ScreenShot
| Created | 2023.04.11 17:52 | Machine | s1_win7_x6401 |
| Filename | windows.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 33 detected (malicious, high confidence, score, Save, confidence, Jaik, Attribute, HighConfidence, GenKryptik, GIMV, CrypterX, RedLineSteal, illkg, moderate, RedLineStealer, Cordimik, X6N31H, Detected, Katusha, ai score=80, unsafe, wqFH5EZ1GkN, Strab, PossibleThreat) | ||
| md5 | ebc9000c9233ce8d2f0ec1d81ea6dfd5 | ||
| sha256 | b939788848ec0367f91d9bd3ffb17f9de4b0b7bd2c94dfc79212ea1d79e6c3c5 | ||
| ssdeep | 3072:6+AnkTCmphR48m3vPyVuyubmC7z0A2A1P59fFZ9mqwS+Tdgk5Ju9u1POY7oT9fxV:6+AnGk8YxRz04PTfFZQqwLOutpol | ||
| imphash | c5cafc3cd56661be310b19febc40278e | ||
| impfuzzy | 24:5vlGTwDZk2+fcMMjOovBt5lwGJ33QFQHRyvnRT4YjMZEZr9WAEUKxt3dATGECwQi:FH+fcMMCKt4m3oRcGZ0AlKX3GTGECS | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 33 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks if process is being debugged by a debugger |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41c014 CreateFileA
0x41c018 FreeConsole
0x41c01c SetStdHandle
0x41c020 WriteConsoleW
0x41c024 GetConsoleOutputCP
0x41c028 WriteConsoleA
0x41c02c InitializeCriticalSectionAndSpinCount
0x41c030 MultiByteToWideChar
0x41c034 SetConsoleCtrlHandler
0x41c038 GetModuleHandleA
0x41c03c GetLocaleInfoW
0x41c040 GetProcAddress
0x41c044 InterlockedIncrement
0x41c048 InterlockedDecrement
0x41c04c Sleep
0x41c050 InitializeCriticalSection
0x41c054 DeleteCriticalSection
0x41c058 EnterCriticalSection
0x41c05c LeaveCriticalSection
0x41c060 RtlUnwind
0x41c064 RaiseException
0x41c068 GetCommandLineA
0x41c06c TerminateProcess
0x41c070 GetCurrentProcess
0x41c074 UnhandledExceptionFilter
0x41c078 SetUnhandledExceptionFilter
0x41c07c IsDebuggerPresent
0x41c080 GetLastError
0x41c084 HeapFree
0x41c088 LCMapStringA
0x41c08c WideCharToMultiByte
0x41c090 LCMapStringW
0x41c094 GetCPInfo
0x41c098 GetModuleHandleW
0x41c09c TlsGetValue
0x41c0a0 TlsAlloc
0x41c0a4 TlsSetValue
0x41c0a8 TlsFree
0x41c0ac SetLastError
0x41c0b0 GetCurrentThreadId
0x41c0b4 HeapAlloc
0x41c0b8 ExitProcess
0x41c0bc WriteFile
0x41c0c0 GetStdHandle
0x41c0c4 GetModuleFileNameA
0x41c0c8 FreeEnvironmentStringsA
0x41c0cc GetEnvironmentStrings
0x41c0d0 FreeEnvironmentStringsW
0x41c0d4 GetEnvironmentStringsW
0x41c0d8 SetHandleCount
0x41c0dc GetFileType
0x41c0e0 GetStartupInfoA
0x41c0e4 HeapCreate
0x41c0e8 VirtualFree
0x41c0ec QueryPerformanceCounter
0x41c0f0 GetTickCount
0x41c0f4 GetCurrentProcessId
0x41c0f8 GetSystemTimeAsFileTime
0x41c0fc VirtualAlloc
0x41c100 HeapReAlloc
0x41c104 GetConsoleCP
0x41c108 GetConsoleMode
0x41c10c FlushFileBuffers
0x41c110 ReadFile
0x41c114 SetFilePointer
0x41c118 CloseHandle
0x41c11c HeapSize
0x41c120 GetACP
0x41c124 GetOEMCP
0x41c128 IsValidCodePage
0x41c12c GetLocaleInfoA
