ScreenShot
| Created | 2021.10.19 16:40 | Machine | s1_win7_x6402 |
| Filename | askinstall25.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 42 detected (malicious, high confidence, Razy, GenericRXAA, Unsafe, Socelars, Save, Eldorado, ExtInstaller, SpySocelars, PWSX, Gencirc, BGVO, Siggen15, Static AI, Malicious PE, Disbuk, AGEN, ASMalwS, Kryptik, Phonzy, score, BScope, Agentb, ai score=86, Glupteba, Bruteforce, FBAdsCard, CLASSIC, 4bmHOip1cWU, ZexaF, BD0@auP3Iynj, Genetic) | ||
| md5 | 61d264f734124d172092b1598a913121 | ||
| sha256 | 1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721 | ||
| ssdeep | 24576:xRp2fYlh5hJYrsWSlTeTmvL26IZX8W6jO2okW1negMdwpVnXa:Dp1v1ji5jtF1nQephX | ||
| imphash | d69e4c13e25f0ad622344ac56118c0df | ||
| impfuzzy | 96:9XTXfp4sMIOtz0LEsQJcGtp43ta73grmxOP:5GyGEta7Qb | ||
Network IP location
Signature (27cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 42 AntiVirus engines on VirusTotal as malicious |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Executes one or more WMI queries |
| notice | Foreign language identified in PE resource |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Queries for potentially installed applications |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Tries to locate where the browsers are installed |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_PWS_Stealer_1_Zero | Trojan.PWS.Stealer Zero | binaries (upload) |
| warning | Credential_User_Data_Check_Zero | Credential User Data Check | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | SQLite_cookies_Check_Zero | SQLite Cookie Check... select | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
Network (12cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x51a050 GetComputerNameW
0x51a054 GetModuleFileNameA
0x51a058 GetCurrentProcessId
0x51a05c OpenProcess
0x51a060 GetModuleFileNameW
0x51a064 SetLastError
0x51a068 WaitForSingleObject
0x51a06c CreateEventW
0x51a070 FreeLibrary
0x51a074 WinExec
0x51a078 GetPrivateProfileStringW
0x51a07c CopyFileW
0x51a080 SetStdHandle
0x51a084 SetEnvironmentVariableW
0x51a088 FreeEnvironmentStringsW
0x51a08c GetEnvironmentStringsW
0x51a090 GetOEMCP
0x51a094 LocalFree
0x51a098 LocalAlloc
0x51a09c LoadResource
0x51a0a0 FindResourceW
0x51a0a4 SizeofResource
0x51a0a8 LockResource
0x51a0ac GetTickCount
0x51a0b0 GetCurrentThread
0x51a0b4 Sleep
0x51a0b8 GetProcessHeap
0x51a0bc HeapAlloc
0x51a0c0 GetLastError
0x51a0c4 GetTempPathA
0x51a0c8 SetCurrentDirectoryW
0x51a0cc GetShortPathNameA
0x51a0d0 LoadLibraryW
0x51a0d4 GetProcAddress
0x51a0d8 WideCharToMultiByte
0x51a0dc MultiByteToWideChar
0x51a0e0 SystemTimeToFileTime
0x51a0e4 DosDateTimeToFileTime
0x51a0e8 GetCurrentProcess
0x51a0ec DuplicateHandle
0x51a0f0 CloseHandle
0x51a0f4 WriteFile
0x51a0f8 SetFileTime
0x51a0fc SetFilePointer
0x51a100 ReadFile
0x51a104 GetFileType
0x51a108 CreateFileW
