ScreenShot
| Created | 2023.04.13 09:15 | Machine | s1_win7_x6402 |
| Filename | （电-子--发-票）.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 44 detected (l9y2, GenericKD, Artemis, malicious, confidence, ZexaF, cq0@aKhXH5cb, Attribute, HighConfidence, high confidence, score, Oader, Hkjl, tyixa, moderate, ai score=85, Wacatac, 1GWZCU, Detected, BScope, TrojanPSW, Panda, unsafe, R002H0DD623, i0f1n8j0TET) | ||
| md5 | d06c243962c54d2763c2ffb8b16208e9 | ||
| sha256 | 9735de6f7e65882eb34df781669bda22ca6aaf86ffe1a23821a3d2951d27780d | ||
| ssdeep | 384:rT9fLOVVThwgyO3MuGfJOtP2i1McPDd7MlSN7idOR5Zw7QSc:loCggJOt+i15Pp7nNGORvr | ||
| imphash | a99bb2525c7a5684028f67b9c34884da | ||
| impfuzzy | 48:o1IEDC7SOSQf1GL7MiMc/JX5Fk3fSQ+x02GU4ECK:oTCOQf1GLU2Xa+RGa | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 44 AntiVirus engines on VirusTotal as malicious |
| notice | Foreign language identified in PE resource |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| info | The executable uses a known packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
MFC42.DLL
0x403038 None
0x40303c None
0x403040 None
0x403044 None
0x403048 None
0x40304c None
0x403050 None
0x403054 None
0x403058 None
0x40305c None
0x403060 None
0x403064 None
0x403068 None
0x40306c None
0x403070 None
0x403074 None
0x403078 None
0x40307c None
0x403080 None
0x403084 None
0x403088 None
0x40308c None
0x403090 None
0x403094 None
0x403098 None
0x40309c None
0x4030a0 None
0x4030a4 None
0x4030a8 None
0x4030ac None
0x4030b0 None
0x4030b4 None
0x4030b8 None
0x4030bc None
0x4030c0 None
0x4030c4 None
0x4030c8 None
0x4030cc None
0x4030d0 None
0x4030d4 None
0x4030d8 None
0x4030dc None
0x4030e0 None
0x4030e4 None
0x4030e8 None
0x4030ec None
0x4030f0 None
0x4030f4 None
0x4030f8 None
0x4030fc None
0x403100 None
0x403104 None
0x403108 None
0x40310c None
0x403110 None
0x403114 None
0x403118 None
0x40311c None
0x403120 None
0x403124 None
0x403128 None
0x40312c None
0x403130 None
0x403134 None
0x403138 None
0x40313c None
0x403140 None
0x403144 None
0x403148 None
0x40314c None
0x403150 None
0x403154 None
0x403158 None
0x40315c None
0x403160 None
0x403164 None
0x403168 None
0x40316c None
0x403170 None
0x403174 None
0x403178 None
0x40317c None
0x403180 None
0x403184 None
0x403188 None
0x40318c None
0x403190 None
0x403194 None
0x403198 None
0x40319c None
0x4031a0 None
0x4031a4 None
0x4031a8 None
0x4031ac None
0x4031b0 None
0x4031b4 None
0x4031b8 None
0x4031bc None
0x4031c0 None
0x4031c4 None
0x4031c8 None
0x4031cc None
0x4031d0 None
0x4031d4 None
0x4031d8 None
0x4031dc None
0x4031e0 None
0x4031e4 None
0x4031e8 None
0x4031ec None
0x4031f0 None
0x4031f4 None
0x4031f8 None
0x4031fc None
0x403200 None
0x403204 None
0x403208 None
0x40320c None
0x403210 None
0x403214 None
0x403218 None
0x40321c None
0x403220 None
0x403224 None
0x403228 None
0x40322c None
0x403230 None
0x403234 None
0x403238 None
