ScreenShot
| Created | 2021.11.02 12:19 | Machine | s1_win7_x6401 |
| Filename | mix.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 25 detected (AIDetect, malware1, malicious, high confidence, Artemis, Unsafe, Save, Hacktool, ZexaF, su0@ayBEVcpG, Kryptik, Eldorado, GenKryptik, FMYB, Lockbit, Score, Sabsik, ET#93%, RDMK, cmRtazpv7MU59KEC6+AWBOx0Et+i, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 863db22615785c834f8ac8ed325404e4 | ||
| sha256 | e80010838ebfc7d949c7ce73355bf5ee912d03dfe7dfe136746bed711c970a1b | ||
| ssdeep | 6144:XFqLqsRKblxC3f5l8V2ZX7RKzBSwgFe6mUixCGfQ:XFqLqEKblAvr8wB7RRdhuCGo | ||
| imphash | 38efc42584ffe235e8d11c10897bfaf8 | ||
| impfuzzy | 24:lhESeJS+IIFD0OR/uchS1OovgcQIlyv9jtuhIgJ3In4FNSFjMvEl3n:1V+NzfcHK9jtuFZjScK3 | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 25 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x43a000 HeapReAlloc
0x43a004 FindFirstChangeNotificationW
0x43a008 FindResourceExW
0x43a00c LoadResource
0x43a010 HeapAlloc
0x43a014 SetMailslotInfo
0x43a018 GetEnvironmentStringsW
0x43a01c SetEvent
0x43a020 FlushConsoleInputBuffer
0x43a024 GetTickCount
0x43a028 TlsSetValue
0x43a02c GlobalAlloc
0x43a030 LoadLibraryW
0x43a034 InitAtomTable
0x43a038 FindNextVolumeW
0x43a03c WriteConsoleW
0x43a040 CreateActCtxA
0x43a044 BindIoCompletionCallback
0x43a048 GetProcAddress
0x43a04c VirtualAlloc
0x43a050 BeginUpdateResourceW
0x43a054 PrepareTape
0x43a058 GetAtomNameA
0x43a05c LoadLibraryA
0x43a060 WriteConsoleA
0x43a064 SetEnvironmentVariableA
0x43a068 GetModuleFileNameA
0x43a06c GetProcessAffinityMask
0x43a070 AddConsoleAliasA
0x43a074 CreateFileW
0x43a078 HeapSize
0x43a07c DecodePointer
0x43a080 EncodePointer
0x43a084 GetCommandLineA
0x43a088 HeapSetInformation
0x43a08c GetStartupInfoW
0x43a090 IsProcessorFeaturePresent
0x43a094 EnterCriticalSection
0x43a098 LeaveCriticalSection
0x43a09c SetHandleCount
0x43a0a0 GetStdHandle
0x43a0a4 InitializeCriticalSectionAndSpinCount
0x43a0a8 GetFileType
0x43a0ac DeleteCriticalSection
0x43a0b0 UnhandledExceptionFilter
0x43a0b4 SetUnhandledExceptionFilter
0x43a0b8 IsDebuggerPresent
0x43a0bc TerminateProcess
0x43a0c0 GetCurrentProcess
0x43a0c4 RtlUnwind
0x43a0c8 GetLastError
0x43a0cc SetFilePointer
0x43a0d0 TlsAlloc
0x43a0d4 TlsGetValue
0x43a0d8 TlsFree
0x43a0dc InterlockedIncrement
0x43a0e0 GetModuleHandleW
0x43a0e4 SetLastError
0x43a0e8 GetCurrentThreadId
0x43a0ec InterlockedDecrement
0x43a0f0 HeapFree
0x43a0f4 CloseHandle
0x43a0f8 ExitProcess
0x43a0fc WriteFile
0x43a100 GetModuleFileNameW
0x43a104 FreeEnvironmentStringsW
0x43a108 WideCharToMultiByte
0x43a10c HeapCreate
0x43a110 QueryPerformanceCounter
0x43a114 GetCurrentProcessId
0x43a118 GetSystemTimeAsFileTime
0x43a11c Sleep
