ScreenShot
| Created | 2023.03.09 10:34 | Machine | s1_win7_x6401 |
| Filename | office.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 42 detected (AIDetectNet, malicious, high confidence, score, Zusy, Save, confidence, 100%, Attribute, HighConfidence, Kryptik, HSUP, Stop, CrypterX, Krypt, Lockbit, high, Azorult, agih, ZPACK, Gen2, ai score=87, StopCrypt, Detected, Buzus, unsafe, CLASSIC, Static AI, Malicious PE, susgen, GenKryptik, HSUL) | ||
| md5 | 4a39e396ddbd9c7116858b6f96a06eb2 | ||
| sha256 | b7318a38055034579cfb6799fd2cb264a6ef1a9f5d6952970474e4139374ef73 | ||
| ssdeep | 24576:mFsLW3eGfYYrd+z9tEdnJkQ8D9rgf2UhxVgnj20E+3b+sC5E2B7K1X42tdYyTr6i:BLWuMrpP8D98XYqY36sCFK1I2tqu2T47 | ||
| imphash | 5a95fc1207ce8743cd9161ce41436aa4 | ||
| impfuzzy | 48:nYbcJFJ9dfgl1D6PhUDftBd0ZcHvLAvSQAwSYGAGKz:nVJ/fgl56PhiftBdscHvLcF | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 42 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x401000 GetCPInfo
0x401004 GetConsoleAliasExesLengthA
0x401008 DeleteVolumeMountPointA
0x40100c EndUpdateResourceW
0x401010 MoveFileExW
0x401014 GlobalSize
0x401018 GetModuleHandleExW
0x40101c InterlockedCompareExchange
0x401020 WriteConsoleInputA
0x401024 FindNextVolumeMountPointA
0x401028 GetConsoleAliasesA
0x40102c GetWindowsDirectoryA
0x401030 CreateActCtxW
0x401034 Sleep
0x401038 GetConsoleAliasExesLengthW
0x40103c GetVersionExW
0x401040 CreateSemaphoreA
0x401044 GetFileAttributesW
0x401048 GetBinaryTypeA
0x40104c GetThreadPriorityBoost
0x401050 RaiseException
0x401054 CreateJobObjectA
0x401058 InterlockedExchange
0x40105c GetLastError
0x401060 GetProcAddress
0x401064 VirtualAlloc
0x401068 EnterCriticalSection
0x40106c GetDiskFreeSpaceW
0x401070 OpenWaitableTimerA
0x401074 LoadLibraryA
0x401078 WriteConsoleA
0x40107c LocalAlloc
0x401080 RemoveDirectoryW
0x401084 QueryDosDeviceW
0x401088 SetProcessWorkingSetSize
0x40108c OpenJobObjectW
0x401090 FindAtomA
0x401094 Module32FirstW
0x401098 GetModuleHandleA
0x40109c GetStringTypeW
0x4010a0 EnumDateFormatsW
0x4010a4 SetFileShortNameA
0x4010a8 GetVersionExA
0x4010ac CreateFileA
0x4010b0 CloseHandle
0x4010b4 GetModuleHandleW
0x4010b8 ExitProcess
0x4010bc GetStartupInfoW
0x4010c0 HeapAlloc
0x4010c4 HeapFree
0x4010c8 LeaveCriticalSection
0x4010cc SetHandleCount
0x4010d0 GetStdHandle
0x4010d4 GetFileType
0x4010d8 GetStartupInfoA
0x4010dc DeleteCriticalSection
0x4010e0 TerminateProcess
0x4010e4 GetCurrentProcess
0x4010e8 UnhandledExceptionFilter
0x4010ec SetUnhandledExceptionFilter
0x4010f0 IsDebuggerPresent
0x4010f4 TlsGetValue
0x4010f8 TlsAlloc
0x4010fc TlsSetValue
0x401100 TlsFree
0x401104 InterlockedIncrement
0x401108 SetLastError
0x40110c GetCurrentThreadId
0x401110 InterlockedDecrement
0x401114 WriteFile
0x401118 GetModuleFileNameA
0x40111c InitializeCriticalSectionAndSpinCount
0x401120 GetModuleFileNameW
0x401124 FreeEnvironmentStringsW
0x401128 GetEnvironmentStringsW
0x40112c GetCommandLineW
0x401130 HeapCreate
0x401134 VirtualFree
0x401138 QueryPerformanceCounter
0x40113c GetTickCount
0x401140 GetCurrentProcessId
0x401144 GetSystemTimeAsFileTime
0x401148 HeapReAlloc
0x40114c SetFilePointer
0x401150 WideCharToMultiByte
0x401154 GetConsoleCP
0x401158 GetConsoleMode
0x40115c RtlUnwind
0x401160 GetACP
0x401164 GetOEMCP
0x401168 IsValidCodePage
