popup

Report - ETH2.exe

PE64 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.10.14 17:22 Machine s1_win7_x6402
Filename ETH2.exe
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
AI Score
3
 Behavior Score
1.2
ZERO API file : malware
VT API (file) 25 detected (Donut, malicious, high confidence, GenericKDZ, Unsafe, Artemis, Outbreak, Score, Wacatac, ai score=83, R002H0DJB21)
md5 13003cbfb6d2adfeea85952f8172c4f7
sha256 9c8590c7165b453dd0792be3cf51e200961a1ed9cf1154768ee86f7018db8fd9
ssdeep 49152:YMWXWDNahuR7JmTqru3cJXNxDyfCDVYNd/0wZUGGa639KNg:YMwiYSHVYNSwZUhV3R
imphash 02549ff92b49cce693542fc9afb10102
impfuzzy 6:HMJqX0syYJxSBS0H5sD4sIWvXoFliPEcn:sJqGMY58E6PXn
  Network IP location

Signature (2cnts)

Level Description
warning File has been identified by 25 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer

Rules (2cnts)

Level Name Description Collection
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

msvcrt.dll
 0x5eb56c malloc
 0x5eb574 memset
 0x5eb57c _get_pgmptr
 0x5eb584 getenv
 0x5eb58c sprintf
 0x5eb594 __argc
 0x5eb59c __argv
 0x5eb5a4 _environ
 0x5eb5ac _XcptFilter
 0x5eb5b4 __set_app_type
 0x5eb5bc _controlfp
 0x5eb5c4 __getmainargs
 0x5eb5cc exit
kernel32.dll
 0x5eb5dc Sleep
 0x5eb5e4 CreateProcessA
 0x5eb5ec SetUnhandledExceptionFilter

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure