ScreenShot
| Created | 2022.12.09 09:52 | Machine | s1_win7_x6401 |
| Filename | k.exe | ||
| Type | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 30 detected (AIDetectNet, malicious, high confidence, score, Unsafe, Save, Attribute, HighConfidence, CryptInject, CLOUD, high, Kryptik, 2KWNMG, kcloud, Artemis, MachineLearning, Anomalous, 100%, Static AI, Suspicious PE, susgen, PossibleThreat, ZemsilF, ny0@a0Ph@EnO, CrypterX) | ||
| md5 | 04eda26f8ffd07ed4a77cb13bb413154 | ||
| sha256 | 149a95862f10a14418b51f595cb28c9f80facdb4c21081661bfd490d3b46e857 | ||
| ssdeep | 3072:4in7bOa6XQhUQrO7Ab3/ZblF+EQeAhz/uxjluRLy:4i7bt6XQeluBh2Duxe+ | ||
| imphash | 218d0fc4cb99087b61778979ff7fe694 | ||
| impfuzzy | 48:kpKaTxVF6h1P58dahV8IlKCzESio+HSYUH+hvPOxQqYcoTpPbNag4pm2:kFD6HhMahV8hO+POxQqYcoTpPbNag4p9 | ||
Network IP location
Signature (18cnts)
| Level | Description |
|---|---|
| danger | Executed a process and injected code into it |
| danger | File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | A process attempted to delay the analysis task. |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Executes one or more WMI queries |
| notice | One or more potentially interesting buffers were extracted |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
Rules (15cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Network_DNS | Communications use DNS | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | Is_DotNET_EXE | (no description) | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
MSVCR90.dll
0x4030cc scanf
0x4030d0 fread
0x4030d4 _invalid_parameter_noinfo
0x4030d8 ??2@YAPAXI@Z
0x4030dc __p__commode
0x4030e0 __p__fmode
0x4030e4 _adjust_fdiv
0x4030e8 _encode_pointer
0x4030ec _configthreadlocale
0x4030f0 _initterm_e
0x4030f4 _initterm
0x4030f8 _wcmdln
0x4030fc exit
0x403100 _XcptFilter
0x403104 _exit
0x403108 _cexit
0x40310c __wgetmainargs
0x403110 _amsg_exit
0x403114 __set_app_type
0x403118 ?terminate@@YAXXZ
0x40311c _unlock
0x403120 __dllonexit
0x403124 _lock
0x403128 ??3@YAXPAX@Z
0x40312c _encoded_null
0x403130 __FrameUnwindFilter
0x403134 _onexit
0x403138 _decode_pointer
0x40313c _except_handler4_common
0x403140 _invoke_watson
0x403144 _controlfp_s
0x403148 __setusermatherr
0x40314c _crt_debugger_hook
0x403150 printf
KERNEL32.dll
0x403038 GetFileType
0x40303c GetModuleHandleA
0x403040 GetProcessId
0x403044 GlobalAlloc
0x403048 GetLastError
0x40304c GetProcAddress
0x403050 GetSystemRegistryQuota
0x403054 GetSystemTimes
0x403058 LocalFileTimeToFileTime
0x40305c CompareFileTime
0x403060 GetNativeSystemInfo
0x403064 IsProcessorFeaturePresent
0x403068 LoadLibraryW
0x40306c LoadLibraryA
0x403070 IsDebuggerPresent
0x403074 UnhandledExceptionFilter
0x403078 InterlockedExchange
0x40307c Sleep
0x403080 InterlockedCompareExchange
0x403084 GetStartupInfoW
0x403088 SetUnhandledExceptionFilter
0x40308c QueryPerformanceCounter
0x403090 GetTickCount
0x403094 GetCurrentThreadId
0x403098 GetCurrentProcessId
0x40309c GetSystemTimeAsFileTime
0x4030a0 TerminateProcess
0x4030a4 GetCurrentProcess
USER32.dll
0x403168 CreateWindowExA
0x40316c ShowWindow
0x403170 UpdateWindow
0x403174 SetCursor
0x403178 GetWindowTextLengthA
0x40317c AdjustWindowRect
0x403180 GetClientRect
0x403184 AnimateWindow
0x403188 LoadIconW
0x40318c CreateCaret
GDI32.dll
0x403010 SetPolyFillMode
0x403014 BitBlt
0x403018 CreateDiscardableBitmap
0x40301c EndPath
0x403020 StretchBlt
0x403024 GetPolyFillMode
0x403028 CreateEllipticRgn
0x40302c CreateDIBitmap
0x403030 SetWinMetaFileBits
ADVAPI32.dll
0x403000 ReportEventA
SHELL32.dll
0x403158 DragQueryPoint
0x40315c DragAcceptFiles
0x403160 ShellExecuteW
MSIMG32.dll
0x4030ac TransparentBlt
