ScreenShot
| Created | 2023.05.30 17:14 | Machine | s1_win7_x6403 |
| Filename | ready.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 34 detected (AIDetectMalware, malicious, high confidence, Midie, Save, Kryptik, Eldorado, Attribute, HighConfidence, HTQS, score, TrojanX, Artemis, moderate, ai score=80, Sabsik, Redline, Detected, Hpdyre, R492527, BScope, TrojanPSW, CLOUD, HTQK, confidence, 100%) | ||
| md5 | 68a12439e64b2e4fd0733e2600153045 | ||
| sha256 | cce94ba64d0c7646a8cb7e0c27fedd30ac763ff847d033ebf7ba690451d4331a | ||
| ssdeep | 12288:pg5/Y8hJt8ikZKRYmUPKpGBTM1/NUH3/EMtcmZErnaEMD:pg5/Dn3kcR8KYBTMxSXPcmWrn+D | ||
| imphash | a723f6c3947c7a9054d33c021115e563 | ||
| impfuzzy | 24:boDZk2+fcM1t0jOov1lwGJ33QFQHRyvnRT4YjMZEZr9plIlDLwA:b2+fcM1t0CHm3oRcGZXW | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 34 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e034 QueryPerformanceFrequency
0x41e038 MultiByteToWideChar
0x41e03c GetModuleHandleA
0x41e040 GetProcAddress
0x41e044 InterlockedIncrement
0x41e048 InterlockedDecrement
0x41e04c Sleep
0x41e050 InitializeCriticalSection
0x41e054 DeleteCriticalSection
0x41e058 EnterCriticalSection
0x41e05c LeaveCriticalSection
0x41e060 RtlUnwind
0x41e064 TerminateProcess
0x41e068 GetCurrentProcess
0x41e06c UnhandledExceptionFilter
0x41e070 SetUnhandledExceptionFilter
0x41e074 IsDebuggerPresent
0x41e078 RaiseException
0x41e07c GetCommandLineA
0x41e080 GetLastError
0x41e084 HeapFree
0x41e088 LCMapStringA
0x41e08c WideCharToMultiByte
0x41e090 LCMapStringW
0x41e094 GetCPInfo
0x41e098 GetModuleHandleW
0x41e09c TlsGetValue
0x41e0a0 TlsAlloc
0x41e0a4 TlsSetValue
0x41e0a8 TlsFree
0x41e0ac SetLastError
0x41e0b0 GetCurrentThreadId
0x41e0b4 HeapAlloc
0x41e0b8 ExitProcess
0x41e0bc WriteFile
0x41e0c0 GetStdHandle
0x41e0c4 GetModuleFileNameA
0x41e0c8 FreeEnvironmentStringsA
0x41e0cc GetEnvironmentStrings
0x41e0d0 FreeEnvironmentStringsW
0x41e0d4 GetEnvironmentStringsW
0x41e0d8 SetHandleCount
0x41e0dc GetFileType
0x41e0e0 GetStartupInfoA
0x41e0e4 HeapCreate
0x41e0e8 VirtualFree
0x41e0ec QueryPerformanceCounter
0x41e0f0 GetTickCount
0x41e0f4 GetCurrentProcessId
0x41e0f8 GetSystemTimeAsFileTime
0x41e0fc VirtualAlloc
0x41e100 HeapReAlloc
0x41e104 GetConsoleCP
0x41e108 GetConsoleMode
0x41e10c FlushFileBuffers
0x41e110 ReadFile
0x41e114 SetFilePointer
0x41e118 CloseHandle
0x41e11c HeapSize
0x41e120 GetACP
0x41e124 GetOEMCP
0x41e128 IsValidCodePage
0x41e12c GetLocaleInfoA
0x41e130 GetStringTypeA
0x41e134 GetStringTypeW
0x41e138 GetUserDefaultLCID
0x41e13c EnumSystemLocalesA
0x41e140 IsValidLocale
0x41e144 LoadLibraryA
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c WriteConsoleA
