Report - RTCReporting_messageLog_2023-04-18-01-58-13.txt

ScreenShot AntiDebug AntiVM
ScreenShot
Created 2023.04.19 11:07 Machine s1_win7_x6402
Filename RTCReporting_messageLog_2023-04-18-01-58-13.txt
Type ASCII text
AI Score Not founds Behavior Score
1.0
ZERO API file : clean
VT API (file)
md5 8c706bf15eb784a8625c339866c74c66
sha256 9da49c523d69bf8bc152475ffb13b88c86ae04de9e55d49235e7c51f128bd9fa
ssdeep 192:eZVGo/D2/BDRD8XJD0RsUWjQxMItIZV/nY82m2FaLsijyq/B7d4BVuEqrVyMvpxw:U/D0BDRDSJDosZsiRvPuatfJAQA97
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Yara rule detected in process memory
info Checks amount of memory in system

Rules (9cnts)

Level Name Description Collection
notice ScreenShot Take ScreenShot memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure