ScreenShot
| Created | 2022.12.20 11:50 | Machine | s1_win7_x6403 |
| Filename | Clip1.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 16 detected (malicious, high confidence, Unsafe, Attribute, HighConfidence, Trickbot, score, Generic ML PUA, Sabsik, Static AI, Suspicious PE, susgen) | ||
| md5 | 08e7e0da767d6c6a629627caad9f9a78 | ||
| sha256 | ddf3e88009b31395bad6bdf11bd57e6b0f77d28ee29f2dda306c8a9147e45263 | ||
| ssdeep | 98304:tDfRit+1X5/S6mZid5Sm3jlhuhG2LGbQkVCdPnLIVKWqEFJSog:tD+mJ/SRZid5S7hTZkkIKWLZ | ||
| imphash | 06034380a955222fd337fddcf511d417 | ||
| impfuzzy | 12:L5zDJ+eb2Q4W2TQot8SaaesBbmI2uD1FzZGMZGqAJcDW:L/+85NoaSaIBb+u5F7dNDW | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 16 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14060f000 GetModuleFileNameA
USER32.dll
0x14060f010 ShowWindow
SHELL32.dll
0x14060f020 ShellExecuteA
MSVCP140.dll
0x14060f030 ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
VCRUNTIME140_1.dll
0x14060f040 __CxxFrameHandler4
VCRUNTIME140.dll
0x14060f050 memcmp
api-ms-win-crt-stdio-l1-1-0.dll
0x14060f060 fputc
api-ms-win-crt-time-l1-1-0.dll
0x14060f070 _difftime64
api-ms-win-crt-filesystem-l1-1-0.dll
0x14060f080 _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll
0x14060f090 _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll
0x14060f0a0 malloc
api-ms-win-crt-math-l1-1-0.dll
0x14060f0b0 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x14060f0c0 _configthreadlocale
KERNEL32.dll
0x14060f0d0 LocalAlloc
0x14060f0d8 LocalFree
0x14060f0e0 GetModuleFileNameW
0x14060f0e8 ExitProcess
0x14060f0f0 LoadLibraryA
0x14060f0f8 GetModuleHandleA
0x14060f100 GetProcAddress
EAT(Export Address Table) is none
KERNEL32.dll
0x14060f000 GetModuleFileNameA
USER32.dll
0x14060f010 ShowWindow
SHELL32.dll
0x14060f020 ShellExecuteA
MSVCP140.dll
0x14060f030 ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
VCRUNTIME140_1.dll
0x14060f040 __CxxFrameHandler4
VCRUNTIME140.dll
0x14060f050 memcmp
api-ms-win-crt-stdio-l1-1-0.dll
0x14060f060 fputc
api-ms-win-crt-time-l1-1-0.dll
0x14060f070 _difftime64
api-ms-win-crt-filesystem-l1-1-0.dll
0x14060f080 _unlock_file
api-ms-win-crt-runtime-l1-1-0.dll
0x14060f090 _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll
0x14060f0a0 malloc
api-ms-win-crt-math-l1-1-0.dll
0x14060f0b0 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x14060f0c0 _configthreadlocale
KERNEL32.dll
0x14060f0d0 LocalAlloc
0x14060f0d8 LocalFree
0x14060f0e0 GetModuleFileNameW
0x14060f0e8 ExitProcess
0x14060f0f0 LoadLibraryA
0x14060f0f8 GetModuleHandleA
0x14060f100 GetProcAddress
EAT(Export Address Table) is none