ScreenShot
| Created | 2021.10.19 09:46 | Machine | s1_win7_x6401 |
| Filename | index.php | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | d78109d9c17ca4493bdde1ac95bdccfd | ||
| sha256 | f1b4584149a917f47508a967e1e24b1acc2f18a8b1782c0ea181b6a5fce9b8b4 | ||
| ssdeep | 12288:yLkjK7dyUj7WNN82fHDAAFmXAdshmxLx9HmFp3xtcIlQuz7jawZGEX8cA0/M:ycK7d77+nMuM1mxd9HmFpB6mQC7jPsEv | ||
| imphash | f937f2af706dbcbf43ed87b459c473ae | ||
| impfuzzy | 24:dWVl6fhJcD5u4NlzL8LOShJKbZtncdYIlyv9P9GT4aajMn5ADLK/:YVa47M68ctncJK9kca55AK/ | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x46e008 HeapAlloc
0x46e00c GetCurrentProcess
0x46e010 GetEnvironmentStringsW
0x46e014 SetEvent
0x46e018 FlushViewOfFile
0x46e01c SleepEx
0x46e020 ReadConsoleW
0x46e024 CreateActCtxW
0x46e028 FreeConsole
0x46e02c HeapDestroy
0x46e030 FindNextVolumeW
0x46e034 WriteConsoleW
0x46e038 GetModuleFileNameW
0x46e03c GetOverlappedResult
0x46e040 GetACP
0x46e044 ReleaseSemaphore
0x46e048 DeactivateActCtx
0x46e04c Module32First
0x46e050 SetLastError
0x46e054 GetProcAddress
0x46e058 BeginUpdateResourceW
0x46e05c GetAtomNameA
0x46e060 LocalAlloc
0x46e064 SetEnvironmentVariableA
0x46e068 GetModuleHandleA
0x46e06c GetProcessShutdownParameters
0x46e070 EraseTape
0x46e074 VirtualProtect
0x46e078 GetCPInfoExA
0x46e07c EndUpdateResourceA
0x46e080 GetVersionExA
0x46e084 DeleteAtom
0x46e088 FindNextVolumeA
0x46e08c lstrcpyW
0x46e090 LCMapStringW
0x46e094 SetProcessAffinityMask
0x46e098 IsProcessorFeaturePresent
0x46e09c HeapReAlloc
0x46e0a0 EncodePointer
0x46e0a4 DecodePointer
0x46e0a8 GetModuleHandleW
0x46e0ac ExitProcess
0x46e0b0 GetCommandLineW
0x46e0b4 HeapSetInformation
0x46e0b8 GetStartupInfoW
0x46e0bc TlsAlloc
0x46e0c0 TlsGetValue
0x46e0c4 TlsSetValue
0x46e0c8 TlsFree
0x46e0cc InterlockedIncrement
0x46e0d0 GetCurrentThreadId
0x46e0d4 GetLastError
0x46e0d8 InterlockedDecrement
0x46e0dc ReadFile
0x46e0e0 UnhandledExceptionFilter
0x46e0e4 SetUnhandledExceptionFilter
0x46e0e8 IsDebuggerPresent
0x46e0ec TerminateProcess
0x46e0f0 EnterCriticalSection
0x46e0f4 LeaveCriticalSection
0x46e0f8 HeapFree
0x46e0fc SetHandleCount
0x46e100 GetStdHandle
0x46e104 InitializeCriticalSectionAndSpinCount
0x46e108 GetFileType
0x46e10c DeleteCriticalSection
0x46e110 SetFilePointer
0x46e114 GetCPInfo
0x46e118 GetOEMCP
0x46e11c IsValidCodePage
0x46e120 CloseHandle
0x46e124 LoadLibraryW
0x46e128 WriteFile
0x46e12c FreeEnvironmentStringsW
0x46e130 HeapCreate
0x46e134 QueryPerformanceCounter
0x46e138 GetTickCount
0x46e13c GetCurrentProcessId
0x46e140 GetSystemTimeAsFileTime
0x46e144 Sleep
0x46e148 MultiByteToWideChar
0x46e14c WideCharToMultiByte
0x46e150 RtlUnwind
0x46e154 SetStdHandle
0x46e158 GetConsoleCP
