ScreenShot
| Created | 2023.04.13 09:33 | Machine | s1_win7_x6403 |
| Filename | xo.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 41 detected (malicious, high confidence, Zusy, Artemis, unsafe, confidence, Babar, Eldorado, Attribute, HighConfidence, Kryptik, HTHJ, CrypterX, FalseSign, Yfow, high, score, Cordimik, GTOMIA, RedLine, Aicat, Detected, Katusha, BScope, ai score=87, RedLineStealer, Genetic, Generic@AI, RDML, AsGiQv31gDQ+i, UO9zG9Kw, Strab, ZexaE, uq2@aKIypNai) | ||
| md5 | 18116ef04d182e14002d6d0928bf4283 | ||
| sha256 | fba662522184e09bb7d8a627fcc53832eae9ed93cd0dbacf8d161005ef5e99fc | ||
| ssdeep | 6144:pcwb2Ri1orQooWMmTdGY/DXYUxEjRavtloK/IcFlm:pcM2JrDTdFX5mwvDn/IcFU | ||
| imphash | 2284a2d8a1a144e12997e0416861622a | ||
| impfuzzy | 48:1fmdZ+fcMMZt2K83oRcVZtAlKX3GTGECS:1SZ+fcMMZtt83wcvtS | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 41 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| info | Checks if process is being debugged by a debugger |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f014 FreeConsole
0x41f018 CreateFileA
0x41f01c SetConsoleCtrlHandler
0x41f020 SetStdHandle
0x41f024 WriteConsoleW
0x41f028 GetConsoleOutputCP
0x41f02c WriteConsoleA
0x41f030 InitializeCriticalSectionAndSpinCount
0x41f034 MultiByteToWideChar
0x41f038 SetFileApisToOEM
0x41f03c GetModuleHandleA
0x41f040 GetLocaleInfoW
0x41f044 GetProcAddress
0x41f048 InterlockedIncrement
0x41f04c InterlockedDecrement
0x41f050 WideCharToMultiByte
0x41f054 Sleep
0x41f058 InterlockedExchange
0x41f05c InitializeCriticalSection
0x41f060 DeleteCriticalSection
0x41f064 EnterCriticalSection
0x41f068 LeaveCriticalSection
0x41f06c RtlUnwind
0x41f070 RaiseException
0x41f074 TerminateProcess
0x41f078 GetCurrentProcess
0x41f07c UnhandledExceptionFilter
0x41f080 SetUnhandledExceptionFilter
0x41f084 IsDebuggerPresent
0x41f088 GetCommandLineA
0x41f08c GetLastError
0x41f090 HeapFree
0x41f094 GetCPInfo
0x41f098 LCMapStringA
0x41f09c LCMapStringW
0x41f0a0 GetModuleHandleW
0x41f0a4 TlsGetValue
0x41f0a8 TlsAlloc
0x41f0ac TlsSetValue
0x41f0b0 TlsFree
0x41f0b4 SetLastError
0x41f0b8 GetCurrentThreadId
0x41f0bc HeapAlloc
0x41f0c0 ExitProcess
0x41f0c4 WriteFile
0x41f0c8 GetStdHandle
0x41f0cc GetModuleFileNameA
0x41f0d0 FreeEnvironmentStringsA
0x41f0d4 GetEnvironmentStrings
0x41f0d8 FreeEnvironmentStringsW
0x41f0dc GetEnvironmentStringsW
0x41f0e0 SetHandleCount
0x41f0e4 GetFileType
0x41f0e8 GetStartupInfoA
0x41f0ec HeapCreate
0x41f0f0 VirtualFree
0x41f0f4 QueryPerformanceCounter
0x41f0f8 GetTickCount
0x41f0fc GetCurrentProcessId
0x41f100 GetSystemTimeAsFileTime
0x41f104 VirtualAlloc
0x41f108 HeapReAlloc
0x41f10c GetConsoleCP
0x41f110 GetConsoleMode
0x41f114 FlushFileBuffers
0x41f118 ReadFile
0x41f11c SetFilePointer
0x41f120 CloseHandle
0x41f124 HeapSize
0x41f128 GetACP
0x41f12c GetOEMCP
0x41f130 IsValidCodePage