0x51a10c CreateDirectoryW
0x51a110 TerminateProcess
0x51a114 GetCurrentDirectoryW
0x51a118 GetACP
0x51a11c IsValidCodePage
0x51a120 FindNextFileW
0x51a124 FindFirstFileExW
0x51a128 FindClose
0x51a12c GetTimeZoneInformation
0x51a130 GetFileSizeEx
0x51a134 GetConsoleOutputCP
0x51a138 SetFilePointerEx
0x51a13c ReadConsoleW
0x51a140 GetConsoleMode
0x51a144 EnumSystemLocalesW
0x51a148 GetUserDefaultLCID
0x51a14c IsValidLocale
0x51a150 GetLocaleInfoW
0x51a154 LCMapStringW
0x51a158 CompareStringW
0x51a15c GetCommandLineW
0x51a160 GetCommandLineA
0x51a164 GetStdHandle
0x51a168 ExitProcess
0x51a16c GetModuleHandleExW
0x51a170 FreeLibraryAndExitThread
0x51a174 ExitThread
0x51a178 CreateThread
0x51a17c LoadLibraryExW
0x51a180 TlsFree
0x51a184 TlsSetValue
0x51a188 TlsGetValue
0x51a18c TlsAlloc
0x51a190 RtlUnwind
0x51a194 RaiseException
0x51a198 GetStringTypeW
0x51a19c WriteConsoleW
0x51a1a0 GetCPInfo
0x51a1a4 CompareStringEx
0x51a1a8 LCMapStringEx
0x51a1ac DecodePointer
0x51a1b0 EncodePointer
0x51a1b4 InitializeCriticalSectionEx
0x51a1b8 InitializeSListHead
0x51a1bc GetStartupInfoW
0x51a1c0 IsDebuggerPresent
0x51a1c4 GetModuleHandleW
0x51a1c8 ResetEvent
0x51a1cc SetEvent
0x51a1d0 InitializeCriticalSectionAndSpinCount
0x51a1d4 IsProcessorFeaturePresent
0x51a1d8 SetUnhandledExceptionFilter
0x51a1dc UnhandledExceptionFilter
0x51a1e0 FlushFileBuffers
0x51a1e4 QueryPerformanceCounter
0x51a1e8 MapViewOfFile
0x51a1ec CreateFileMappingW
0x51a1f0 AreFileApisANSI
0x51a1f4 TryEnterCriticalSection
0x51a1f8 HeapCreate
0x51a1fc HeapFree
0x51a200 EnterCriticalSection
0x51a204 GetFullPathNameW
0x51a208 GetDiskFreeSpaceW
0x51a20c OutputDebugStringA
0x51a210 LockFile
0x51a214 LeaveCriticalSection
0x51a218 InitializeCriticalSection
0x51a21c GetFullPathNameA
0x51a220 SetEndOfFile
0x51a224 UnlockFileEx
0x51a228 GetTempPathW
0x51a22c CreateMutexW
0x51a230 GetFileAttributesW
0x51a234 GetCurrentThreadId
0x51a238 UnmapViewOfFile
0x51a23c HeapValidate
0x51a240 HeapSize
0x51a244 FormatMessageW
0x51a248 GetDiskFreeSpaceA
0x51a24c GetFileAttributesA
0x51a250 GetFileAttributesExW
0x51a254 OutputDebugStringW
0x51a258 FlushViewOfFile
0x51a25c CreateFileA
0x51a260 LoadLibraryA
0x51a264 WaitForSingleObjectEx
0x51a268 DeleteFileA
0x51a26c DeleteFileW
0x51a270 HeapReAlloc
0x51a274 GetSystemInfo
0x51a278 HeapCompact
0x51a27c HeapDestroy
0x51a280 UnlockFile
0x51a284 LockFileEx
0x51a288 GetFileSize
0x51a28c DeleteCriticalSection
0x51a290 GetSystemTimeAsFileTime
0x51a294 GetSystemTime
0x51a298 FormatMessageA
ADVAPI32.dll
0x51a000 LookupPrivilegeValueW
0x51a004 AdjustTokenPrivileges
0x51a008 LookupAccountNameW
0x51a00c SetSecurityDescriptorOwner
0x51a010 SetSecurityDescriptorGroup
0x51a014 SetSecurityDescriptorDacl
0x51a018 IsValidSecurityDescriptor
0x51a01c InitializeSecurityDescriptor
0x51a020 InitializeAcl
0x51a024 GetTokenInformation
0x51a028 GetLengthSid
