ScreenShot
| Created | 2021.10.04 10:12 | Machine | s1_win7_x6401 |
| Filename | sefile3.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 94fa890b7a91f842e006e1c7c795b616 | ||
| sha256 | fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886 | ||
| ssdeep | 6144:IcZIY/cLq84cQZ8TH20w5sarZmdY8Ge+NEIOEDk/U9F+PJF6AnhrROhxxpeTr/et:/I3P4cQZaH24arP8G9Ntf9FEF6Anizxo | ||
| imphash | c15bb6cf111ec297d5d1e54944f0caf3 | ||
| impfuzzy | 24:UokroOovFPhv1SFdED8Sa7uJXOaV4wlb61R+fjlntsMZ6LJ3NQuOZyvuTzZrnlLg:1ecPhsdaO2w+fRtsMZINsuuXZ7O | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x43a000 HeapReAlloc
0x43a004 GlobalDeleteAtom
0x43a008 GetLocaleInfoA
0x43a00c InterlockedIncrement
0x43a010 GetQueuedCompletionStatus
0x43a014 GetEnvironmentStringsW
0x43a018 SetEvent
0x43a01c ReadConsoleW
0x43a020 GetCommandLineA
0x43a024 CreateActCtxW
0x43a028 GlobalAlloc
0x43a02c CopyFileW
0x43a030 FreeConsole
0x43a034 LeaveCriticalSection
0x43a038 HeapCreate
0x43a03c GetFileAttributesW
0x43a040 WriteConsoleW
0x43a044 GetModuleFileNameW
0x43a048 lstrlenW
0x43a04c SetConsoleTitleA
0x43a050 FlushFileBuffers
0x43a054 DeactivateActCtx
0x43a058 InterlockedExchange
0x43a05c GetProcAddress
0x43a060 BeginUpdateResourceW
0x43a064 RemoveDirectoryA
0x43a068 VerLanguageNameW
0x43a06c LocalAlloc
0x43a070 SetConsoleWindowInfo
0x43a074 GetTapeParameters
0x43a078 SetEnvironmentVariableA
0x43a07c SetConsoleTitleW
0x43a080 GetModuleHandleA
0x43a084 EraseTape
0x43a088 VirtualProtect
0x43a08c EndUpdateResourceA
0x43a090 FindFirstVolumeW
0x43a094 GetCurrentProcessId
0x43a098 GetPrivateProfileSectionW
0x43a09c FindNextVolumeA
0x43a0a0 lstrcpyW
0x43a0a4 GetConsoleOutputCP
0x43a0a8 WideCharToMultiByte
0x43a0ac InterlockedDecrement
0x43a0b0 InterlockedCompareExchange
0x43a0b4 MultiByteToWideChar
0x43a0b8 Sleep
0x43a0bc InitializeCriticalSection
0x43a0c0 DeleteCriticalSection
0x43a0c4 EnterCriticalSection
0x43a0c8 GetLastError
0x43a0cc HeapFree
0x43a0d0 TerminateProcess
0x43a0d4 GetCurrentProcess
0x43a0d8 UnhandledExceptionFilter
0x43a0dc SetUnhandledExceptionFilter
0x43a0e0 IsDebuggerPresent
0x43a0e4 HeapAlloc
0x43a0e8 GetStartupInfoW
0x43a0ec GetCPInfo
0x43a0f0 RtlUnwind
0x43a0f4 RaiseException
0x43a0f8 LCMapStringW
0x43a0fc LCMapStringA
0x43a100 GetStringTypeW
0x43a104 VirtualFree
0x43a108 VirtualAlloc
0x43a10c GetModuleHandleW
0x43a110 TlsGetValue
0x43a114 TlsAlloc
0x43a118 TlsSetValue
0x43a11c TlsFree
0x43a120 SetLastError
0x43a124 GetCurrentThreadId
0x43a128 SetFilePointer
0x43a12c CloseHandle
0x43a130 ExitProcess
0x43a134 WriteFile
0x43a138 GetStdHandle
0x43a13c GetModuleFileNameA
0x43a140 FreeEnvironmentStringsW
0x43a144 GetCommandLineW
0x43a148 SetHandleCount
0x43a14c GetFileType
0x43a150 GetStartupInfoA
0x43a154 QueryPerformanceCounter
0x43a158 GetTickCount
0x43a15c GetSystemTimeAsFileTime
0x43a160 GetStringTypeA
0x43a164 HeapSize
0x43a168 GetACP
0x43a16c GetOEMCP
0x43a170 IsValidCodePage
0x43a174 GetUserDefaultLCID
0x43a178 EnumSystemLocalesA
0x43a17c IsValidLocale
0x43a180 InitializeCriticalSectionAndSpinCount