0x43a120 GetConsoleCP
0x43a124 GetConsoleMode
0x43a128 GetCPInfo
0x43a12c GetACP
0x43a130 GetOEMCP
0x43a134 IsValidCodePage
0x43a138 CreateFileA
0x43a13c SetStdHandle
0x43a140 FlushFileBuffers
0x43a144 RaiseException
0x43a148 MultiByteToWideChar
0x43a14c LCMapStringW
0x43a150 GetStringTypeW
0x43a154 SetEndOfFile
0x43a158 GetProcessHeap
0x43a15c ReadFile
USER32.dll
0x43a164 GetCursorPos
EAT(Export Address Table) is none
KERNEL32.dll
0x43a000 HeapReAlloc
0x43a004 FindFirstChangeNotificationW
0x43a008 FindResourceExW
0x43a00c LoadResource
0x43a010 HeapAlloc
0x43a014 SetMailslotInfo
0x43a018 GetEnvironmentStringsW
0x43a01c SetEvent
0x43a020 FlushConsoleInputBuffer
0x43a024 GetTickCount
0x43a028 TlsSetValue
0x43a02c GlobalAlloc
0x43a030 LoadLibraryW
0x43a034 InitAtomTable
0x43a038 FindNextVolumeW
0x43a03c WriteConsoleW
0x43a040 CreateActCtxA
0x43a044 BindIoCompletionCallback
0x43a048 GetProcAddress
0x43a04c VirtualAlloc
0x43a050 BeginUpdateResourceW
0x43a054 PrepareTape
0x43a058 GetAtomNameA
0x43a05c LoadLibraryA
0x43a060 WriteConsoleA
0x43a064 SetEnvironmentVariableA
0x43a068 GetModuleFileNameA
0x43a06c GetProcessAffinityMask
0x43a070 AddConsoleAliasA
0x43a074 CreateFileW
0x43a078 HeapSize
0x43a07c DecodePointer
0x43a080 EncodePointer
0x43a084 GetCommandLineA
0x43a088 HeapSetInformation
0x43a08c GetStartupInfoW
0x43a090 IsProcessorFeaturePresent
0x43a094 EnterCriticalSection
0x43a098 LeaveCriticalSection
0x43a09c SetHandleCount
0x43a0a0 GetStdHandle
0x43a0a4 InitializeCriticalSectionAndSpinCount
0x43a0a8 GetFileType
0x43a0ac DeleteCriticalSection
0x43a0b0 UnhandledExceptionFilter
0x43a0b4 SetUnhandledExceptionFilter
0x43a0b8 IsDebuggerPresent
0x43a0bc TerminateProcess
0x43a0c0 GetCurrentProcess
0x43a0c4 RtlUnwind
0x43a0c8 GetLastError
0x43a0cc SetFilePointer
0x43a0d0 TlsAlloc
0x43a0d4 TlsGetValue
0x43a0d8 TlsFree
0x43a0dc InterlockedIncrement
0x43a0e0 GetModuleHandleW
0x43a0e4 SetLastError
0x43a0e8 GetCurrentThreadId
0x43a0ec InterlockedDecrement
0x43a0f0 HeapFree
0x43a0f4 CloseHandle
0x43a0f8 ExitProcess
0x43a0fc WriteFile
0x43a100 GetModuleFileNameW
0x43a104 FreeEnvironmentStringsW
0x43a108 WideCharToMultiByte
0x43a10c HeapCreate
0x43a110 QueryPerformanceCounter
0x43a114 GetCurrentProcessId
0x43a118 GetSystemTimeAsFileTime
0x43a11c Sleep
0x43a120 GetConsoleCP
0x43a124 GetConsoleMode
0x43a128 GetCPInfo
0x43a12c GetACP
0x43a130 GetOEMCP
0x43a134 IsValidCodePage
0x43a138 CreateFileA
0x43a13c SetStdHandle
0x43a140 FlushFileBuffers
0x43a144 RaiseException
0x43a148 MultiByteToWideChar
0x43a14c LCMapStringW
0x43a150 GetStringTypeW
0x43a154 SetEndOfFile
0x43a158 GetProcessHeap
0x43a15c ReadFile
USER32.dll
0x43a164 GetCursorPos
EAT(Export Address Table) is none