popup

Report - AtomLdr.dll

DLL PE64 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.05.17 09:34 Machine s1_win7_x6403
Filename AtomLdr.dll
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
AI Score
2
 Behavior Score
1.2
ZERO API file : malware
VT API (file) 17 detected (Lazy, malicious, confidence, Runner, AGen, score, moderate, ai score=84, ivNoXlcNGlJ)
md5 513eecac1e602be2a404f1d70719dffb
sha256 80ef5b531e2e8cb19403a8f06cfa1d6743900957ebf24d84f63211ae04d6bc1f
ssdeep 196608:gqtd+hY7xGKq9SsHd9rm2niE6RK/Io+IDZT0Lx:Lt7Q97HX/n76RK/394
imphash d9e5262dbdb011627a845c0251a44802
impfuzzy 3:srO7S9KnJsJSd1EL/K5sJoAAJo6BJO7a2qyLAJ1M1AJmXHiMRW+HLR9JbHWbGTIM:IaOLG5lJXA2iAOCQWacbKIRbGeA
  Network IP location

Signature (3cnts)

Level Description
watch File has been identified by 17 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger

Rules (3cnts)

Level Name Description Collection
info IsDLL (no description) binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x180004000 HeapAlloc
 0x180004008 GetProcessHeap
 0x180004010 GetCommandLineW
 0x180004018 HeapFree
 0x180004020 CloseHandle
 0x180004028 CreateEventW
 0x180004030 ExitThread
USER32.dll
 0x180004058 MsgWaitForMultipleObjectsEx
SHELL32.dll
 0x180004040 CommandLineToArgvW
 0x180004048 SHGetFolderPathW

EAT(Export Address Table) Library

0x180002930 Atom
0x180002940 AtomHelper
0x180002940 AtomSystemInstaller
0x180002940 InitializeAtomSystem

Similarity measure (PE file only) - Checking for service failure