Report - heytap_backup

AntiDebug AntiVM
ScreenShot
Created 2022.07.04 18:53 Machine s1_win7_x6401
Filename heytap_backup
Type empty
AI Score Not founds Behavior Score
3.0
ZERO API file : clean
VT API (file)
md5 d41d8cd98f00b204e9800998ecf8427e
sha256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ssdeep 3::
imphash
impfuzzy
  Network IP location

Signature (7cnts)

Level Description
watch Attempts to modify browser security settings
watch Harvests credentials from local email clients
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger

Rules (8cnts)

Level Name Description Collection
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure