ScreenShot
| Created | 2021.11.11 12:33 | Machine | s1_win7_x6403 |
| Filename | zuroq6 | ||
| Type | PE32+ executable (DLL) (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 3f20bab397fdae94a874dc9b15a2fcc4 | ||
| sha256 | c90d97b23a126e8e6ebc2ae6daf35bc2236d8002289ab43a006c0d8c053a018e | ||
| ssdeep | 6144:IsmgKiaHcHl5vi9jsL71k24UjrfD1snOuOu+HUtjmCBIEq8ogd:Ismg6cHTkUKO9sn1Ou+GjhBIB8v | ||
| imphash | d4755b9a9aec93c05c955ca11140bdc5 | ||
| impfuzzy | 24:bS1o0qtSVlJnc+pl3eDoTK2dUSOovbO9ZsvwjM6:bS1YtSFc+pp/KR36i | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x180011000 QueryPerformanceCounter
0x180011008 GetCurrentProcessId
0x180011010 GetCurrentThreadId
0x180011018 GetSystemTimeAsFileTime
0x180011020 InitializeSListHead
0x180011028 RtlCaptureContext
0x180011030 RtlLookupFunctionEntry
0x180011038 RtlVirtualUnwind
0x180011040 IsDebuggerPresent
0x180011048 UnhandledExceptionFilter
0x180011050 SetUnhandledExceptionFilter
0x180011058 GetStartupInfoW
0x180011060 IsProcessorFeaturePresent
0x180011068 GetModuleHandleW
0x180011070 RtlUnwindEx
0x180011078 InterlockedFlushSList
0x180011080 GetLastError
0x180011088 SetLastError
0x180011090 EnterCriticalSection
0x180011098 LeaveCriticalSection
0x1800110a0 DeleteCriticalSection
0x1800110a8 InitializeCriticalSectionAndSpinCount
0x1800110b0 TlsAlloc
0x1800110b8 TlsGetValue
0x1800110c0 TlsSetValue
0x1800110c8 TlsFree
0x1800110d0 FreeLibrary
0x1800110d8 GetProcAddress
0x1800110e0 LoadLibraryExW
0x1800110e8 RaiseException
0x1800110f0 GetCurrentProcess
0x1800110f8 ExitProcess
0x180011100 TerminateProcess
0x180011108 GetModuleHandleExW
0x180011110 GetModuleFileNameW
0x180011118 HeapAlloc
0x180011120 HeapFree
0x180011128 FindClose
0x180011130 FindFirstFileExW
0x180011138 FindNextFileW
0x180011140 IsValidCodePage
0x180011148 GetACP
0x180011150 GetOEMCP
0x180011158 GetCPInfo
0x180011160 GetCommandLineA
0x180011168 GetCommandLineW
0x180011170 MultiByteToWideChar
0x180011178 WideCharToMultiByte
0x180011180 GetEnvironmentStringsW
0x180011188 FreeEnvironmentStringsW
0x180011190 LCMapStringW
0x180011198 GetProcessHeap
0x1800111a0 GetStdHandle
0x1800111a8 GetFileType
0x1800111b0 GetStringTypeW
0x1800111b8 HeapSize
0x1800111c0 HeapReAlloc
0x1800111c8 SetStdHandle
0x1800111d0 FlushFileBuffers
0x1800111d8 WriteFile
0x1800111e0 GetConsoleCP
0x1800111e8 GetConsoleMode
0x1800111f0 SetFilePointerEx
0x1800111f8 CreateFileW
0x180011200 CloseHandle
0x180011208 WriteConsoleW
EAT(Export Address Table) Library
0x180001116 About
0x180001038 DllRegisterServer
0x1800010bc RtlClearBuffer
0x18000109e RtlConstructorBuffer
0x180001080 RtlDestructorBuffer
0x180001152 RtlGetBuffer
0x1800010da RtlReadBuffer
0x180001134 RtlSetBuffer
0x1800010f8 RtlWriteBuffer
KERNEL32.dll
0x180011000 QueryPerformanceCounter
0x180011008 GetCurrentProcessId
0x180011010 GetCurrentThreadId
0x180011018 GetSystemTimeAsFileTime
0x180011020 InitializeSListHead
0x180011028 RtlCaptureContext
0x180011030 RtlLookupFunctionEntry
0x180011038 RtlVirtualUnwind
0x180011040 IsDebuggerPresent
0x180011048 UnhandledExceptionFilter
0x180011050 SetUnhandledExceptionFilter
0x180011058 GetStartupInfoW
0x180011060 IsProcessorFeaturePresent
0x180011068 GetModuleHandleW
0x180011070 RtlUnwindEx
0x180011078 InterlockedFlushSList
0x180011080 GetLastError
0x180011088 SetLastError
0x180011090 EnterCriticalSection
0x180011098 LeaveCriticalSection
0x1800110a0 DeleteCriticalSection
0x1800110a8 InitializeCriticalSectionAndSpinCount
0x1800110b0 TlsAlloc
0x1800110b8 TlsGetValue
0x1800110c0 TlsSetValue
0x1800110c8 TlsFree
0x1800110d0 FreeLibrary
0x1800110d8 GetProcAddress
0x1800110e0 LoadLibraryExW
0x1800110e8 RaiseException
0x1800110f0 GetCurrentProcess
0x1800110f8 ExitProcess
0x180011100 TerminateProcess
0x180011108 GetModuleHandleExW
0x180011110 GetModuleFileNameW
0x180011118 HeapAlloc
0x180011120 HeapFree
0x180011128 FindClose
0x180011130 FindFirstFileExW
0x180011138 FindNextFileW
0x180011140 IsValidCodePage
0x180011148 GetACP
0x180011150 GetOEMCP
0x180011158 GetCPInfo
0x180011160 GetCommandLineA
0x180011168 GetCommandLineW
0x180011170 MultiByteToWideChar
0x180011178 WideCharToMultiByte
0x180011180 GetEnvironmentStringsW
0x180011188 FreeEnvironmentStringsW
0x180011190 LCMapStringW
0x180011198 GetProcessHeap
0x1800111a0 GetStdHandle
0x1800111a8 GetFileType
0x1800111b0 GetStringTypeW
0x1800111b8 HeapSize
0x1800111c0 HeapReAlloc
0x1800111c8 SetStdHandle
0x1800111d0 FlushFileBuffers
0x1800111d8 WriteFile
0x1800111e0 GetConsoleCP
0x1800111e8 GetConsoleMode
0x1800111f0 SetFilePointerEx
0x1800111f8 CreateFileW
0x180011200 CloseHandle
0x180011208 WriteConsoleW
EAT(Export Address Table) Library
0x180001116 About
0x180001038 DllRegisterServer
0x1800010bc RtlClearBuffer
0x18000109e RtlConstructorBuffer
0x180001080 RtlDestructorBuffer
0x180001152 RtlGetBuffer
0x1800010da RtlReadBuffer
0x180001134 RtlSetBuffer
0x1800010f8 RtlWriteBuffer