0x40116c HeapSize
0x401170 GetLocaleInfoA
0x401174 FlushFileBuffers
0x401178 SetStdHandle
0x40117c GetConsoleOutputCP
0x401180 WriteConsoleW
0x401184 MultiByteToWideChar
0x401188 LCMapStringA
0x40118c LCMapStringW
0x401190 GetStringTypeA
USER32.dll
0x401198 LoadMenuA
0x40119c CharLowerBuffW
0x4011a0 CopyAcceleratorTableA
0x4011a4 LoadIconW
0x4011a8 GetSysColorBrush
0x4011ac GetMenuInfo
0x4011b0 SetCaretPos
0x4011b4 GetCaretBlinkTime
EAT(Export Address Table) is none
KERNEL32.dll
0x401000 GetCPInfo
0x401004 GetConsoleAliasExesLengthA
0x401008 DeleteVolumeMountPointA
0x40100c EndUpdateResourceW
0x401010 MoveFileExW
0x401014 GlobalSize
0x401018 GetModuleHandleExW
0x40101c InterlockedCompareExchange
0x401020 WriteConsoleInputA
0x401024 FindNextVolumeMountPointA
0x401028 GetConsoleAliasesA
0x40102c GetWindowsDirectoryA
0x401030 CreateActCtxW
0x401034 Sleep
0x401038 GetConsoleAliasExesLengthW
0x40103c GetVersionExW
0x401040 CreateSemaphoreA
0x401044 GetFileAttributesW
0x401048 GetBinaryTypeA
0x40104c GetThreadPriorityBoost
0x401050 RaiseException
0x401054 CreateJobObjectA
0x401058 InterlockedExchange
0x40105c GetLastError
0x401060 GetProcAddress
0x401064 VirtualAlloc
0x401068 EnterCriticalSection
0x40106c GetDiskFreeSpaceW
0x401070 OpenWaitableTimerA
0x401074 LoadLibraryA
0x401078 WriteConsoleA
0x40107c LocalAlloc
0x401080 RemoveDirectoryW
0x401084 QueryDosDeviceW
0x401088 SetProcessWorkingSetSize
0x40108c OpenJobObjectW
0x401090 FindAtomA
0x401094 Module32FirstW
0x401098 GetModuleHandleA
0x40109c GetStringTypeW
0x4010a0 EnumDateFormatsW
0x4010a4 SetFileShortNameA
0x4010a8 GetVersionExA
0x4010ac CreateFileA
0x4010b0 CloseHandle
0x4010b4 GetModuleHandleW
0x4010b8 ExitProcess
0x4010bc GetStartupInfoW
0x4010c0 HeapAlloc
0x4010c4 HeapFree
0x4010c8 LeaveCriticalSection
0x4010cc SetHandleCount
0x4010d0 GetStdHandle
0x4010d4 GetFileType
0x4010d8 GetStartupInfoA
0x4010dc DeleteCriticalSection
0x4010e0 TerminateProcess
0x4010e4 GetCurrentProcess
0x4010e8 UnhandledExceptionFilter
0x4010ec SetUnhandledExceptionFilter
0x4010f0 IsDebuggerPresent
0x4010f4 TlsGetValue
0x4010f8 TlsAlloc
0x4010fc TlsSetValue
0x401100 TlsFree
0x401104 InterlockedIncrement
0x401108 SetLastError
0x40110c GetCurrentThreadId
0x401110 InterlockedDecrement
0x401114 WriteFile
0x401118 GetModuleFileNameA
0x40111c InitializeCriticalSectionAndSpinCount
0x401120 GetModuleFileNameW
0x401124 FreeEnvironmentStringsW
0x401128 GetEnvironmentStringsW
0x40112c GetCommandLineW
0x401130 HeapCreate
0x401134 VirtualFree
0x401138 QueryPerformanceCounter
0x40113c GetTickCount
0x401140 GetCurrentProcessId
0x401144 GetSystemTimeAsFileTime
0x401148 HeapReAlloc
0x40114c SetFilePointer
0x401150 WideCharToMultiByte
0x401154 GetConsoleCP
0x401158 GetConsoleMode
0x40115c RtlUnwind
0x401160 GetACP
0x401164 GetOEMCP
0x401168 IsValidCodePage
0x40116c HeapSize
0x401170 GetLocaleInfoA
0x401174 FlushFileBuffers
0x401178 SetStdHandle
0x40117c GetConsoleOutputCP
0x401180 WriteConsoleW
0x401184 MultiByteToWideChar
0x401188 LCMapStringA
0x40118c LCMapStringW
0x401190 GetStringTypeA
USER32.dll
0x401198 LoadMenuA
0x40119c CharLowerBuffW
0x4011a0 CopyAcceleratorTableA
0x4011a4 LoadIconW
0x4011a8 GetSysColorBrush
0x4011ac GetMenuInfo
0x4011b0 SetCaretPos
0x4011b4 GetCaretBlinkTime
EAT(Export Address Table) is none