ScreenShot
| Created | 2021.11.01 11:17 | Machine | s1_win7_x6403 |
| Filename | askinstall60.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 42 detected (AIDetect, malware1, malicious, high confidence, Zusy, Unsafe, Save, Attribute, HighConfidence, Razy, FBAdsCard, CLASSIC, Generic ML PUA, R002C0WJV21, Static AI, Malicious PE, ai score=87, Sabsik, score, Socelars, R372531, Artemis, BScope, Agentb, Lkxx, Outbreak, ZexaF, B10@auxD, PWSX, confidence) | ||
| md5 | 3d3d006726a944136a63820c48a81ee5 | ||
| sha256 | c11b40b180d20ac5f5f49071df7b3b5f9809fba193e4af70b92cd985eca54283 | ||
| ssdeep | 24576:y40mpQwZSQhRfEnj7dbE1EHVluS8+XrWG0d6AM+Td2aZF5F1/cPRs:ampRfypigMQ+TEaZvF1/cPRs | ||
| imphash | bb685719d9ce856f7efb2faee0f8ae19 | ||
| impfuzzy | 48:9XTOaLD0DZuBGRMUJ0LES9wYQJcGtp48+9faOwOe6mxvmYBOvzzn:9XTXfEjRMY0LESBQJcGtp43ta736mxOH | ||
Network IP location
Signature (25cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 42 AntiVirus engines on VirusTotal as malicious |
| warning | Generates some ICMP traffic |
| watch | One or more non-whitelisted processes were created |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | An application raised an exception which may be indicative of an exploit crash |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Executes one or more WMI queries |
| notice | Foreign language identified in PE resource |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| notice | Queries for potentially installed applications |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | Tries to locate where the browsers are installed |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Trojan_PWS_Stealer_1_Zero | Trojan.PWS.Stealer Zero | binaries (upload) |
| warning | Credential_User_Data_Check_Zero | Credential User Data Check | binaries (upload) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | SQLite_cookies_Check_Zero | SQLite Cookie Check... select | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
Network (12cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x51d050 GetComputerNameW
0x51d054 GetModuleFileNameA
0x51d058 GetCurrentProcessId
0x51d05c OpenProcess
0x51d060 GetModuleFileNameW
0x51d064 SetLastError
0x51d068 WaitForSingleObject
0x51d06c CreateEventW
0x51d070 FreeLibrary
0x51d074 WinExec
0x51d078 GetPrivateProfileStringW
0x51d07c CopyFileW
0x51d080 SetStdHandle
0x51d084 SetEnvironmentVariableW
0x51d088 FreeEnvironmentStringsW
0x51d08c GetEnvironmentStringsW
0x51d090 GetOEMCP
0x51d094 LocalFree
0x51d098 LocalAlloc
0x51d09c LoadResource
0x51d0a0 FindResourceW
0x51d0a4 SizeofResource
0x51d0a8 LockResource
0x51d0ac GetTickCount
0x51d0b0 GetCurrentThread
0x51d0b4 Sleep
0x51d0b8 GetProcessHeap
0x51d0bc HeapAlloc
0x51d0c0 GetLastError
0x51d0c4 GetTempPathA
0x51d0c8 SetCurrentDirectoryW
0x51d0cc GetShortPathNameA
0x51d0d0 LoadLibraryW
0x51d0d4 GetProcAddress
0x51d0d8 WideCharToMultiByte
