ScreenShot
| Created | 2022.01.18 14:06 | Machine | s1_win7_x6402 |
| Filename | Athens.dll | ||
| Type | PE32+ executable (DLL) (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 11 detected (Unsafe, malicious, confidence, Static AI, Suspicious PE, Wacatac, score, Artemis, H8sAavcA) | ||
| md5 | 61295ca80fbecf05b60915d8f6ce8c31 | ||
| sha256 | ce7be5bfe8fc4c8439cda750f20e37439ff9a2fb2aeac4a967e4bf6e916d9dac | ||
| ssdeep | 196608:osnnFLF9PGTv7L5WdpCibQUy8G3LfUOQSVrs:oyZqAdrpG3AB | ||
| imphash | 37de52b0abb86dac9b77eeeb776902ab | ||
| impfuzzy | 24:VWA5uKro5LTv4Tg0w/KIWriaQtXJHc9NDI5Q8:gAMysCiKfinXpcM5Q8 | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 11 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is likely packed with VMProtect |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | VMProtect_Zero | VMProtect packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x180d4b000 LoadLibraryA
USER32.dll
0x180d4b010 SetWindowDisplayAffinity
ADVAPI32.dll
0x180d4b020 RegSetValueExW
MSVCP140.dll
0x180d4b030 ?_Xout_of_range@std@@YAXPEBD@Z
D3DCOMPILER_47.dll
0x180d4b040 D3DCompile
IMM32.dll
0x180d4b050 ImmSetCompositionWindow
WINHTTP.dll
0x180d4b060 WinHttpReceiveResponse
VCRUNTIME140_1.dll
0x180d4b070 __CxxFrameHandler4
VCRUNTIME140.dll
0x180d4b080 _CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll
0x180d4b090 malloc
api-ms-win-crt-runtime-l1-1-0.dll
0x180d4b0a0 _configure_narrow_argv
api-ms-win-crt-convert-l1-1-0.dll
0x180d4b0b0 wcstombs
api-ms-win-crt-stdio-l1-1-0.dll
0x180d4b0c0 _fseeki64
api-ms-win-crt-filesystem-l1-1-0.dll
0x180d4b0d0 _mkdir
api-ms-win-crt-environment-l1-1-0.dll
0x180d4b0e0 getenv
api-ms-win-crt-string-l1-1-0.dll
0x180d4b0f0 isspace
api-ms-win-crt-time-l1-1-0.dll
0x180d4b100 _localtime64
api-ms-win-crt-utility-l1-1-0.dll
0x180d4b110 srand
api-ms-win-crt-math-l1-1-0.dll
0x180d4b120 sinf
WTSAPI32.dll
0x180d4b130 WTSSendMessageW
KERNEL32.dll
0x180d4b140 GetSystemTimeAsFileTime
USER32.dll
0x180d4b150 GetUserObjectInformationW
KERNEL32.dll
0x180d4b160 LocalAlloc
0x180d4b168 LocalFree
0x180d4b170 GetModuleFileNameW
0x180d4b178 GetProcessAffinityMask
0x180d4b180 SetProcessAffinityMask
0x180d4b188 SetThreadAffinityMask
0x180d4b190 Sleep
0x180d4b198 ExitProcess
0x180d4b1a0 FreeLibrary
0x180d4b1a8 LoadLibraryA
0x180d4b1b0 GetModuleHandleA
0x180d4b1b8 GetProcAddress
USER32.dll
0x180d4b1c8 GetProcessWindowStation
0x180d4b1d0 GetUserObjectInformationW
EAT(Export Address Table) is none
KERNEL32.dll
0x180d4b000 LoadLibraryA
USER32.dll
0x180d4b010 SetWindowDisplayAffinity
ADVAPI32.dll
0x180d4b020 RegSetValueExW
MSVCP140.dll
0x180d4b030 ?_Xout_of_range@std@@YAXPEBD@Z
D3DCOMPILER_47.dll
0x180d4b040 D3DCompile
IMM32.dll
0x180d4b050 ImmSetCompositionWindow
WINHTTP.dll
0x180d4b060 WinHttpReceiveResponse
VCRUNTIME140_1.dll
0x180d4b070 __CxxFrameHandler4
VCRUNTIME140.dll
0x180d4b080 _CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll
0x180d4b090 malloc
api-ms-win-crt-runtime-l1-1-0.dll
0x180d4b0a0 _configure_narrow_argv
api-ms-win-crt-convert-l1-1-0.dll
0x180d4b0b0 wcstombs
api-ms-win-crt-stdio-l1-1-0.dll
0x180d4b0c0 _fseeki64
api-ms-win-crt-filesystem-l1-1-0.dll
0x180d4b0d0 _mkdir
api-ms-win-crt-environment-l1-1-0.dll
0x180d4b0e0 getenv
api-ms-win-crt-string-l1-1-0.dll
0x180d4b0f0 isspace
api-ms-win-crt-time-l1-1-0.dll
0x180d4b100 _localtime64
api-ms-win-crt-utility-l1-1-0.dll
0x180d4b110 srand
api-ms-win-crt-math-l1-1-0.dll
0x180d4b120 sinf
WTSAPI32.dll
0x180d4b130 WTSSendMessageW
KERNEL32.dll
0x180d4b140 GetSystemTimeAsFileTime
USER32.dll
0x180d4b150 GetUserObjectInformationW
KERNEL32.dll
0x180d4b160 LocalAlloc
0x180d4b168 LocalFree
0x180d4b170 GetModuleFileNameW
0x180d4b178 GetProcessAffinityMask
0x180d4b180 SetProcessAffinityMask
0x180d4b188 SetThreadAffinityMask
0x180d4b190 Sleep
0x180d4b198 ExitProcess
0x180d4b1a0 FreeLibrary
0x180d4b1a8 LoadLibraryA
0x180d4b1b0 GetModuleHandleA
0x180d4b1b8 GetProcAddress
USER32.dll
0x180d4b1c8 GetProcessWindowStation
0x180d4b1d0 GetUserObjectInformationW
EAT(Export Address Table) is none