0x40323c None
0x403240 None
0x403244 None
0x403248 None
0x40324c None
0x403250 None
0x403254 None
0x403258 None
0x40325c None
0x403260 None
0x403264 None
0x403268 None
0x40326c None
0x403270 None
0x403274 None
0x403278 None
0x40327c None
0x403280 None
0x403284 None
0x403288 None
0x40328c None
0x403290 None
0x403294 None
0x403298 None
0x40329c None
0x4032a0 None
0x4032a4 None
0x4032a8 None
0x4032ac None
0x4032b0 None
0x4032b4 None
0x4032b8 None
0x4032bc None
0x4032c0 None
0x4032c4 None
0x4032c8 None
0x4032cc None
0x4032d0 None
0x4032d4 None
0x4032d8 None
0x4032dc None
0x4032e0 None
0x4032e4 None
0x4032e8 None
0x4032ec None
0x4032f0 None
0x4032f4 None
0x4032f8 None
0x4032fc None
0x403300 None
0x403304 None
0x403308 None
0x40330c None
0x403310 None
0x403314 None
0x403318 None
0x40331c None
0x403320 None
0x403324 None
0x403328 None
0x40332c None
0x403330 None
0x403334 None
0x403338 None
0x40333c None
0x403340 None
0x403344 None
0x403348 None
0x40334c None
0x403350 None
0x403354 None
0x403358 None
0x40335c None
0x403360 None
0x403364 None
0x403368 None
0x40336c None
0x403370 None
0x403374 None
0x403378 None
0x40337c None
MSVCRT.dll
0x403384 _controlfp
0x403388 _except_handler3
0x40338c __set_app_type
0x403390 __p__fmode
0x403394 __p__commode
0x403398 _adjust_fdiv
0x40339c __setusermatherr
0x4033a0 _initterm
0x4033a4 __getmainargs
0x4033a8 _acmdln
0x4033ac _XcptFilter
0x4033b0 exit
0x4033b4 _setmbcp
0x4033b8 __CxxFrameHandler
0x4033bc __dllonexit
0x4033c0 _exit
0x4033c4 _onexit
KERNEL32.dll
0x403010 CreateDirectoryA
0x403014 GetProcAddress
0x403018 GetStartupInfoA
0x40301c CreateToolhelp32Snapshot
0x403020 Process32First
0x403024 GetModuleHandleA
0x403028 LoadLibraryA
0x40302c CloseHandle
0x403030 Process32Next
USER32.dll
0x4033cc GetDC
0x4033d0 EnableWindow
0x4033d4 UpdateWindow
0x4033d8 LoadImageA
GDI32.dll
0x403000 GetObjectA
0x403004 BitBlt
0x403008 CreateCompatibleDC
WININET.dll
0x4033e0 DeleteUrlCacheEntry
EAT(Export Address Table) is none
MFC42.DLL
0x403038 None
0x40303c None
0x403040 None
0x403044 None
0x403048 None
0x40304c None
0x403050 None
0x403054 None
0x403058 None
0x40305c None
0x403060 None
0x403064 None
0x403068 None
0x40306c None
0x403070 None
0x403074 None
0x403078 None
0x40307c None
0x403080 None
0x403084 None
0x403088 None
0x40308c None
0x403090 None
0x403094 None
0x403098 None
0x40309c None
0x4030a0 None
0x4030a4 None
0x4030a8 None
0x4030ac None
0x4030b0 None
0x4030b4 None
0x4030b8 None
0x4030bc None
0x4030c0 None
0x4030c4 None
0x4030c8 None
0x4030cc None
0x4030d0 None
0x4030d4 None
0x4030d8 None
0x4030dc None
0x4030e0 None
0x4030e4 None
0x4030e8 None
0x4030ec None
0x4030f0 None
0x4030f4 None
0x4030f8 None
0x4030fc None
0x403100 None
0x403104 None
0x403108 None
0x40310c None
0x403110 None
0x403114 None
0x403118 None
0x40311c None
0x403120 None
0x403124 None
0x403128 None
0x40312c None
0x403130 None
0x403134 None
