ScreenShot
| Created | 2023.05.14 17:40 | Machine | s1_win7_x6403 |
| Filename | ppls25.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 32 detected (unsafe, Malicious, FileRepMalware, Oader, Dkjl, Sabsik, Malware@#2cb6lk3jwq160, Detected, ai score=81, ymdkToqZoCK, susgen, Behavior) | ||
| md5 | a14d01d96ea78f39f7e118582dad3cb9 | ||
| sha256 | 6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e | ||
| ssdeep | 6144:xFH8RIT6Fam4StJ3rXDW49wY7SkzU0iaODgKYleQ4HzP:xWdtXDzCwGMAP | ||
| imphash | 77e359c59376704055cd15c273e85720 | ||
| impfuzzy | 48:GKo/kNEA+EQbH6UnXyfcyE7le/u8j/9LCAkJE/yLnBn6gIE9oz6UygAwovGfSYku:GKsY+pbH6UnXyfcyE7lGu8j/e9tWLDx | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 32 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (upload) |
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0x100001000 RegCreateKeyExW
0x100001008 RegCloseKey
0x100001010 RegSetValueExW
0x100001018 RegQueryValueExW
0x100001020 RegDeleteValueW
0x100001028 RegOpenKeyExW
0x100001030 RegNotifyChangeKeyValue
0x100001038 RegFlushKey
KERNEL32.dll
0x100001080 EnterCriticalSection
0x100001088 DeleteCriticalSection
0x100001090 GetCommandLineW
0x100001098 lstrlenA
0x1000010a0 FreeLibrary
0x1000010a8 WaitForSingleObject
0x1000010b0 SetEvent
0x1000010b8 RegisterApplicationRestart
0x1000010c0 LoadLibraryW
0x1000010c8 Sleep
0x1000010d0 CreateEventW
0x1000010d8 WaitForMultipleObjects
0x1000010e0 HeapSetInformation
0x1000010e8 GetCurrentThreadId
0x1000010f0 CloseHandle
0x1000010f8 GetVersionExW
0x100001100 GetProcAddress
0x100001108 GetSystemInfo
0x100001110 GetFullPathNameW
0x100001118 WideCharToMultiByte
0x100001120 ReadFile
0x100001128 GetProcessHeap
0x100001130 SetEndOfFile
0x100001138 GetCurrentDirectoryW
0x100001140 VirtualQuery
0x100001148 SetThreadStackGuarantee
0x100001150 VirtualAlloc
0x100001158 VirtualProtect
0x100001160 FlushFileBuffers
0x100001168 SetStdHandle
0x100001170 CreateFileW
0x100001178 GetConsoleMode
0x100001180 GetConsoleCP
0x100001188 SetFilePointer
0x100001190 GetStringTypeW
0x100001198 MultiByteToWideChar
0x1000011a0 LCMapStringW
0x1000011a8 LoadLibraryExW
0x1000011b0 InitializeCriticalSectionAndSpinCount
0x1000011b8 HeapSize
0x1000011c0 GetOEMCP
0x1000011c8 GetACP
0x1000011d0 GetCPInfo
0x1000011d8 OutputDebugStringA
0x1000011e0 RtlCaptureContext
0x1000011e8 RtlVirtualUnwind
0x1000011f0 lstrlenW
0x1000011f8 GetModuleFileNameW
0x100001200 GetFileAttributesW
0x100001208 LeaveCriticalSection
0x100001210 GetSystemDirectoryW
0x100001218 InitializeCriticalSection
0x100001220 WriteConsoleW
0x100001228 UnhandledExceptionFilter
0x100001230 GetCurrentProcess
0x100001238 TerminateProcess
0x100001240 GetSystemTimeAsFileTime
0x100001248 GetCurrentProcessId
0x100001250 GetTickCount
0x100001258 QueryPerformanceCounter
0x100001260 HeapCreate
0x100001268 FlsAlloc
0x100001270 GetCommandLineA
0x100001278 GetStartupInfoW
0x100001280 GetLastError
0x100001288 HeapFree
0x100001290 HeapReAlloc