0x41f134 GetUserDefaultLCID
0x41f138 GetLocaleInfoA
0x41f13c EnumSystemLocalesA
0x41f140 IsValidLocale
0x41f144 GetStringTypeA
0x41f148 GetStringTypeW
0x41f14c LoadLibraryA
USER32.dll
0x41f154 CreateWindowExA
0x41f158 ShowWindow
0x41f15c SendMessageA
0x41f160 GetMessageA
0x41f164 TranslateMessage
0x41f168 DispatchMessageA
0x41f16c GetDlgCtrlID
0x41f170 GetWindowTextA
0x41f174 MessageBoxA
GDI32.dll
0x41f00c CreateFontA
COMDLG32.dll
0x41f000 GetSaveFileNameA
0x41f004 GetOpenFileNameA
EAT(Export Address Table) is none
KERNEL32.dll
0x41f014 FreeConsole
0x41f018 CreateFileA
0x41f01c SetConsoleCtrlHandler
0x41f020 SetStdHandle
0x41f024 WriteConsoleW
0x41f028 GetConsoleOutputCP
0x41f02c WriteConsoleA
0x41f030 InitializeCriticalSectionAndSpinCount
0x41f034 MultiByteToWideChar
0x41f038 SetFileApisToOEM
0x41f03c GetModuleHandleA
0x41f040 GetLocaleInfoW
0x41f044 GetProcAddress
0x41f048 InterlockedIncrement
0x41f04c InterlockedDecrement
0x41f050 WideCharToMultiByte
0x41f054 Sleep
0x41f058 InterlockedExchange
0x41f05c InitializeCriticalSection
0x41f060 DeleteCriticalSection
0x41f064 EnterCriticalSection
0x41f068 LeaveCriticalSection
0x41f06c RtlUnwind
0x41f070 RaiseException
0x41f074 TerminateProcess
0x41f078 GetCurrentProcess
0x41f07c UnhandledExceptionFilter
0x41f080 SetUnhandledExceptionFilter
0x41f084 IsDebuggerPresent
0x41f088 GetCommandLineA
0x41f08c GetLastError
0x41f090 HeapFree
0x41f094 GetCPInfo
0x41f098 LCMapStringA
0x41f09c LCMapStringW
0x41f0a0 GetModuleHandleW
0x41f0a4 TlsGetValue
0x41f0a8 TlsAlloc
0x41f0ac TlsSetValue
0x41f0b0 TlsFree
0x41f0b4 SetLastError
0x41f0b8 GetCurrentThreadId
0x41f0bc HeapAlloc
0x41f0c0 ExitProcess
0x41f0c4 WriteFile
0x41f0c8 GetStdHandle
0x41f0cc GetModuleFileNameA
0x41f0d0 FreeEnvironmentStringsA
0x41f0d4 GetEnvironmentStrings
0x41f0d8 FreeEnvironmentStringsW
0x41f0dc GetEnvironmentStringsW
0x41f0e0 SetHandleCount
0x41f0e4 GetFileType
0x41f0e8 GetStartupInfoA
0x41f0ec HeapCreate
0x41f0f0 VirtualFree
0x41f0f4 QueryPerformanceCounter
0x41f0f8 GetTickCount
0x41f0fc GetCurrentProcessId
0x41f100 GetSystemTimeAsFileTime
0x41f104 VirtualAlloc
0x41f108 HeapReAlloc
0x41f10c GetConsoleCP
0x41f110 GetConsoleMode
0x41f114 FlushFileBuffers
0x41f118 ReadFile
0x41f11c SetFilePointer
0x41f120 CloseHandle
0x41f124 HeapSize
0x41f128 GetACP
0x41f12c GetOEMCP
0x41f130 IsValidCodePage
0x41f134 GetUserDefaultLCID
0x41f138 GetLocaleInfoA
0x41f13c EnumSystemLocalesA
0x41f140 IsValidLocale
0x41f144 GetStringTypeA
0x41f148 GetStringTypeW
0x41f14c LoadLibraryA
USER32.dll
0x41f154 CreateWindowExA
0x41f158 ShowWindow
0x41f15c SendMessageA
0x41f160 GetMessageA
0x41f164 TranslateMessage
0x41f168 DispatchMessageA
0x41f16c GetDlgCtrlID
0x41f170 GetWindowTextA
0x41f174 MessageBoxA
GDI32.dll
0x41f00c CreateFontA
COMDLG32.dll
0x41f000 GetSaveFileNameA
0x41f004 GetOpenFileNameA
EAT(Export Address Table) is none