ScreenShot
| Created | 2023.04.11 15:26 | Machine | s1_win7_x6403 |
| Filename | ap3b.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 45 detected (malicious, high confidence, score, GenericKD, Vhix, confidence, 100%, BackdoorX, ABRisk, ERJX, Attribute, HighConfidence, myunsh, X2bE3GplYK, AGEN, PRIVATELOADER, YXDDFZ, Static AI, Suspicious PE, ai score=84, Sabsik, Tiggre, Detected, unsafe, Psmw) | ||
| md5 | 2f2354202272c2848ca7c2ac18794703 | ||
| sha256 | e3ca0aef57fe55a74ad6447da1cdc694f34f5421fec760beb6c731641ae778ab | ||
| ssdeep | 24576:uotX+0WEP/j2Bbz20UrjRQ/PYuJDATac+sHpB9:Twcgzgvm/gSsZpB9 | ||
| imphash | 5f3daafabbcb520fe4d1131686c696b1 | ||
| impfuzzy | 24:D2ty8vTLWYgMyWNwyWPWUbyKLSQaBSJCybJLocADfzABAihOvAK4Tg9ZyBb+u5F3:6ty8vVNgVtLSQ391GVyBSM | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 45 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140003000 SetHandleInformation
0x140003008 WriteFile
0x140003010 GetModuleFileNameW
0x140003018 CreatePipe
0x140003020 CloseHandle
0x140003028 CreateProcessW
0x140003030 RtlLookupFunctionEntry
0x140003038 RtlVirtualUnwind
0x140003040 UnhandledExceptionFilter
0x140003048 SetUnhandledExceptionFilter
0x140003050 GetCurrentProcess
0x140003058 TerminateProcess
0x140003060 GetModuleHandleW
0x140003068 GetStartupInfoW
0x140003070 IsDebuggerPresent
0x140003078 InitializeSListHead
0x140003080 GetSystemTimeAsFileTime
0x140003088 GetCurrentThreadId
0x140003090 GetCurrentProcessId
0x140003098 QueryPerformanceCounter
0x1400030a0 IsProcessorFeaturePresent
0x1400030a8 RtlCaptureContext
VCRUNTIME140.dll
0x1400030b8 __C_specific_handler
0x1400030c0 __current_exception
0x1400030c8 __current_exception_context
0x1400030d0 memset
0x1400030d8 memcpy
api-ms-win-crt-stdio-l1-1-0.dll
0x1400031a0 __stdio_common_vswprintf
0x1400031a8 __p__commode
0x1400031b0 _set_fmode
api-ms-win-crt-runtime-l1-1-0.dll
0x140003118 _seh_filter_exe
0x140003120 _register_onexit_function
0x140003128 terminate
0x140003130 _crt_atexit
0x140003138 _register_thread_local_exe_atexit_callback
0x140003140 _c_exit
0x140003148 _cexit
0x140003150 _set_app_type
0x140003158 _exit
0x140003160 exit
0x140003168 _initterm_e
0x140003170 _initterm
0x140003178 _get_narrow_winmain_command_line
0x140003180 _initialize_narrow_environment
0x140003188 _configure_narrow_argv
0x140003190 _initialize_onexit_table
api-ms-win-crt-math-l1-1-0.dll
0x140003108 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x1400030f8 _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll
0x1400030e8 _set_new_mode
EAT(Export Address Table) is none
KERNEL32.dll
0x140003000 SetHandleInformation
0x140003008 WriteFile
0x140003010 GetModuleFileNameW
0x140003018 CreatePipe
0x140003020 CloseHandle
0x140003028 CreateProcessW
0x140003030 RtlLookupFunctionEntry
0x140003038 RtlVirtualUnwind
0x140003040 UnhandledExceptionFilter
0x140003048 SetUnhandledExceptionFilter
0x140003050 GetCurrentProcess
0x140003058 TerminateProcess
0x140003060 GetModuleHandleW
0x140003068 GetStartupInfoW
0x140003070 IsDebuggerPresent
0x140003078 InitializeSListHead
0x140003080 GetSystemTimeAsFileTime
0x140003088 GetCurrentThreadId
0x140003090 GetCurrentProcessId
0x140003098 QueryPerformanceCounter
0x1400030a0 IsProcessorFeaturePresent
0x1400030a8 RtlCaptureContext
VCRUNTIME140.dll
0x1400030b8 __C_specific_handler
0x1400030c0 __current_exception
0x1400030c8 __current_exception_context
0x1400030d0 memset
0x1400030d8 memcpy
api-ms-win-crt-stdio-l1-1-0.dll
0x1400031a0 __stdio_common_vswprintf
0x1400031a8 __p__commode
0x1400031b0 _set_fmode
api-ms-win-crt-runtime-l1-1-0.dll
0x140003118 _seh_filter_exe
0x140003120 _register_onexit_function
0x140003128 terminate
0x140003130 _crt_atexit
0x140003138 _register_thread_local_exe_atexit_callback
0x140003140 _c_exit
0x140003148 _cexit
0x140003150 _set_app_type
0x140003158 _exit
0x140003160 exit
0x140003168 _initterm_e
0x140003170 _initterm
0x140003178 _get_narrow_winmain_command_line
0x140003180 _initialize_narrow_environment
0x140003188 _configure_narrow_argv
0x140003190 _initialize_onexit_table
api-ms-win-crt-math-l1-1-0.dll
0x140003108 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x1400030f8 _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll
0x1400030e8 _set_new_mode
EAT(Export Address Table) is none