ScreenShot
| Created | 2023.03.23 13:25 | Machine | s1_win7_x6403 |
| Filename | Firefox1.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (Zenpak, DownLoader7, Zusy, Rozena, Viyf, malicious, confidence, 100%, ZexaF, dqW@ayveWhoi, Genus, ABRisk, DEET, Attribute, HighConfidence, moderate confidence, score, ccmw, Yimw, R002C0DCM23, Artemis, alimm, aexkw, ai score=84, Detected, BScope, Generic@AI, RDML, pi7A+OY26Z4YlhNMNuFxMQ, Slenfbot, Chgt) | ||
| md5 | 77d8ff584c4a6be6e927107aa7aa813b | ||
| sha256 | d8163bf2b105cf122924ad6d1e0e03331bbf8e9f4b8f81688f210d825587c141 | ||
| ssdeep | 384:SGdNcvxQvum6teBIUaHe7+j2Hk94IdcbQuqTZRUJM4AgRFgYjPlJf7jXOuoBqz6d:SacvKbBz7+pdOM3TCqNWPvfv+VNEtQ5 | ||
| imphash | aca77bb36f4ee9dc931c40d10b8cabe8 | ||
| impfuzzy | 24:jOovnZt6DWQFQjERyvDh/J3IeRT4RfLpYTG:Cet1LDjhcRfFYTG | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Repeatedly searches for a not-found process |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| info | Checks amount of memory in system |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x408000 GetCommandLineA
0x408004 HeapFree
0x408008 GetVersionExA
0x40800c HeapAlloc
0x408010 GetProcessHeap
0x408014 TerminateProcess
0x408018 GetCurrentProcess
0x40801c UnhandledExceptionFilter
0x408020 SetUnhandledExceptionFilter
0x408024 IsDebuggerPresent
0x408028 GetProcAddress
0x40802c GetModuleHandleA
0x408030 ExitProcess
0x408034 WriteFile
0x408038 GetStdHandle
0x40803c GetModuleFileNameA
0x408040 FreeEnvironmentStringsA
0x408044 GetEnvironmentStrings
0x408048 FreeEnvironmentStringsW
0x40804c WideCharToMultiByte
0x408050 GetLastError
0x408054 GetEnvironmentStringsW
0x408058 SetHandleCount
0x40805c GetFileType
0x408060 GetStartupInfoA
0x408064 DeleteCriticalSection
0x408068 TlsGetValue
0x40806c TlsAlloc
0x408070 TlsSetValue
0x408074 TlsFree
0x408078 InterlockedIncrement
0x40807c SetLastError
0x408080 GetCurrentThreadId
0x408084 InterlockedDecrement
0x408088 HeapDestroy
0x40808c HeapCreate
0x408090 VirtualFree
0x408094 QueryPerformanceCounter
0x408098 GetTickCount
0x40809c GetCurrentProcessId
0x4080a0 GetSystemTimeAsFileTime
0x4080a4 LeaveCriticalSection
0x4080a8 EnterCriticalSection
0x4080ac LoadLibraryA
0x4080b0 InitializeCriticalSection
0x4080b4 Sleep
0x4080b8 GetCPInfo
0x4080bc GetACP
0x4080c0 GetOEMCP
0x4080c4 VirtualAlloc
0x4080c8 HeapReAlloc
0x4080cc RtlUnwind
0x4080d0 HeapSize
0x4080d4 MultiByteToWideChar
0x4080d8 GetLocaleInfoA
0x4080dc LCMapStringA
0x4080e0 LCMapStringW
0x4080e4 GetStringTypeA
0x4080e8 GetStringTypeW
EAT(Export Address Table) is none
KERNEL32.dll
0x408000 GetCommandLineA
0x408004 HeapFree
0x408008 GetVersionExA
0x40800c HeapAlloc
0x408010 GetProcessHeap
0x408014 TerminateProcess
0x408018 GetCurrentProcess
0x40801c UnhandledExceptionFilter
0x408020 SetUnhandledExceptionFilter
0x408024 IsDebuggerPresent
0x408028 GetProcAddress
0x40802c GetModuleHandleA
0x408030 ExitProcess
0x408034 WriteFile
0x408038 GetStdHandle
0x40803c GetModuleFileNameA
0x408040 FreeEnvironmentStringsA
0x408044 GetEnvironmentStrings
0x408048 FreeEnvironmentStringsW
0x40804c WideCharToMultiByte
0x408050 GetLastError
0x408054 GetEnvironmentStringsW
0x408058 SetHandleCount
0x40805c GetFileType
0x408060 GetStartupInfoA
0x408064 DeleteCriticalSection
0x408068 TlsGetValue
0x40806c TlsAlloc
0x408070 TlsSetValue
0x408074 TlsFree
0x408078 InterlockedIncrement
0x40807c SetLastError
0x408080 GetCurrentThreadId
0x408084 InterlockedDecrement
0x408088 HeapDestroy
0x40808c HeapCreate
0x408090 VirtualFree
0x408094 QueryPerformanceCounter
0x408098 GetTickCount
0x40809c GetCurrentProcessId
0x4080a0 GetSystemTimeAsFileTime
0x4080a4 LeaveCriticalSection
0x4080a8 EnterCriticalSection
0x4080ac LoadLibraryA
0x4080b0 InitializeCriticalSection
0x4080b4 Sleep
0x4080b8 GetCPInfo
0x4080bc GetACP
0x4080c0 GetOEMCP
0x4080c4 VirtualAlloc
0x4080c8 HeapReAlloc
0x4080cc RtlUnwind
0x4080d0 HeapSize
0x4080d4 MultiByteToWideChar
0x4080d8 GetLocaleInfoA
0x4080dc LCMapStringA
0x4080e0 LCMapStringW
0x4080e4 GetStringTypeA
0x4080e8 GetStringTypeW
EAT(Export Address Table) is none