0x51a02c FreeSid
0x51a030 EqualSid
0x51a034 DuplicateToken
0x51a038 AllocateAndInitializeSid
0x51a03c AddAccessAllowedAce
0x51a040 AccessCheck
0x51a044 OpenThreadToken
0x51a048 OpenProcessToken
SHELL32.dll
0x51a2a8 ShellExecuteExA
ole32.dll
0x51a2fc CoInitializeEx
0x51a300 CoGetObject
0x51a304 CoUninitialize
WININET.dll
0x51a2b0 InternetGetCookieExA
NETAPI32.dll
0x51a2a0 Netbios
ntdll.dll
0x51a2b8 RtlInitUnicodeString
0x51a2bc NtFreeVirtualMemory
0x51a2c0 LdrEnumerateLoadedModules
0x51a2c4 RtlEqualUnicodeString
0x51a2c8 RtlAcquirePebLock
0x51a2cc NtAllocateVirtualMemory
0x51a2d0 RtlReleasePebLock
0x51a2d4 RtlNtStatusToDosError
0x51a2d8 RtlCreateHeap
0x51a2dc RtlDestroyHeap
0x51a2e0 RtlAllocateHeap
0x51a2e4 RtlFreeHeap
0x51a2e8 NtClose
0x51a2ec NtOpenKey
0x51a2f0 NtEnumerateValueKey
0x51a2f4 NtQueryValueKey
EAT(Export Address Table) is none
KERNEL32.dll
0x51a050 GetComputerNameW
0x51a054 GetModuleFileNameA
0x51a058 GetCurrentProcessId
0x51a05c OpenProcess
0x51a060 GetModuleFileNameW
0x51a064 SetLastError
0x51a068 WaitForSingleObject
0x51a06c CreateEventW
0x51a070 FreeLibrary
0x51a074 WinExec
0x51a078 GetPrivateProfileStringW
0x51a07c CopyFileW
0x51a080 SetStdHandle
0x51a084 SetEnvironmentVariableW
0x51a088 FreeEnvironmentStringsW
0x51a08c GetEnvironmentStringsW
0x51a090 GetOEMCP
0x51a094 LocalFree
0x51a098 LocalAlloc
0x51a09c LoadResource
0x51a0a0 FindResourceW
0x51a0a4 SizeofResource
0x51a0a8 LockResource
0x51a0ac GetTickCount
0x51a0b0 GetCurrentThread
0x51a0b4 Sleep
0x51a0b8 GetProcessHeap
0x51a0bc HeapAlloc
0x51a0c0 GetLastError
0x51a0c4 GetTempPathA
0x51a0c8 SetCurrentDirectoryW
0x51a0cc GetShortPathNameA
0x51a0d0 LoadLibraryW
0x51a0d4 GetProcAddress
0x51a0d8 WideCharToMultiByte
0x51a0dc MultiByteToWideChar
0x51a0e0 SystemTimeToFileTime
0x51a0e4 DosDateTimeToFileTime
0x51a0e8 GetCurrentProcess
0x51a0ec DuplicateHandle
0x51a0f0 CloseHandle
0x51a0f4 WriteFile
0x51a0f8 SetFileTime
0x51a0fc SetFilePointer
0x51a100 ReadFile
0x51a104 GetFileType
0x51a108 CreateFileW
0x51a10c CreateDirectoryW
0x51a110 TerminateProcess
0x51a114 GetCurrentDirectoryW
0x51a118 GetACP
0x51a11c IsValidCodePage
0x51a120 FindNextFileW
0x51a124 FindFirstFileExW
0x51a128 FindClose
0x51a12c GetTimeZoneInformation
0x51a130 GetFileSizeEx
0x51a134 GetConsoleOutputCP
0x51a138 SetFilePointerEx
0x51a13c ReadConsoleW
0x51a140 GetConsoleMode
0x51a144 EnumSystemLocalesW
0x51a148 GetUserDefaultLCID
0x51a14c IsValidLocale
0x51a150 GetLocaleInfoW
0x51a154 LCMapStringW
0x51a158 CompareStringW
0x51a15c GetCommandLineW
0x51a160 GetCommandLineA
0x51a164 GetStdHandle
0x51a168 ExitProcess
0x51a16c GetModuleHandleExW
0x51a170 FreeLibraryAndExitThread
0x51a174 ExitThread
0x51a178 CreateThread
0x51a17c LoadLibraryExW
0x51a180 TlsFree
0x51a184 TlsSetValue
0x51a188 TlsGetValue
0x51a18c TlsAlloc
0x51a190 RtlUnwind
0x51a194 RaiseException
0x51a198 GetStringTypeW