0x41e150 GetConsoleOutputCP
0x41e154 WriteConsoleW
0x41e158 SetStdHandle
0x41e15c GetLocaleInfoW
0x41e160 CreateFileA
GDI32.dll
0x41e014 SelectObject
0x41e018 CreateFontIndirectA
0x41e01c SetTextColor
0x41e020 SetBkMode
0x41e024 DeleteObject
0x41e028 GetStockObject
0x41e02c GetObjectA
COMDLG32.dll
0x41e008 GetOpenFileNameA
0x41e00c GetSaveFileNameA
ADVAPI32.dll
0x41e000 RegDeleteKeyA
EAT(Export Address Table) is none
KERNEL32.dll
0x41e034 QueryPerformanceFrequency
0x41e038 MultiByteToWideChar
0x41e03c GetModuleHandleA
0x41e040 GetProcAddress
0x41e044 InterlockedIncrement
0x41e048 InterlockedDecrement
0x41e04c Sleep
0x41e050 InitializeCriticalSection
0x41e054 DeleteCriticalSection
0x41e058 EnterCriticalSection
0x41e05c LeaveCriticalSection
0x41e060 RtlUnwind
0x41e064 TerminateProcess
0x41e068 GetCurrentProcess
0x41e06c UnhandledExceptionFilter
0x41e070 SetUnhandledExceptionFilter
0x41e074 IsDebuggerPresent
0x41e078 RaiseException
0x41e07c GetCommandLineA
0x41e080 GetLastError
0x41e084 HeapFree
0x41e088 LCMapStringA
0x41e08c WideCharToMultiByte
0x41e090 LCMapStringW
0x41e094 GetCPInfo
0x41e098 GetModuleHandleW
0x41e09c TlsGetValue
0x41e0a0 TlsAlloc
0x41e0a4 TlsSetValue
0x41e0a8 TlsFree
0x41e0ac SetLastError
0x41e0b0 GetCurrentThreadId
0x41e0b4 HeapAlloc
0x41e0b8 ExitProcess
0x41e0bc WriteFile
0x41e0c0 GetStdHandle
0x41e0c4 GetModuleFileNameA
0x41e0c8 FreeEnvironmentStringsA
0x41e0cc GetEnvironmentStrings
0x41e0d0 FreeEnvironmentStringsW
0x41e0d4 GetEnvironmentStringsW
0x41e0d8 SetHandleCount
0x41e0dc GetFileType
0x41e0e0 GetStartupInfoA
0x41e0e4 HeapCreate
0x41e0e8 VirtualFree
0x41e0ec QueryPerformanceCounter
0x41e0f0 GetTickCount
0x41e0f4 GetCurrentProcessId
0x41e0f8 GetSystemTimeAsFileTime
0x41e0fc VirtualAlloc
0x41e100 HeapReAlloc
0x41e104 GetConsoleCP
0x41e108 GetConsoleMode
0x41e10c FlushFileBuffers
0x41e110 ReadFile
0x41e114 SetFilePointer
0x41e118 CloseHandle
0x41e11c HeapSize
0x41e120 GetACP
0x41e124 GetOEMCP
0x41e128 IsValidCodePage
0x41e12c GetLocaleInfoA
0x41e130 GetStringTypeA
0x41e134 GetStringTypeW
0x41e138 GetUserDefaultLCID
0x41e13c EnumSystemLocalesA
0x41e140 IsValidLocale
0x41e144 LoadLibraryA
0x41e148 InitializeCriticalSectionAndSpinCount
0x41e14c WriteConsoleA
0x41e150 GetConsoleOutputCP
0x41e154 WriteConsoleW
0x41e158 SetStdHandle
0x41e15c GetLocaleInfoW
0x41e160 CreateFileA
GDI32.dll
0x41e014 SelectObject
0x41e018 CreateFontIndirectA
0x41e01c SetTextColor
0x41e020 SetBkMode
0x41e024 DeleteObject
0x41e028 GetStockObject
0x41e02c GetObjectA
COMDLG32.dll
0x41e008 GetOpenFileNameA
0x41e00c GetSaveFileNameA
ADVAPI32.dll
0x41e000 RegDeleteKeyA
EAT(Export Address Table) is none