0x100001298 ExitThread
0x1000012a0 FlsSetValue
0x1000012a8 FlsGetValue
0x1000012b0 CreateThread
0x1000012b8 RaiseException
0x1000012c0 RtlPcToFileHeader
0x1000012c8 RtlLookupFunctionEntry
0x1000012d0 RtlUnwindEx
0x1000012d8 HeapAlloc
0x1000012e0 SetUnhandledExceptionFilter
0x1000012e8 GetModuleHandleW
0x1000012f0 ExitProcess
0x1000012f8 WriteFile
0x100001300 GetStdHandle
0x100001308 GetModuleFileNameA
0x100001310 FreeEnvironmentStringsW
0x100001318 GetEnvironmentStringsW
0x100001320 SetHandleCount
0x100001328 GetFileType
0x100001330 EncodePointer
0x100001338 DecodePointer
0x100001340 FlsFree
0x100001348 SetLastError
USER32.dll
0x100001390 UpdateWindow
0x100001398 SetWindowTextW
0x1000013a0 DispatchMessageW
0x1000013a8 EnableWindow
0x1000013b0 DestroyWindow
0x1000013b8 SetTimer
0x1000013c0 GetWindowRect
0x1000013c8 PostQuitMessage
0x1000013d0 PostMessageW
0x1000013d8 KillTimer
0x1000013e0 MsgWaitForMultipleObjects
0x1000013e8 GetKeyState
0x1000013f0 SetForegroundWindow
0x1000013f8 GetFocus
0x100001400 DialogBoxParamW
0x100001408 CallNextHookEx
0x100001410 IsWindowEnabled
0x100001418 GetWindowLongPtrW
0x100001420 GetClientRect
0x100001428 SetFocus
0x100001430 TranslateMessage
0x100001438 IsDialogMessageW
0x100001440 LoadIconW
0x100001448 GetWindowLongW
0x100001450 PeekMessageW
0x100001458 GetDlgItem
0x100001460 EndDialog
0x100001468 GetDesktopWindow
0x100001470 SetWindowPos
0x100001478 LoadStringW
0x100001480 CheckDlgButton
0x100001488 ShowWindow
0x100001490 CreateDialogParamW
0x100001498 SetWindowsHookExW
0x1000014a0 AdjustWindowRectEx
0x1000014a8 UnhookWindowsHookEx
0x1000014b0 MessageBoxW
0x1000014b8 SendMessageW
COMDLG32.dll
0x100001070 GetSaveFileNameW
SHELL32.dll
0x100001380 ShellExecuteW
ole32.dll
0x1000014c8 CoUninitialize
0x1000014d0 CoInitialize
0x1000014d8 CoInitializeSecurity
0x1000014e0 CoCreateInstance
EAT(Export Address Table) is none
ADVAPI32.dll
0x100001000 RegCreateKeyExW
0x100001008 RegCloseKey
0x100001010 RegSetValueExW
0x100001018 RegQueryValueExW
0x100001020 RegDeleteValueW
0x100001028 RegOpenKeyExW
0x100001030 RegNotifyChangeKeyValue
0x100001038 RegFlushKey
KERNEL32.dll
0x100001080 EnterCriticalSection
0x100001088 DeleteCriticalSection
0x100001090 GetCommandLineW
0x100001098 lstrlenA
0x1000010a0 FreeLibrary
0x1000010a8 WaitForSingleObject
0x1000010b0 SetEvent
0x1000010b8 RegisterApplicationRestart
0x1000010c0 LoadLibraryW
0x1000010c8 Sleep
0x1000010d0 CreateEventW
0x1000010d8 WaitForMultipleObjects
0x1000010e0 HeapSetInformation
0x1000010e8 GetCurrentThreadId
0x1000010f0 CloseHandle
0x1000010f8 GetVersionExW
0x100001100 GetProcAddress
0x100001108 GetSystemInfo
0x100001110 GetFullPathNameW
0x100001118 WideCharToMultiByte
0x100001120 ReadFile
0x100001128 GetProcessHeap
0x100001130 SetEndOfFile
0x100001138 GetCurrentDirectoryW
0x100001140 VirtualQuery
0x100001148 SetThreadStackGuarantee
0x100001150 VirtualAlloc
0x100001158 VirtualProtect
0x100001160 FlushFileBuffers