0x403138 None
0x40313c None
0x403140 None
0x403144 None
0x403148 None
0x40314c None
0x403150 None
0x403154 None
0x403158 None
0x40315c None
0x403160 None
0x403164 None
0x403168 None
0x40316c None
0x403170 None
0x403174 None
0x403178 None
0x40317c None
0x403180 None
0x403184 None
0x403188 None
0x40318c None
0x403190 None
0x403194 None
0x403198 None
0x40319c None
0x4031a0 None
0x4031a4 None
0x4031a8 None
0x4031ac None
0x4031b0 None
0x4031b4 None
0x4031b8 None
0x4031bc None
0x4031c0 None
0x4031c4 None
0x4031c8 None
0x4031cc None
0x4031d0 None
0x4031d4 None
0x4031d8 None
0x4031dc None
0x4031e0 None
0x4031e4 None
0x4031e8 None
0x4031ec None
0x4031f0 None
0x4031f4 None
0x4031f8 None
0x4031fc None
0x403200 None
0x403204 None
0x403208 None
0x40320c None
0x403210 None
0x403214 None
0x403218 None
0x40321c None
0x403220 None
0x403224 None
0x403228 None
0x40322c None
0x403230 None
0x403234 None
0x403238 None
0x40323c None
0x403240 None
0x403244 None
0x403248 None
0x40324c None
0x403250 None
0x403254 None
0x403258 None
0x40325c None
0x403260 None
0x403264 None
0x403268 None
0x40326c None
0x403270 None
0x403274 None
0x403278 None
0x40327c None
0x403280 None
0x403284 None
0x403288 None
0x40328c None
0x403290 None
0x403294 None
0x403298 None
0x40329c None
0x4032a0 None
0x4032a4 None
0x4032a8 None
0x4032ac None
0x4032b0 None
0x4032b4 None
0x4032b8 None
0x4032bc None
0x4032c0 None
0x4032c4 None
0x4032c8 None
0x4032cc None
0x4032d0 None
0x4032d4 None
0x4032d8 None
0x4032dc None
0x4032e0 None
0x4032e4 None
0x4032e8 None
0x4032ec None
0x4032f0 None
0x4032f4 None
0x4032f8 None
0x4032fc None
0x403300 None
0x403304 None
0x403308 None
0x40330c None
0x403310 None
0x403314 None
0x403318 None
0x40331c None
0x403320 None
0x403324 None
0x403328 None
0x40332c None
0x403330 None
0x403334 None
0x403338 None
0x40333c None
0x403340 None
0x403344 None
0x403348 None
0x40334c None
0x403350 None
0x403354 None
0x403358 None
0x40335c None
0x403360 None
0x403364 None
0x403368 None
0x40336c None
0x403370 None
0x403374 None
0x403378 None
0x40337c None
MSVCRT.dll
0x403384 _controlfp
0x403388 _except_handler3
0x40338c __set_app_type
0x403390 __p__fmode
0x403394 __p__commode
0x403398 _adjust_fdiv
0x40339c __setusermatherr
0x4033a0 _initterm
0x4033a4 __getmainargs
0x4033a8 _acmdln
0x4033ac _XcptFilter
0x4033b0 exit
0x4033b4 _setmbcp
0x4033b8 __CxxFrameHandler
0x4033bc __dllonexit
0x4033c0 _exit
0x4033c4 _onexit
KERNEL32.dll
0x403010 CreateDirectoryA
0x403014 GetProcAddress
0x403018 GetStartupInfoA
0x40301c CreateToolhelp32Snapshot
0x403020 Process32First
0x403024 GetModuleHandleA
0x403028 LoadLibraryA
0x40302c CloseHandle
0x403030 Process32Next
USER32.dll
0x4033cc GetDC
0x4033d0 EnableWindow
0x4033d4 UpdateWindow
0x4033d8 LoadImageA
GDI32.dll
0x403000 GetObjectA
0x403004 BitBlt
0x403008 CreateCompatibleDC
WININET.dll
0x4033e0 DeleteUrlCacheEntry
EAT(Export Address Table) is none