0x51a19c WriteConsoleW
0x51a1a0 GetCPInfo
0x51a1a4 CompareStringEx
0x51a1a8 LCMapStringEx
0x51a1ac DecodePointer
0x51a1b0 EncodePointer
0x51a1b4 InitializeCriticalSectionEx
0x51a1b8 InitializeSListHead
0x51a1bc GetStartupInfoW
0x51a1c0 IsDebuggerPresent
0x51a1c4 GetModuleHandleW
0x51a1c8 ResetEvent
0x51a1cc SetEvent
0x51a1d0 InitializeCriticalSectionAndSpinCount
0x51a1d4 IsProcessorFeaturePresent
0x51a1d8 SetUnhandledExceptionFilter
0x51a1dc UnhandledExceptionFilter
0x51a1e0 FlushFileBuffers
0x51a1e4 QueryPerformanceCounter
0x51a1e8 MapViewOfFile
0x51a1ec CreateFileMappingW
0x51a1f0 AreFileApisANSI
0x51a1f4 TryEnterCriticalSection
0x51a1f8 HeapCreate
0x51a1fc HeapFree
0x51a200 EnterCriticalSection
0x51a204 GetFullPathNameW
0x51a208 GetDiskFreeSpaceW
0x51a20c OutputDebugStringA
0x51a210 LockFile
0x51a214 LeaveCriticalSection
0x51a218 InitializeCriticalSection
0x51a21c GetFullPathNameA
0x51a220 SetEndOfFile
0x51a224 UnlockFileEx
0x51a228 GetTempPathW
0x51a22c CreateMutexW
0x51a230 GetFileAttributesW
0x51a234 GetCurrentThreadId
0x51a238 UnmapViewOfFile
0x51a23c HeapValidate
0x51a240 HeapSize
0x51a244 FormatMessageW
0x51a248 GetDiskFreeSpaceA
0x51a24c GetFileAttributesA
0x51a250 GetFileAttributesExW
0x51a254 OutputDebugStringW
0x51a258 FlushViewOfFile
0x51a25c CreateFileA
0x51a260 LoadLibraryA
0x51a264 WaitForSingleObjectEx
0x51a268 DeleteFileA
0x51a26c DeleteFileW
0x51a270 HeapReAlloc
0x51a274 GetSystemInfo
0x51a278 HeapCompact
0x51a27c HeapDestroy
0x51a280 UnlockFile
0x51a284 LockFileEx
0x51a288 GetFileSize
0x51a28c DeleteCriticalSection
0x51a290 GetSystemTimeAsFileTime
0x51a294 GetSystemTime
0x51a298 FormatMessageA
ADVAPI32.dll
0x51a000 LookupPrivilegeValueW
0x51a004 AdjustTokenPrivileges
0x51a008 LookupAccountNameW
0x51a00c SetSecurityDescriptorOwner
0x51a010 SetSecurityDescriptorGroup
0x51a014 SetSecurityDescriptorDacl
0x51a018 IsValidSecurityDescriptor
0x51a01c InitializeSecurityDescriptor
0x51a020 InitializeAcl
0x51a024 GetTokenInformation
0x51a028 GetLengthSid
0x51a02c FreeSid
0x51a030 EqualSid
0x51a034 DuplicateToken
0x51a038 AllocateAndInitializeSid
0x51a03c AddAccessAllowedAce
0x51a040 AccessCheck
0x51a044 OpenThreadToken
0x51a048 OpenProcessToken
SHELL32.dll
0x51a2a8 ShellExecuteExA
ole32.dll
0x51a2fc CoInitializeEx
0x51a300 CoGetObject
0x51a304 CoUninitialize
WININET.dll
0x51a2b0 InternetGetCookieExA
NETAPI32.dll
0x51a2a0 Netbios
ntdll.dll
0x51a2b8 RtlInitUnicodeString
0x51a2bc NtFreeVirtualMemory
0x51a2c0 LdrEnumerateLoadedModules
0x51a2c4 RtlEqualUnicodeString
0x51a2c8 RtlAcquirePebLock
0x51a2cc NtAllocateVirtualMemory
0x51a2d0 RtlReleasePebLock
0x51a2d4 RtlNtStatusToDosError
0x51a2d8 RtlCreateHeap
0x51a2dc RtlDestroyHeap
0x51a2e0 RtlAllocateHeap
0x51a2e4 RtlFreeHeap
0x51a2e8 NtClose
0x51a2ec NtOpenKey
0x51a2f0 NtEnumerateValueKey
0x51a2f4 NtQueryValueKey
EAT(Export Address Table) is none