ScreenShot
| Created | 2021.10.20 08:10 | Machine | s1_win7_x6402 |
| Filename | csrss.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 40 detected (AIDetect, malware1, malicious, high confidence, GenericKD, Unsafe, Save, Androm, ZexaF, sy0@aa7b2rcG, Attribute, HighConfidence, Kryptik, HMYZ, R + Troj, Krypt, UMal, ywycz@0, susgen, kcloud, StopCrypt, LokiBot, 4LQ5DU, score, CRYPTINJECT, USMANJJ21, CLASSIC, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | a6cf11855cd106ea4fcc35c40906331b | ||
| sha256 | 4f28f8460abcaaf087c8f7ac3980916768846e60a096763429bc66bed1e62f57 | ||
| ssdeep | 6144:EF+Fetc/IzSIKu9vM2BMwnggzqX7tNfVXVHQLIiu8cfo0/pW:EFketAI3KevzPzwZGEX8cA0/M | ||
| imphash | f937f2af706dbcbf43ed87b459c473ae | ||
| impfuzzy | 24:dWVl6fhJcD5u4NlzL8LOShJKbZtncdYIlyv9P9GT4aajMn5ADLK/:YVa47M68ctncJK9kca55AK/ | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 40 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e008 HeapAlloc
0x41e00c GetCurrentProcess
0x41e010 GetEnvironmentStringsW
0x41e014 SetEvent
0x41e018 FlushViewOfFile
0x41e01c SleepEx
0x41e020 ReadConsoleW
0x41e024 CreateActCtxW
0x41e028 FreeConsole
0x41e02c HeapDestroy
0x41e030 FindNextVolumeW
0x41e034 WriteConsoleW
0x41e038 GetModuleFileNameW
0x41e03c GetOverlappedResult
0x41e040 GetACP
0x41e044 ReleaseSemaphore
0x41e048 DeactivateActCtx
0x41e04c Module32First
0x41e050 SetLastError
0x41e054 GetProcAddress
0x41e058 BeginUpdateResourceW
0x41e05c GetAtomNameA
0x41e060 LocalAlloc
0x41e064 SetEnvironmentVariableA
0x41e068 GetModuleHandleA
0x41e06c GetProcessShutdownParameters
0x41e070 EraseTape
0x41e074 VirtualProtect
0x41e078 GetCPInfoExA
0x41e07c EndUpdateResourceA
0x41e080 GetVersionExA
0x41e084 DeleteAtom
0x41e088 FindNextVolumeA
0x41e08c lstrcpyW
0x41e090 LCMapStringW
0x41e094 SetProcessAffinityMask
0x41e098 IsProcessorFeaturePresent
0x41e09c HeapReAlloc
0x41e0a0 EncodePointer
0x41e0a4 DecodePointer
0x41e0a8 GetModuleHandleW
0x41e0ac ExitProcess
0x41e0b0 GetCommandLineW
0x41e0b4 HeapSetInformation
0x41e0b8 GetStartupInfoW
0x41e0bc TlsAlloc
0x41e0c0 TlsGetValue
0x41e0c4 TlsSetValue
0x41e0c8 TlsFree
0x41e0cc InterlockedIncrement
0x41e0d0 GetCurrentThreadId
0x41e0d4 GetLastError
0x41e0d8 InterlockedDecrement
0x41e0dc ReadFile
0x41e0e0 UnhandledExceptionFilter
0x41e0e4 SetUnhandledExceptionFilter
0x41e0e8 IsDebuggerPresent
0x41e0ec TerminateProcess
0x41e0f0 EnterCriticalSection
0x41e0f4 LeaveCriticalSection
0x41e0f8 HeapFree
0x41e0fc SetHandleCount
0x41e100 GetStdHandle
0x41e104 InitializeCriticalSectionAndSpinCount
0x41e108 GetFileType
0x41e10c DeleteCriticalSection
0x41e110 SetFilePointer
0x41e114 GetCPInfo
0x41e118 GetOEMCP
0x41e11c IsValidCodePage
0x41e120 CloseHandle
0x41e124 LoadLibraryW
0x41e128 WriteFile
0x41e12c FreeEnvironmentStringsW
0x41e130 HeapCreate
0x41e134 QueryPerformanceCounter
0x41e138 GetTickCount