0x51d0dc MultiByteToWideChar
0x51d0e0 SystemTimeToFileTime
0x51d0e4 DosDateTimeToFileTime
0x51d0e8 GetCurrentProcess
0x51d0ec DuplicateHandle
0x51d0f0 CloseHandle
0x51d0f4 WriteFile
0x51d0f8 SetFileTime
0x51d0fc SetFilePointer
0x51d100 ReadFile
0x51d104 GetFileType
0x51d108 CreateFileW
0x51d10c CreateDirectoryW
0x51d110 TerminateProcess
0x51d114 GetCurrentDirectoryW
0x51d118 GetACP
0x51d11c IsValidCodePage
0x51d120 FindNextFileW
0x51d124 FindFirstFileExW
0x51d128 FindClose
0x51d12c GetTimeZoneInformation
0x51d130 GetFileSizeEx
0x51d134 GetConsoleCP
0x51d138 SetFilePointerEx
0x51d13c ReadConsoleW
0x51d140 GetConsoleMode
0x51d144 EnumSystemLocalesW
0x51d148 GetUserDefaultLCID
0x51d14c IsValidLocale
0x51d150 GetCommandLineW
0x51d154 GetCommandLineA
0x51d158 GetStdHandle
0x51d15c ExitProcess
0x51d160 GetModuleHandleExW
0x51d164 FreeLibraryAndExitThread
0x51d168 ExitThread
0x51d16c CreateThread
0x51d170 LoadLibraryExW
0x51d174 RtlUnwind
0x51d178 RaiseException
0x51d17c GetStringTypeW
0x51d180 GetLocaleInfoW
0x51d184 LCMapStringW
0x51d188 CompareStringW
0x51d18c TlsFree
0x51d190 TlsSetValue
0x51d194 TlsGetValue
0x51d198 WriteConsoleW
0x51d19c TlsAlloc
0x51d1a0 GetCPInfo
0x51d1a4 DecodePointer
0x51d1a8 EncodePointer
0x51d1ac InitializeSListHead
0x51d1b0 GetStartupInfoW
0x51d1b4 IsDebuggerPresent
0x51d1b8 GetModuleHandleW
0x51d1bc ResetEvent
0x51d1c0 SetEvent
0x51d1c4 InitializeCriticalSectionAndSpinCount
0x51d1c8 IsProcessorFeaturePresent
0x51d1cc SetUnhandledExceptionFilter
0x51d1d0 UnhandledExceptionFilter
0x51d1d4 FlushFileBuffers
0x51d1d8 QueryPerformanceCounter
0x51d1dc MapViewOfFile
0x51d1e0 CreateFileMappingW
0x51d1e4 FormatMessageA
0x51d1e8 GetSystemTime
0x51d1ec GetSystemTimeAsFileTime
0x51d1f0 AreFileApisANSI
0x51d1f4 TryEnterCriticalSection
0x51d1f8 HeapCreate
0x51d1fc HeapFree
0x51d200 EnterCriticalSection
0x51d204 GetFullPathNameW
0x51d208 GetDiskFreeSpaceW
0x51d20c OutputDebugStringA
0x51d210 LockFile
0x51d214 LeaveCriticalSection
0x51d218 InitializeCriticalSection
0x51d21c GetFullPathNameA
0x51d220 SetEndOfFile
0x51d224 UnlockFileEx
0x51d228 GetTempPathW
0x51d22c CreateMutexW
0x51d230 GetFileAttributesW
0x51d234 GetCurrentThreadId
0x51d238 UnmapViewOfFile
0x51d23c HeapValidate
0x51d240 HeapSize
0x51d244 FormatMessageW
0x51d248 GetDiskFreeSpaceA
0x51d24c GetFileAttributesA
0x51d250 GetFileAttributesExW
0x51d254 OutputDebugStringW
0x51d258 FlushViewOfFile
0x51d25c CreateFileA
0x51d260 LoadLibraryA
0x51d264 WaitForSingleObjectEx
0x51d268 DeleteFileA
0x51d26c DeleteFileW
0x51d270 HeapReAlloc
0x51d274 GetSystemInfo
0x51d278 HeapCompact
0x51d27c HeapDestroy
0x51d280 UnlockFile
0x51d284 LockFileEx
0x51d288 GetFileSize
0x51d28c DeleteCriticalSection
ADVAPI32.dll
0x51d000 LookupPrivilegeValueW
0x51d004 AdjustTokenPrivileges
0x51d008 LookupAccountNameW
0x51d00c SetSecurityDescriptorOwner
0x51d010 SetSecurityDescriptorGroup
0x51d014 SetSecurityDescriptorDacl