0x41c130 GetStringTypeA
0x41c134 GetStringTypeW
0x41c138 GetUserDefaultLCID
0x41c13c EnumSystemLocalesA
0x41c140 IsValidLocale
0x41c144 LoadLibraryA
USER32.dll
0x41c14c CreateWindowExA
0x41c150 ShowWindow
0x41c154 SendMessageA
0x41c158 GetMessageA
0x41c15c TranslateMessage
0x41c160 DispatchMessageA
0x41c164 GetDlgCtrlID
0x41c168 GetWindowTextA
0x41c16c MessageBoxA
GDI32.dll
0x41c00c CreateFontA
COMDLG32.dll
0x41c000 GetSaveFileNameA
0x41c004 GetOpenFileNameA
EAT(Export Address Table) is none
KERNEL32.dll
0x41c014 CreateFileA
0x41c018 FreeConsole
0x41c01c SetStdHandle
0x41c020 WriteConsoleW
0x41c024 GetConsoleOutputCP
0x41c028 WriteConsoleA
0x41c02c InitializeCriticalSectionAndSpinCount
0x41c030 MultiByteToWideChar
0x41c034 SetConsoleCtrlHandler
0x41c038 GetModuleHandleA
0x41c03c GetLocaleInfoW
0x41c040 GetProcAddress
0x41c044 InterlockedIncrement
0x41c048 InterlockedDecrement
0x41c04c Sleep
0x41c050 InitializeCriticalSection
0x41c054 DeleteCriticalSection
0x41c058 EnterCriticalSection
0x41c05c LeaveCriticalSection
0x41c060 RtlUnwind
0x41c064 RaiseException
0x41c068 GetCommandLineA
0x41c06c TerminateProcess
0x41c070 GetCurrentProcess
0x41c074 UnhandledExceptionFilter
0x41c078 SetUnhandledExceptionFilter
0x41c07c IsDebuggerPresent
0x41c080 GetLastError
0x41c084 HeapFree
0x41c088 LCMapStringA
0x41c08c WideCharToMultiByte
0x41c090 LCMapStringW
0x41c094 GetCPInfo
0x41c098 GetModuleHandleW
0x41c09c TlsGetValue
0x41c0a0 TlsAlloc
0x41c0a4 TlsSetValue
0x41c0a8 TlsFree
0x41c0ac SetLastError
0x41c0b0 GetCurrentThreadId
0x41c0b4 HeapAlloc
0x41c0b8 ExitProcess
0x41c0bc WriteFile
0x41c0c0 GetStdHandle
0x41c0c4 GetModuleFileNameA
0x41c0c8 FreeEnvironmentStringsA
0x41c0cc GetEnvironmentStrings
0x41c0d0 FreeEnvironmentStringsW
0x41c0d4 GetEnvironmentStringsW
0x41c0d8 SetHandleCount
0x41c0dc GetFileType
0x41c0e0 GetStartupInfoA
0x41c0e4 HeapCreate
0x41c0e8 VirtualFree
0x41c0ec QueryPerformanceCounter
0x41c0f0 GetTickCount
0x41c0f4 GetCurrentProcessId
0x41c0f8 GetSystemTimeAsFileTime
0x41c0fc VirtualAlloc
0x41c100 HeapReAlloc
0x41c104 GetConsoleCP
0x41c108 GetConsoleMode
0x41c10c FlushFileBuffers
0x41c110 ReadFile
0x41c114 SetFilePointer
0x41c118 CloseHandle
0x41c11c HeapSize
0x41c120 GetACP
0x41c124 GetOEMCP
0x41c128 IsValidCodePage
0x41c12c GetLocaleInfoA
0x41c130 GetStringTypeA
0x41c134 GetStringTypeW
0x41c138 GetUserDefaultLCID
0x41c13c EnumSystemLocalesA
0x41c140 IsValidLocale
0x41c144 LoadLibraryA
USER32.dll
0x41c14c CreateWindowExA
0x41c150 ShowWindow
0x41c154 SendMessageA
0x41c158 GetMessageA
0x41c15c TranslateMessage
0x41c160 DispatchMessageA
0x41c164 GetDlgCtrlID
0x41c168 GetWindowTextA
0x41c16c MessageBoxA
GDI32.dll
0x41c00c CreateFontA
COMDLG32.dll
0x41c000 GetSaveFileNameA
0x41c004 GetOpenFileNameA
EAT(Export Address Table) is none