0x100001168 SetStdHandle
0x100001170 CreateFileW
0x100001178 GetConsoleMode
0x100001180 GetConsoleCP
0x100001188 SetFilePointer
0x100001190 GetStringTypeW
0x100001198 MultiByteToWideChar
0x1000011a0 LCMapStringW
0x1000011a8 LoadLibraryExW
0x1000011b0 InitializeCriticalSectionAndSpinCount
0x1000011b8 HeapSize
0x1000011c0 GetOEMCP
0x1000011c8 GetACP
0x1000011d0 GetCPInfo
0x1000011d8 OutputDebugStringA
0x1000011e0 RtlCaptureContext
0x1000011e8 RtlVirtualUnwind
0x1000011f0 lstrlenW
0x1000011f8 GetModuleFileNameW
0x100001200 GetFileAttributesW
0x100001208 LeaveCriticalSection
0x100001210 GetSystemDirectoryW
0x100001218 InitializeCriticalSection
0x100001220 WriteConsoleW
0x100001228 UnhandledExceptionFilter
0x100001230 GetCurrentProcess
0x100001238 TerminateProcess
0x100001240 GetSystemTimeAsFileTime
0x100001248 GetCurrentProcessId
0x100001250 GetTickCount
0x100001258 QueryPerformanceCounter
0x100001260 HeapCreate
0x100001268 FlsAlloc
0x100001270 GetCommandLineA
0x100001278 GetStartupInfoW
0x100001280 GetLastError
0x100001288 HeapFree
0x100001290 HeapReAlloc
0x100001298 ExitThread
0x1000012a0 FlsSetValue
0x1000012a8 FlsGetValue
0x1000012b0 CreateThread
0x1000012b8 RaiseException
0x1000012c0 RtlPcToFileHeader
0x1000012c8 RtlLookupFunctionEntry
0x1000012d0 RtlUnwindEx
0x1000012d8 HeapAlloc
0x1000012e0 SetUnhandledExceptionFilter
0x1000012e8 GetModuleHandleW
0x1000012f0 ExitProcess
0x1000012f8 WriteFile
0x100001300 GetStdHandle
0x100001308 GetModuleFileNameA
0x100001310 FreeEnvironmentStringsW
0x100001318 GetEnvironmentStringsW
0x100001320 SetHandleCount
0x100001328 GetFileType
0x100001330 EncodePointer
0x100001338 DecodePointer
0x100001340 FlsFree
0x100001348 SetLastError
USER32.dll
0x100001390 UpdateWindow
0x100001398 SetWindowTextW
0x1000013a0 DispatchMessageW
0x1000013a8 EnableWindow
0x1000013b0 DestroyWindow
0x1000013b8 SetTimer
0x1000013c0 GetWindowRect
0x1000013c8 PostQuitMessage
0x1000013d0 PostMessageW
0x1000013d8 KillTimer
0x1000013e0 MsgWaitForMultipleObjects
0x1000013e8 GetKeyState
0x1000013f0 SetForegroundWindow
0x1000013f8 GetFocus
0x100001400 DialogBoxParamW
0x100001408 CallNextHookEx
0x100001410 IsWindowEnabled
0x100001418 GetWindowLongPtrW
0x100001420 GetClientRect
0x100001428 SetFocus
0x100001430 TranslateMessage
0x100001438 IsDialogMessageW
0x100001440 LoadIconW
0x100001448 GetWindowLongW
0x100001450 PeekMessageW
0x100001458 GetDlgItem
0x100001460 EndDialog
0x100001468 GetDesktopWindow
0x100001470 SetWindowPos
0x100001478 LoadStringW
0x100001480 CheckDlgButton
0x100001488 ShowWindow
0x100001490 CreateDialogParamW
0x100001498 SetWindowsHookExW
0x1000014a0 AdjustWindowRectEx
0x1000014a8 UnhookWindowsHookEx
0x1000014b0 MessageBoxW
0x1000014b8 SendMessageW
COMDLG32.dll
0x100001070 GetSaveFileNameW
SHELL32.dll
0x100001380 ShellExecuteW
ole32.dll
0x1000014c8 CoUninitialize
0x1000014d0 CoInitialize
0x1000014d8 CoInitializeSecurity
0x1000014e0 CoCreateInstance
EAT(Export Address Table) is none