ScreenShot
| Created | 2021.10.04 10:17 | Machine | s1_win7_x6402 |
| Filename | toolspab2.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | fa37c09192e38254a4e80951f6f00642 | ||
| sha256 | 169038c4494a81883466339e557f01af08bb45f7e1fb436d753ee8b1daa8b606 | ||
| ssdeep | 6144:mePG4fLu5mu5aYatk1c0iE8T+eROhxxpeTr/ekI:FPDEmu5aYaq1MT+Lzxp6L | ||
| imphash | c15bb6cf111ec297d5d1e54944f0caf3 | ||
| impfuzzy | 24:UokroOovFPhv1SFdED8Sa7uJXOaV4wlb61R+fjlntsMZ6LJ3NQuOZyvuTzZrnlLg:1ecPhsdaO2w+fRtsMZINsuuXZ7O | ||
Network IP location
Signature (13cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Detects Avast Antivirus through the presence of a library |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | One or more potentially interesting buffers were extracted |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks if process is being debugged by a debugger |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (10cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41b000 HeapReAlloc
0x41b004 GlobalDeleteAtom
0x41b008 GetLocaleInfoA
0x41b00c InterlockedIncrement
0x41b010 GetQueuedCompletionStatus
0x41b014 GetEnvironmentStringsW
0x41b018 SetEvent
0x41b01c ReadConsoleW
0x41b020 GetCommandLineA
0x41b024 CreateActCtxW
0x41b028 GlobalAlloc
0x41b02c CopyFileW
0x41b030 FreeConsole
0x41b034 LeaveCriticalSection
0x41b038 HeapCreate
0x41b03c GetFileAttributesW
0x41b040 WriteConsoleW
0x41b044 GetModuleFileNameW
0x41b048 lstrlenW
0x41b04c SetConsoleTitleA
0x41b050 FlushFileBuffers
0x41b054 DeactivateActCtx
0x41b058 InterlockedExchange
0x41b05c GetProcAddress
0x41b060 BeginUpdateResourceW
0x41b064 RemoveDirectoryA
0x41b068 VerLanguageNameW
0x41b06c LocalAlloc
0x41b070 SetConsoleWindowInfo
0x41b074 GetTapeParameters
0x41b078 SetEnvironmentVariableA
0x41b07c SetConsoleTitleW
0x41b080 GetModuleHandleA
0x41b084 EraseTape
0x41b088 VirtualProtect
0x41b08c EndUpdateResourceA
0x41b090 FindFirstVolumeW
0x41b094 GetCurrentProcessId
0x41b098 GetPrivateProfileSectionW
0x41b09c FindNextVolumeA
0x41b0a0 lstrcpyW
0x41b0a4 GetConsoleOutputCP
0x41b0a8 WideCharToMultiByte
0x41b0ac InterlockedDecrement
0x41b0b0 InterlockedCompareExchange
0x41b0b4 MultiByteToWideChar
0x41b0b8 Sleep
0x41b0bc InitializeCriticalSection
0x41b0c0 DeleteCriticalSection
0x41b0c4 EnterCriticalSection
0x41b0c8 GetLastError
0x41b0cc HeapFree
0x41b0d0 TerminateProcess
0x41b0d4 GetCurrentProcess
0x41b0d8 UnhandledExceptionFilter
0x41b0dc SetUnhandledExceptionFilter
0x41b0e0 IsDebuggerPresent
0x41b0e4 HeapAlloc
0x41b0e8 GetStartupInfoW
0x41b0ec GetCPInfo
0x41b0f0 RtlUnwind
0x41b0f4 RaiseException
0x41b0f8 LCMapStringW
0x41b0fc LCMapStringA
0x41b100 GetStringTypeW
0x41b104 VirtualFree
0x41b108 VirtualAlloc
0x41b10c GetModuleHandleW
0x41b110 TlsGetValue
0x41b114 TlsAlloc
0x41b118 TlsSetValue
0x41b11c TlsFree
0x41b120 SetLastError
0x41b124 GetCurrentThreadId
0x41b128 SetFilePointer
0x41b12c CloseHandle
0x41b130 ExitProcess
0x41b134 WriteFile
0x41b138 GetStdHandle
0x41b13c GetModuleFileNameA
0x41b140 FreeEnvironmentStringsW
0x41b144 GetCommandLineW
0x41b148 SetHandleCount
0x41b14c GetFileType
0x41b150 GetStartupInfoA
0x41b154 QueryPerformanceCounter
0x41b158 GetTickCount
0x41b15c GetSystemTimeAsFileTime
0x41b160 GetStringTypeA