0x4030b0 GradientFill
COMCTL32.dll
0x403008 None
WINHTTP.dll
0x403194 WinHttpConnect
0x403198 WinHttpOpenRequest
MSVCP90.dll
0x4030b8 ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
0x4030bc ??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
0x4030c0 ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
0x4030c4 ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcm90.dll
0x4031a8 ?ThrowNestedModuleLoadException@@@YAXP$AAVException@System@@0@Z
0x4031ac ?DoDllLanguageSupportValidation@@@YAXXZ
0x4031b0 ?ThrowModuleLoadException@@@YAXP$AAVString@System@@P$AAVException@3@@Z
0x4031b4 ?DoCallBackInDefaultDomain@@@YAXP6GJPAX@Z0@Z
0x4031b8 ?RegisterModuleUninitializer@@@YAXP$AAVEventHandler@System@@@Z
0x4031bc ?ThrowModuleLoadException@@@YAXP$AAVString@System@@@Z
mscoree.dll
0x4031a0 _CorExeMain
EAT(Export Address Table) is none
MSVCR90.dll
0x4030cc scanf
0x4030d0 fread
0x4030d4 _invalid_parameter_noinfo
0x4030d8 ??2@YAPAXI@Z
0x4030dc __p__commode
0x4030e0 __p__fmode
0x4030e4 _adjust_fdiv
0x4030e8 _encode_pointer
0x4030ec _configthreadlocale
0x4030f0 _initterm_e
0x4030f4 _initterm
0x4030f8 _wcmdln
0x4030fc exit
0x403100 _XcptFilter
0x403104 _exit
0x403108 _cexit
0x40310c __wgetmainargs
0x403110 _amsg_exit
0x403114 __set_app_type
0x403118 ?terminate@@YAXXZ
0x40311c _unlock
0x403120 __dllonexit
0x403124 _lock
0x403128 ??3@YAXPAX@Z
0x40312c _encoded_null
0x403130 __FrameUnwindFilter
0x403134 _onexit
0x403138 _decode_pointer
0x40313c _except_handler4_common
0x403140 _invoke_watson
0x403144 _controlfp_s
0x403148 __setusermatherr
0x40314c _crt_debugger_hook
0x403150 printf
KERNEL32.dll
0x403038 GetFileType
0x40303c GetModuleHandleA
0x403040 GetProcessId
0x403044 GlobalAlloc
0x403048 GetLastError
0x40304c GetProcAddress
0x403050 GetSystemRegistryQuota
0x403054 GetSystemTimes
0x403058 LocalFileTimeToFileTime
0x40305c CompareFileTime
0x403060 GetNativeSystemInfo
0x403064 IsProcessorFeaturePresent
0x403068 LoadLibraryW
0x40306c LoadLibraryA
0x403070 IsDebuggerPresent
0x403074 UnhandledExceptionFilter
0x403078 InterlockedExchange
0x40307c Sleep
0x403080 InterlockedCompareExchange
0x403084 GetStartupInfoW
0x403088 SetUnhandledExceptionFilter
0x40308c QueryPerformanceCounter
0x403090 GetTickCount
0x403094 GetCurrentThreadId
0x403098 GetCurrentProcessId
0x40309c GetSystemTimeAsFileTime
0x4030a0 TerminateProcess
0x4030a4 GetCurrentProcess
USER32.dll
0x403168 CreateWindowExA
0x40316c ShowWindow
0x403170 UpdateWindow
0x403174 SetCursor
0x403178 GetWindowTextLengthA
0x40317c AdjustWindowRect
0x403180 GetClientRect
0x403184 AnimateWindow
0x403188 LoadIconW
0x40318c CreateCaret
GDI32.dll
0x403010 SetPolyFillMode
0x403014 BitBlt
0x403018 CreateDiscardableBitmap
0x40301c EndPath
0x403020 StretchBlt
0x403024 GetPolyFillMode
0x403028 CreateEllipticRgn
0x40302c CreateDIBitmap
0x403030 SetWinMetaFileBits
ADVAPI32.dll
0x403000 ReportEventA
SHELL32.dll
0x403158 DragQueryPoint
0x40315c DragAcceptFiles
0x403160 ShellExecuteW
MSIMG32.dll
0x4030ac TransparentBlt
0x4030b0 GradientFill
COMCTL32.dll
0x403008 None
WINHTTP.dll
0x403194 WinHttpConnect
0x403198 WinHttpOpenRequest
MSVCP90.dll
0x4030b8 ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
0x4030bc ??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
0x4030c0 ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
0x4030c4 ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcm90.dll
0x4031a8 ?ThrowNestedModuleLoadException@
0x4031ac ?DoDllLanguageSupportValidation@
0x4031b0 ?ThrowModuleLoadException@
0x4031b4 ?DoCallBackInDefaultDomain@
0x4031b8 ?RegisterModuleUninitializer@
0x4031bc ?ThrowModuleLoadException@
mscoree.dll
0x4031a0 _CorExeMain
EAT(Export Address Table) is none