0x51d018 IsValidSecurityDescriptor
0x51d01c InitializeSecurityDescriptor
0x51d020 InitializeAcl
0x51d024 GetTokenInformation
0x51d028 GetLengthSid
0x51d02c FreeSid
0x51d030 EqualSid
0x51d034 DuplicateToken
0x51d038 AllocateAndInitializeSid
0x51d03c AddAccessAllowedAce
0x51d040 AccessCheck
0x51d044 OpenThreadToken
0x51d048 OpenProcessToken
SHELL32.dll
0x51d29c ShellExecuteExA
ole32.dll
0x51d2f0 CoInitializeEx
0x51d2f4 CoGetObject
0x51d2f8 CoUninitialize
WININET.dll
0x51d2a4 InternetGetCookieExA
NETAPI32.dll
0x51d294 Netbios
ntdll.dll
0x51d2ac RtlInitUnicodeString
0x51d2b0 NtFreeVirtualMemory
0x51d2b4 LdrEnumerateLoadedModules
0x51d2b8 RtlEqualUnicodeString
0x51d2bc RtlAcquirePebLock
0x51d2c0 NtAllocateVirtualMemory
0x51d2c4 RtlReleasePebLock
0x51d2c8 RtlNtStatusToDosError
0x51d2cc RtlCreateHeap
0x51d2d0 RtlDestroyHeap
0x51d2d4 RtlFreeHeap
0x51d2d8 NtClose
0x51d2dc NtOpenKey
0x51d2e0 NtEnumerateValueKey
0x51d2e4 NtQueryValueKey
0x51d2e8 RtlAllocateHeap
EAT(Export Address Table) is none
KERNEL32.dll
0x51d050 GetComputerNameW
0x51d054 GetModuleFileNameA
0x51d058 GetCurrentProcessId
0x51d05c OpenProcess
0x51d060 GetModuleFileNameW
0x51d064 SetLastError
0x51d068 WaitForSingleObject
0x51d06c CreateEventW
0x51d070 FreeLibrary
0x51d074 WinExec
0x51d078 GetPrivateProfileStringW
0x51d07c CopyFileW
0x51d080 SetStdHandle
0x51d084 SetEnvironmentVariableW
0x51d088 FreeEnvironmentStringsW
0x51d08c GetEnvironmentStringsW
0x51d090 GetOEMCP
0x51d094 LocalFree
0x51d098 LocalAlloc
0x51d09c LoadResource
0x51d0a0 FindResourceW
0x51d0a4 SizeofResource
0x51d0a8 LockResource
0x51d0ac GetTickCount
0x51d0b0 GetCurrentThread
0x51d0b4 Sleep
0x51d0b8 GetProcessHeap
0x51d0bc HeapAlloc
0x51d0c0 GetLastError
0x51d0c4 GetTempPathA
0x51d0c8 SetCurrentDirectoryW
0x51d0cc GetShortPathNameA
0x51d0d0 LoadLibraryW
0x51d0d4 GetProcAddress
0x51d0d8 WideCharToMultiByte
0x51d0dc MultiByteToWideChar
0x51d0e0 SystemTimeToFileTime
0x51d0e4 DosDateTimeToFileTime
0x51d0e8 GetCurrentProcess
0x51d0ec DuplicateHandle
0x51d0f0 CloseHandle
0x51d0f4 WriteFile
0x51d0f8 SetFileTime
0x51d0fc SetFilePointer
0x51d100 ReadFile
0x51d104 GetFileType
0x51d108 CreateFileW
0x51d10c CreateDirectoryW
0x51d110 TerminateProcess
0x51d114 GetCurrentDirectoryW
0x51d118 GetACP
0x51d11c IsValidCodePage
0x51d120 FindNextFileW
0x51d124 FindFirstFileExW
0x51d128 FindClose
0x51d12c GetTimeZoneInformation
0x51d130 GetFileSizeEx
0x51d134 GetConsoleCP
0x51d138 SetFilePointerEx
0x51d13c ReadConsoleW
0x51d140 GetConsoleMode
0x51d144 EnumSystemLocalesW
0x51d148 GetUserDefaultLCID
0x51d14c IsValidLocale
0x51d150 GetCommandLineW
0x51d154 GetCommandLineA
0x51d158 GetStdHandle
0x51d15c ExitProcess
0x51d160 GetModuleHandleExW
0x51d164 FreeLibraryAndExitThread
0x51d168 ExitThread
0x51d16c CreateThread
0x51d170 LoadLibraryExW
0x51d174 RtlUnwind
0x51d178 RaiseException
0x51d17c GetStringTypeW
0x51d180 GetLocaleInfoW
0x51d184 LCMapStringW
0x51d188 CompareStringW
0x51d18c TlsFree
0x51d190 TlsSetValue
0x51d194 TlsGetValue
0x51d198 WriteConsoleW
0x51d19c TlsAlloc
0x51d1a0 GetCPInfo
0x51d1a4 DecodePointer
0x51d1a8 EncodePointer
0x51d1ac InitializeSListHead
0x51d1b0 GetStartupInfoW
0x51d1b4 IsDebuggerPresent
0x51d1b8 GetModuleHandleW
0x51d1bc ResetEvent
0x51d1c0 SetEvent
0x51d1c4 InitializeCriticalSectionAndSpinCount
0x51d1c8 IsProcessorFeaturePresent
0x51d1cc SetUnhandledExceptionFilter
0x51d1d0 UnhandledExceptionFilter
0x51d1d4 FlushFileBuffers
0x51d1d8 QueryPerformanceCounter
0x51d1dc MapViewOfFile
0x51d1e0 CreateFileMappingW
0x51d1e4 FormatMessageA
0x51d1e8 GetSystemTime
0x51d1ec GetSystemTimeAsFileTime
0x51d1f0 AreFileApisANSI
0x51d1f4 TryEnterCriticalSection
0x51d1f8 HeapCreate
0x51d1fc HeapFree
0x51d200 EnterCriticalSection
0x51d204 GetFullPathNameW
0x51d208 GetDiskFreeSpaceW
0x51d20c OutputDebugStringA
0x51d210 LockFile
0x51d214 LeaveCriticalSection
0x51d218 InitializeCriticalSection
0x51d21c GetFullPathNameA
0x51d220 SetEndOfFile
0x51d224 UnlockFileEx
0x51d228 GetTempPathW
0x51d22c CreateMutexW
0x51d230 GetFileAttributesW
0x51d234 GetCurrentThreadId
0x51d238 UnmapViewOfFile
0x51d23c HeapValidate
0x51d240 HeapSize
0x51d244 FormatMessageW
0x51d248 GetDiskFreeSpaceA
0x51d24c GetFileAttributesA
0x51d250 GetFileAttributesExW
0x51d254 OutputDebugStringW
0x51d258 FlushViewOfFile
0x51d25c CreateFileA
0x51d260 LoadLibraryA
0x51d264 WaitForSingleObjectEx
0x51d268 DeleteFileA
0x51d26c DeleteFileW
0x51d270 HeapReAlloc
0x51d274 GetSystemInfo
0x51d278 HeapCompact
0x51d27c HeapDestroy
0x51d280 UnlockFile
0x51d284 LockFileEx
0x51d288 GetFileSize
0x51d28c DeleteCriticalSection
ADVAPI32.dll
0x51d000 LookupPrivilegeValueW
0x51d004 AdjustTokenPrivileges
0x51d008 LookupAccountNameW
0x51d00c SetSecurityDescriptorOwner
0x51d010 SetSecurityDescriptorGroup
0x51d014 SetSecurityDescriptorDacl
0x51d018 IsValidSecurityDescriptor
0x51d01c InitializeSecurityDescriptor
0x51d020 InitializeAcl
0x51d024 GetTokenInformation
0x51d028 GetLengthSid
0x51d02c FreeSid
0x51d030 EqualSid
0x51d034 DuplicateToken
0x51d038 AllocateAndInitializeSid
0x51d03c AddAccessAllowedAce
0x51d040 AccessCheck
0x51d044 OpenThreadToken
0x51d048 OpenProcessToken
SHELL32.dll
0x51d29c ShellExecuteExA
ole32.dll
0x51d2f0 CoInitializeEx
0x51d2f4 CoGetObject
0x51d2f8 CoUninitialize
WININET.dll
0x51d2a4 InternetGetCookieExA
NETAPI32.dll
0x51d294 Netbios
ntdll.dll
0x51d2ac RtlInitUnicodeString
0x51d2b0 NtFreeVirtualMemory
0x51d2b4 LdrEnumerateLoadedModules
0x51d2b8 RtlEqualUnicodeString
0x51d2bc RtlAcquirePebLock
0x51d2c0 NtAllocateVirtualMemory
0x51d2c4 RtlReleasePebLock
0x51d2c8 RtlNtStatusToDosError
0x51d2cc RtlCreateHeap
0x51d2d0 RtlDestroyHeap
0x51d2d4 RtlFreeHeap
0x51d2d8 NtClose
0x51d2dc NtOpenKey
0x51d2e0 NtEnumerateValueKey
0x51d2e4 NtQueryValueKey
0x51d2e8 RtlAllocateHeap
EAT(Export Address Table) is none