0x43a184 CreateFileA
0x43a188 SetStdHandle
0x43a18c GetConsoleCP
0x43a190 GetConsoleMode
0x43a194 LoadLibraryA
0x43a198 GetLocaleInfoW
0x43a19c SetEndOfFile
0x43a1a0 GetProcessHeap
0x43a1a4 ReadFile
0x43a1a8 WriteConsoleA
EAT(Export Address Table) Library
0x401763 @GetFirstVice@8
KERNEL32.dll
0x43a000 HeapReAlloc
0x43a004 GlobalDeleteAtom
0x43a008 GetLocaleInfoA
0x43a00c InterlockedIncrement
0x43a010 GetQueuedCompletionStatus
0x43a014 GetEnvironmentStringsW
0x43a018 SetEvent
0x43a01c ReadConsoleW
0x43a020 GetCommandLineA
0x43a024 CreateActCtxW
0x43a028 GlobalAlloc
0x43a02c CopyFileW
0x43a030 FreeConsole
0x43a034 LeaveCriticalSection
0x43a038 HeapCreate
0x43a03c GetFileAttributesW
0x43a040 WriteConsoleW
0x43a044 GetModuleFileNameW
0x43a048 lstrlenW
0x43a04c SetConsoleTitleA
0x43a050 FlushFileBuffers
0x43a054 DeactivateActCtx
0x43a058 InterlockedExchange
0x43a05c GetProcAddress
0x43a060 BeginUpdateResourceW
0x43a064 RemoveDirectoryA
0x43a068 VerLanguageNameW
0x43a06c LocalAlloc
0x43a070 SetConsoleWindowInfo
0x43a074 GetTapeParameters
0x43a078 SetEnvironmentVariableA
0x43a07c SetConsoleTitleW
0x43a080 GetModuleHandleA
0x43a084 EraseTape
0x43a088 VirtualProtect
0x43a08c EndUpdateResourceA
0x43a090 FindFirstVolumeW
0x43a094 GetCurrentProcessId
0x43a098 GetPrivateProfileSectionW
0x43a09c FindNextVolumeA
0x43a0a0 lstrcpyW
0x43a0a4 GetConsoleOutputCP
0x43a0a8 WideCharToMultiByte
0x43a0ac InterlockedDecrement
0x43a0b0 InterlockedCompareExchange
0x43a0b4 MultiByteToWideChar
0x43a0b8 Sleep
0x43a0bc InitializeCriticalSection
0x43a0c0 DeleteCriticalSection
0x43a0c4 EnterCriticalSection
0x43a0c8 GetLastError
0x43a0cc HeapFree
0x43a0d0 TerminateProcess
0x43a0d4 GetCurrentProcess
0x43a0d8 UnhandledExceptionFilter
0x43a0dc SetUnhandledExceptionFilter
0x43a0e0 IsDebuggerPresent
0x43a0e4 HeapAlloc
0x43a0e8 GetStartupInfoW
0x43a0ec GetCPInfo
0x43a0f0 RtlUnwind
0x43a0f4 RaiseException
0x43a0f8 LCMapStringW
0x43a0fc LCMapStringA
0x43a100 GetStringTypeW
0x43a104 VirtualFree
0x43a108 VirtualAlloc
0x43a10c GetModuleHandleW
0x43a110 TlsGetValue
0x43a114 TlsAlloc
0x43a118 TlsSetValue
0x43a11c TlsFree
0x43a120 SetLastError
0x43a124 GetCurrentThreadId
0x43a128 SetFilePointer
0x43a12c CloseHandle
0x43a130 ExitProcess
0x43a134 WriteFile
0x43a138 GetStdHandle
0x43a13c GetModuleFileNameA
0x43a140 FreeEnvironmentStringsW
0x43a144 GetCommandLineW
0x43a148 SetHandleCount
0x43a14c GetFileType
0x43a150 GetStartupInfoA
0x43a154 QueryPerformanceCounter
0x43a158 GetTickCount
0x43a15c GetSystemTimeAsFileTime
0x43a160 GetStringTypeA
0x43a164 HeapSize
0x43a168 GetACP
0x43a16c GetOEMCP
0x43a170 IsValidCodePage
0x43a174 GetUserDefaultLCID
0x43a178 EnumSystemLocalesA
0x43a17c IsValidLocale
0x43a180 InitializeCriticalSectionAndSpinCount
0x43a184 CreateFileA
0x43a188 SetStdHandle
0x43a18c GetConsoleCP
0x43a190 GetConsoleMode
0x43a194 LoadLibraryA
0x43a198 GetLocaleInfoW
0x43a19c SetEndOfFile
0x43a1a0 GetProcessHeap
0x43a1a4 ReadFile
0x43a1a8 WriteConsoleA
EAT(Export Address Table) Library
0x401763 @GetFirstVice@8