0x46e15c GetConsoleMode
0x46e160 FlushFileBuffers
0x46e164 GetStringTypeW
0x46e168 HeapSize
0x46e16c RaiseException
0x46e170 CreateFileW
USER32.dll
0x46e178 ScreenToClient
GDI32.dll
0x46e000 GetBitmapBits
WINHTTP.dll
0x46e180 WinHttpSetOption
EAT(Export Address Table) is none
KERNEL32.dll
0x46e008 HeapAlloc
0x46e00c GetCurrentProcess
0x46e010 GetEnvironmentStringsW
0x46e014 SetEvent
0x46e018 FlushViewOfFile
0x46e01c SleepEx
0x46e020 ReadConsoleW
0x46e024 CreateActCtxW
0x46e028 FreeConsole
0x46e02c HeapDestroy
0x46e030 FindNextVolumeW
0x46e034 WriteConsoleW
0x46e038 GetModuleFileNameW
0x46e03c GetOverlappedResult
0x46e040 GetACP
0x46e044 ReleaseSemaphore
0x46e048 DeactivateActCtx
0x46e04c Module32First
0x46e050 SetLastError
0x46e054 GetProcAddress
0x46e058 BeginUpdateResourceW
0x46e05c GetAtomNameA
0x46e060 LocalAlloc
0x46e064 SetEnvironmentVariableA
0x46e068 GetModuleHandleA
0x46e06c GetProcessShutdownParameters
0x46e070 EraseTape
0x46e074 VirtualProtect
0x46e078 GetCPInfoExA
0x46e07c EndUpdateResourceA
0x46e080 GetVersionExA
0x46e084 DeleteAtom
0x46e088 FindNextVolumeA
0x46e08c lstrcpyW
0x46e090 LCMapStringW
0x46e094 SetProcessAffinityMask
0x46e098 IsProcessorFeaturePresent
0x46e09c HeapReAlloc
0x46e0a0 EncodePointer
0x46e0a4 DecodePointer
0x46e0a8 GetModuleHandleW
0x46e0ac ExitProcess
0x46e0b0 GetCommandLineW
0x46e0b4 HeapSetInformation
0x46e0b8 GetStartupInfoW
0x46e0bc TlsAlloc
0x46e0c0 TlsGetValue
0x46e0c4 TlsSetValue
0x46e0c8 TlsFree
0x46e0cc InterlockedIncrement
0x46e0d0 GetCurrentThreadId
0x46e0d4 GetLastError
0x46e0d8 InterlockedDecrement
0x46e0dc ReadFile
0x46e0e0 UnhandledExceptionFilter
0x46e0e4 SetUnhandledExceptionFilter
0x46e0e8 IsDebuggerPresent
0x46e0ec TerminateProcess
0x46e0f0 EnterCriticalSection
0x46e0f4 LeaveCriticalSection
0x46e0f8 HeapFree
0x46e0fc SetHandleCount
0x46e100 GetStdHandle
0x46e104 InitializeCriticalSectionAndSpinCount
0x46e108 GetFileType
0x46e10c DeleteCriticalSection
0x46e110 SetFilePointer
0x46e114 GetCPInfo
0x46e118 GetOEMCP
0x46e11c IsValidCodePage
0x46e120 CloseHandle
0x46e124 LoadLibraryW
0x46e128 WriteFile
0x46e12c FreeEnvironmentStringsW
0x46e130 HeapCreate
0x46e134 QueryPerformanceCounter
0x46e138 GetTickCount
0x46e13c GetCurrentProcessId
0x46e140 GetSystemTimeAsFileTime
0x46e144 Sleep
0x46e148 MultiByteToWideChar
0x46e14c WideCharToMultiByte
0x46e150 RtlUnwind
0x46e154 SetStdHandle
0x46e158 GetConsoleCP
0x46e15c GetConsoleMode
0x46e160 FlushFileBuffers
0x46e164 GetStringTypeW
0x46e168 HeapSize
0x46e16c RaiseException
0x46e170 CreateFileW
USER32.dll
0x46e178 ScreenToClient
GDI32.dll
0x46e000 GetBitmapBits
WINHTTP.dll
0x46e180 WinHttpSetOption
EAT(Export Address Table) is none