphoreA
0x41e05c GetBinaryTypeA
0x41e060 QueryInformationJobObject
0x41e064 GetStartupInfoW
0x41e068 LCMapStringA
0x41e06c GetPrivateProfileIntW
0x41e070 GetLastError
0x41e074 SetLastError
0x41e078 GetProcAddress
0x41e07c SetStdHandle
0x41e080 SearchPathA
0x41e084 LocalAlloc
0x41e088 GetNumberFormatW
0x41e08c FindAtomA
0x41e090 GetModuleFileNameA
0x41e094 FindNextFileA
0x41e098 CreateIoCompletionPort
0x41e09c FindFirstChangeNotificationA
0x41e0a0 HeapSetInformation
0x41e0a4 GetCurrentDirectoryA
0x41e0a8 OutputDebugStringA
0x41e0ac GetCPInfoExA
0x41e0b0 FindAtomW
0x41e0b4 DeleteFileW
0x41e0b8 GetSystemTime
0x41e0bc CopyFileExA
0x41e0c0 InterlockedDecrement
0x41e0c4 DecodePointer
0x41e0c8 GetModuleHandleW
0x41e0cc ExitProcess
0x41e0d0 TerminateProcess
0x41e0d4 GetCurrentProcess
0x41e0d8 UnhandledExceptionFilter
0x41e0dc SetUnhandledExceptionFilter
0x41e0e0 IsDebuggerPresent
0x41e0e4 EncodePointer
0x41e0e8 GetModuleFileNameW
0x41e0ec WriteFile
0x41e0f0 GetStdHandle
0x41e0f4 EnterCriticalSection
0x41e0f8 LeaveCriticalSection
0x41e0fc RtlUnwind
0x41e100 GetACP
0x41e104 GetOEMCP
0x41e108 GetCPInfo
0x41e10c IsValidCodePage
0x41e110 TlsAlloc
0x41e114 TlsGetValue
0x41e118 TlsSetValue
0x41e11c GetCurrentThreadId
0x41e120 TlsFree
0x41e124 SetHandleCount
0x41e128 InitializeCriticalSectionAndSpinCount
0x41e12c GetFileType
0x41e130 DeleteCriticalSection
0x41e134 QueryPerformanceCounter
0x41e138 GetTickCount
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 FreeEnvironmentStringsW
0x41e148 GetEnvironmentStringsW
0x41e14c HeapValidate
0x41e150 IsBadReadPtr
0x41e154 HeapCreate
0x41e158 SetFilePointer
0x41e15c WideCharToMultiByte
0x41e160 GetConsoleCP
0x41e164 GetConsoleMode
0x41e168 WriteConsoleW
0x41e16c OutputDebugStringW
0x41e170 MultiByteToWideChar
0x41e174 GetStringTypeW
0x41e178 LCMapStringW
0x41e17c HeapAlloc
0x41e180 HeapReAlloc
0x41e184 HeapSize
0x41e188 HeapQueryInformation
0x41e18c HeapFree
0x41e190 IsProcessorFeaturePresent
0x41e194 FlushFileBuffers
0x41e198 ReadFile
0x41e19c RaiseException
0x41e1a0 CreateFileW
0x41e1a4 CloseHandle
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 GetCommandLineW
0x41e004 GetThreadContext
0x41e008 lstrlenA
0x41e00c InterlockedIncrement
0x41e010 GetQueuedCompletionStatus
0x41e014 GetCommState
0x41e018 GetSystemWindowsDirectoryW
0x41e01c GetProfileStringW
0x41e020 SetConsoleScreenBufferSize
0x41e024 CallNamedPipeW
0x41e028 FreeEnvironmentStringsA
0x41e02c SetTapeParameters
0x41e030 CreateNamedPipeW
0x41e034 GetCompressedFileSizeW
0x41e038 CreateActCtxW
0x41e03c FindResourceExA
0x41e040 GetPrivateProfileIntA
0x41e044 GetSystemDirectoryW
0x41e048 SetFileShortNameW
0x41e04c LoadLibraryW
0x41e050 GetSystemWow64DirectoryW
0x41e054 HeapDestroy
0x41e058 CreateSemaphoreA
0x41e05c GetBinaryTypeA
0x41e060 QueryInformationJobObject
0x41e064 GetStartupInfoW
0x41e068 LCMapStringA
0x41e06c GetPrivateProfileIntW
0x41e070 GetLastError
0x41e074 SetLastError
0x41e078 GetProcAddress
0x41e07c SetStdHandle
0x41e080 SearchPathA
0x41e084 LocalAlloc
0x41e088 GetNumberFormatW
0x41e08c FindAtomA
0x41e090 GetModuleFileNameA
0x41e094 FindNextFileA
0x41e098 CreateIoCompletionPort
0x41e09c FindFirstChangeNotificationA
0x41e0a0 HeapSetInformation
0x41e0a4 GetCurrentDirectoryA
0x41e0a8 OutputDebugStringA
0x41e0ac GetCPInfoExA
0x41e0b0 FindAtomW
0x41e0b4 DeleteFileW
0x41e0b8 GetSystemTime
0x41e0bc CopyFileExA
0x41e0c0 InterlockedDecrement
0x41e0c4 DecodePointer
0x41e0c8 GetModuleHandleW
0x41e0cc ExitProcess
0x41e0d0 TerminateProcess
0x41e0d4 GetCurrentProcess
0x41e0d8 UnhandledExceptionFilter
0x41e0dc SetUnhandledExceptionFilter
0x41e0e0 IsDebuggerPresent
0x41e0e4 EncodePointer
0x41e0e8 GetModuleFileNameW
0x41e0ec WriteFile
0x41e0f0 GetStdHandle
0x41e0f4 EnterCriticalSection
0x41e0f8 LeaveCriticalSection
0x41e0fc RtlUnwind
0x41e100 GetACP
0x41e104 GetOEMCP
0x41e108 GetCPInfo
0x41e10c IsValidCodePage
0x41e110 TlsAlloc
0x41e114 TlsGetValue
0x41e118 TlsSetValue
0x41e11c GetCurrentThreadId
0x41e120 TlsFree
0x41e124 SetHandleCount
0x41e128 InitializeCriticalSectionAndSpinCount
0x41e12c GetFileType
0x41e130 DeleteCriticalSection
0x41e134 QueryPerformanceCounter
0x41e138 GetTickCount
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 FreeEnvironmentStringsW
0x41e148 GetEnvironmentStringsW
0x41e14c HeapValidate
0x41e150 IsBadReadPtr
0x41e154 HeapCreate
0x41e158 SetFilePointer
0x41e15c WideCharToMultiByte
0x41e160 GetConsoleCP
0x41e164 GetConsoleMode
0x41e168 WriteConsoleW
0x41e16c OutputDebugStringW
0x41e170 MultiByteToWideChar
0x41e174 GetStringTypeW
0x41e178 LCMapStringW
0x41e17c HeapAlloc
0x41e180 HeapReAlloc
0x41e184 HeapSize
0x41e188 HeapQueryInformation
0x41e18c HeapFree
0x41e190 IsProcessorFeaturePresent
0x41e194 FlushFileBuffers
0x41e198 ReadFile
0x41e19c RaiseException
0x41e1a0 CreateFileW
0x41e1a4 CloseHandle
EAT(Export Address Table) is none