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 Sleep
0x41e148 MultiByteToWideChar
0x41e14c WideCharToMultiByte
0x41e150 RtlUnwind
0x41e154 SetStdHandle
0x41e158 GetConsoleCP
0x41e15c GetConsoleMode
0x41e160 FlushFileBuffers
0x41e164 GetStringTypeW
0x41e168 HeapSize
0x41e16c RaiseException
0x41e170 CreateFileW
USER32.dll
0x41e178 ScreenToClient
GDI32.dll
0x41e000 GetBitmapBits
WINHTTP.dll
0x41e180 WinHttpSetOption
EAT(Export Address Table) is none
KERNEL32.dll
0x41e008 HeapAlloc
0x41e00c GetCurrentProcess
0x41e010 GetEnvironmentStringsW
0x41e014 SetEvent
0x41e018 FlushViewOfFile
0x41e01c SleepEx
0x41e020 ReadConsoleW
0x41e024 CreateActCtxW
0x41e028 FreeConsole
0x41e02c HeapDestroy
0x41e030 FindNextVolumeW
0x41e034 WriteConsoleW
0x41e038 GetModuleFileNameW
0x41e03c GetOverlappedResult
0x41e040 GetACP
0x41e044 ReleaseSemaphore
0x41e048 DeactivateActCtx
0x41e04c Module32First
0x41e050 SetLastError
0x41e054 GetProcAddress
0x41e058 BeginUpdateResourceW
0x41e05c GetAtomNameA
0x41e060 LocalAlloc
0x41e064 SetEnvironmentVariableA
0x41e068 GetModuleHandleA
0x41e06c GetProcessShutdownParameters
0x41e070 EraseTape
0x41e074 VirtualProtect
0x41e078 GetCPInfoExA
0x41e07c EndUpdateResourceA
0x41e080 GetVersionExA
0x41e084 DeleteAtom
0x41e088 FindNextVolumeA
0x41e08c lstrcpyW
0x41e090 LCMapStringW
0x41e094 SetProcessAffinityMask
0x41e098 IsProcessorFeaturePresent
0x41e09c HeapReAlloc
0x41e0a0 EncodePointer
0x41e0a4 DecodePointer
0x41e0a8 GetModuleHandleW
0x41e0ac ExitProcess
0x41e0b0 GetCommandLineW
0x41e0b4 HeapSetInformation
0x41e0b8 GetStartupInfoW
0x41e0bc TlsAlloc
0x41e0c0 TlsGetValue
0x41e0c4 TlsSetValue
0x41e0c8 TlsFree
0x41e0cc InterlockedIncrement
0x41e0d0 GetCurrentThreadId
0x41e0d4 GetLastError
0x41e0d8 InterlockedDecrement
0x41e0dc ReadFile
0x41e0e0 UnhandledExceptionFilter
0x41e0e4 SetUnhandledExceptionFilter
0x41e0e8 IsDebuggerPresent
0x41e0ec TerminateProcess
0x41e0f0 EnterCriticalSection
0x41e0f4 LeaveCriticalSection
0x41e0f8 HeapFree
0x41e0fc SetHandleCount
0x41e100 GetStdHandle
0x41e104 InitializeCriticalSectionAndSpinCount
0x41e108 GetFileType
0x41e10c DeleteCriticalSection
0x41e110 SetFilePointer
0x41e114 GetCPInfo
0x41e118 GetOEMCP
0x41e11c IsValidCodePage
0x41e120 CloseHandle
0x41e124 LoadLibraryW
0x41e128 WriteFile
0x41e12c FreeEnvironmentStringsW
0x41e130 HeapCreate
0x41e134 QueryPerformanceCounter
0x41e138 GetTickCount
0x41e13c GetCurrentProcessId
0x41e140 GetSystemTimeAsFileTime
0x41e144 Sleep
0x41e148 MultiByteToWideChar
0x41e14c WideCharToMultiByte
0x41e150 RtlUnwind
0x41e154 SetStdHandle
0x41e158 GetConsoleCP
0x41e15c GetConsoleMode
0x41e160 FlushFileBuffers
0x41e164 GetStringTypeW
0x41e168 HeapSize
0x41e16c RaiseException
0x41e170 CreateFileW
USER32.dll
0x41e178 ScreenToClient
GDI32.dll
0x41e000 GetBitmapBits
WINHTTP.dll
0x41e180 WinHttpSetOption
EAT(Export Address Table) is none