0x41b164 HeapSize
0x41b168 GetACP
0x41b16c GetOEMCP
0x41b170 IsValidCodePage
0x41b174 GetUserDefaultLCID
0x41b178 EnumSystemLocalesA
0x41b17c IsValidLocale
0x41b180 InitializeCriticalSectionAndSpinCount
0x41b184 CreateFileA
0x41b188 SetStdHandle
0x41b18c GetConsoleCP
0x41b190 GetConsoleMode
0x41b194 LoadLibraryA
0x41b198 GetLocaleInfoW
0x41b19c SetEndOfFile
0x41b1a0 GetProcessHeap
0x41b1a4 ReadFile
0x41b1a8 WriteConsoleA
EAT(Export Address Table) Library
0x401763 @GetFirstVice@8
KERNEL32.dll
0x41b000 HeapReAlloc
0x41b004 GlobalDeleteAtom
0x41b008 GetLocaleInfoA
0x41b00c InterlockedIncrement
0x41b010 GetQueuedCompletionStatus
0x41b014 GetEnvironmentStringsW
0x41b018 SetEvent
0x41b01c ReadConsoleW
0x41b020 GetCommandLineA
0x41b024 CreateActCtxW
0x41b028 GlobalAlloc
0x41b02c CopyFileW
0x41b030 FreeConsole
0x41b034 LeaveCriticalSection
0x41b038 HeapCreate
0x41b03c GetFileAttributesW
0x41b040 WriteConsoleW
0x41b044 GetModuleFileNameW
0x41b048 lstrlenW
0x41b04c SetConsoleTitleA
0x41b050 FlushFileBuffers
0x41b054 DeactivateActCtx
0x41b058 InterlockedExchange
0x41b05c GetProcAddress
0x41b060 BeginUpdateResourceW
0x41b064 RemoveDirectoryA
0x41b068 VerLanguageNameW
0x41b06c LocalAlloc
0x41b070 SetConsoleWindowInfo
0x41b074 GetTapeParameters
0x41b078 SetEnvironmentVariableA
0x41b07c SetConsoleTitleW
0x41b080 GetModuleHandleA
0x41b084 EraseTape
0x41b088 VirtualProtect
0x41b08c EndUpdateResourceA
0x41b090 FindFirstVolumeW
0x41b094 GetCurrentProcessId
0x41b098 GetPrivateProfileSectionW
0x41b09c FindNextVolumeA
0x41b0a0 lstrcpyW
0x41b0a4 GetConsoleOutputCP
0x41b0a8 WideCharToMultiByte
0x41b0ac InterlockedDecrement
0x41b0b0 InterlockedCompareExchange
0x41b0b4 MultiByteToWideChar
0x41b0b8 Sleep
0x41b0bc InitializeCriticalSection
0x41b0c0 DeleteCriticalSection
0x41b0c4 EnterCriticalSection
0x41b0c8 GetLastError
0x41b0cc HeapFree
0x41b0d0 TerminateProcess
0x41b0d4 GetCurrentProcess
0x41b0d8 UnhandledExceptionFilter
0x41b0dc SetUnhandledExceptionFilter
0x41b0e0 IsDebuggerPresent
0x41b0e4 HeapAlloc
0x41b0e8 GetStartupInfoW
0x41b0ec GetCPInfo
0x41b0f0 RtlUnwind
0x41b0f4 RaiseException
0x41b0f8 LCMapStringW
0x41b0fc LCMapStringA
0x41b100 GetStringTypeW
0x41b104 VirtualFree
0x41b108 VirtualAlloc
0x41b10c GetModuleHandleW
0x41b110 TlsGetValue
0x41b114 TlsAlloc
0x41b118 TlsSetValue
0x41b11c TlsFree
0x41b120 SetLastError
0x41b124 GetCurrentThreadId
0x41b128 SetFilePointer
0x41b12c CloseHandle
0x41b130 ExitProcess
0x41b134 WriteFile
0x41b138 GetStdHandle
0x41b13c GetModuleFileNameA
0x41b140 FreeEnvironmentStringsW
0x41b144 GetCommandLineW
0x41b148 SetHandleCount
0x41b14c GetFileType
0x41b150 GetStartupInfoA
0x41b154 QueryPerformanceCounter
0x41b158 GetTickCount
0x41b15c GetSystemTimeAsFileTime
0x41b160 GetStringTypeA
0x41b164 HeapSize
0x41b168 GetACP
0x41b16c GetOEMCP
0x41b170 IsValidCodePage
0x41b174 GetUserDefaultLCID
0x41b178 EnumSystemLocalesA
0x41b17c IsValidLocale
0x41b180 InitializeCriticalSectionAndSpinCount
0x41b184 CreateFileA
0x41b188 SetStdHandle
0x41b18c GetConsoleCP
0x41b190 GetConsoleMode
0x41b194 LoadLibraryA
0x41b198 GetLocaleInfoW
0x41b19c SetEndOfFile
0x41b1a0 GetProcessHeap
0x41b1a4 ReadFile
0x41b1a8 WriteConsoleA
EAT(Export Address Table) Library
0x401763 @GetFirstVice@8