ScreenShot
| Created | 2023.06.19 17:11 | Machine | s1_win7_x6401 |
| Filename | dc.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 37 detected (Scar, ClipBanker, Python, Malicious, score, tpge, FileRepMalware, Misc, munvo, R002C0XER23, ai score=89, Wacatac, Artemis, unsafe, Chgt, Jcnw, susgen, Behavior, confidence, 100%) | ||
| md5 | a1dc3e2f998031a7c96685e6571f4f5f | ||
| sha256 | f1f178feb065f7deedf19c4d29428eefb0632acdf4568e48e0067b466f77d15c | ||
| ssdeep | 196608:SjUOMYe3o5AeNp93S3IdQmRJ8dA6l10sKYu/PaQ8IkaqdVTLDuwY6f5nJbOnzzg:y6YPh8IdQusl7Q8IwdF5nJQXg | ||
| imphash | a6cec5b1a631d592d80900ab7e1de8df | ||
| impfuzzy | 48:t/gub6EwoQ54rzSv6xviM3teV9aGhteS1/c+pIuCJcgTkOtV0Kq14r:ph9deVFhteS1/c+pIustkiWHS | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 37 AntiVirus engines on VirusTotal as malicious |
| notice | Creates executable files on the filesystem |
| info | Checks amount of memory in system |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (19cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_1_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Emotet_2_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | zip_file_format | ZIP file format | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
USER32.dll
0x14002a388 CreateWindowExW
0x14002a390 MessageBoxW
0x14002a398 MessageBoxA
0x14002a3a0 SystemParametersInfoW
0x14002a3a8 DestroyIcon
0x14002a3b0 SetWindowLongPtrW
0x14002a3b8 GetWindowLongPtrW
0x14002a3c0 GetClientRect
0x14002a3c8 InvalidateRect
0x14002a3d0 ReleaseDC
0x14002a3d8 GetDC
0x14002a3e0 DrawTextW
0x14002a3e8 GetDialogBaseUnits
0x14002a3f0 EndDialog
0x14002a3f8 DialogBoxIndirectParamW
0x14002a400 MoveWindow
0x14002a408 SendMessageW
COMCTL32.dll
0x14002a028 None
KERNEL32.dll
0x14002a058 IsValidCodePage
0x14002a060 GetStringTypeW
0x14002a068 GetFileAttributesExW
0x14002a070 HeapReAlloc
0x14002a078 FlushFileBuffers
0x14002a080 GetCurrentDirectoryW
0x14002a088 GetACP
0x14002a090 GetOEMCP
0x14002a098 GetModuleHandleW
0x14002a0a0 MulDiv
0x14002a0a8 GetLastError
0x14002a0b0 SetDllDirectoryW
0x14002a0b8 GetModuleFileNameW
0x14002a0c0 GetProcAddress
0x14002a0c8 GetCommandLineW
0x14002a0d0 GetEnvironmentVariableW
0x14002a0d8 GetCPInfo
0x14002a0e0 ExpandEnvironmentStringsW
0x14002a0e8 CreateDirectoryW
0x14002a0f0 GetTempPathW
0x14002a0f8 WaitForSingleObject
0x14002a100 Sleep
0x14002a108 GetExitCodeProcess
0x14002a110 CreateProcessW
0x14002a118 GetStartupInfoW
0x14002a120 FreeLibrary
0x14002a128 LoadLibraryExW
0x14002a130 SetConsoleCtrlHandler
0x14002a138 FindClose
0x14002a140 FindFirstFileExW
0x14002a148 CloseHandle
0x14002a150 GetCurrentProcess
0x14002a158 LocalFree
0x14002a160 FormatMessageW
0x14002a168 MultiByteToWideChar
0x14002a170 WideCharToMultiByte
0x14002a178 GetEnvironmentStringsW
0x14002a180 FreeEnvironmentStringsW
0x14002a188 GetProcessHeap
0x14002a190 GetTimeZoneInformation
0x14002a198 HeapSize
0x14002a1a0 WriteConsoleW
0x14002a1a8 SetEndOfFile
0x14002a1b0 SetEnvironmentVariableW
0x14002a1b8 RtlUnwindEx
0x14002a1c0 RtlCaptureContext
0x14002a1c8 RtlLookupFunctionEntry
0x14002a1d0 RtlVirtualUnwind
0x14002a1d8 UnhandledExceptionFilter
0x14002a1e0 SetUnhandledExceptionFilter
0x14002a1e8 TerminateProcess
0x14002a1f0 IsProcessorFeaturePresent
0x14002a1f8 QueryPerformanceCounter
0x14002a200 GetCurrentProcessId
0x14002a208 GetCurrentThreadId
0x14002a210 GetSystemTimeAsFileTime
0x14002a218 InitializeSListHead
0x14002a220 IsDebuggerPresent
0x14002a228 SetLastError
0x14002a230 EnterCriticalSection
0x14002a238 LeaveCriticalSection
0x14002a240 DeleteCriticalSection
0x14002a248 InitializeCriticalSectionAndSpinCount
0x14002a250 TlsAlloc
0x14002a258 TlsGetValue
0x14002a260 TlsSetValue
0x14002a268 TlsFree
0x14002a270 EncodePointer
0x14002a278 RaiseException
0x14002a280 RtlPcToFileHeader
0x14002a288 GetCommandLineA
0x14002a290 CreateFileW
0x14002a298 GetDriveTypeW
0x14002a2a0 GetFileInformationByHandle
0x14002a2a8 GetFileType
0x14002a2b0 PeekNamedPipe
0x14002a2b8 SystemTimeToTzSpecificLocalTime
0x14002a2c0 FileTimeToSystemTime
0x14002a2c8 GetFullPathNameW
0x14002a2d0 RemoveDirectoryW
0x14002a2d8 FindNextFileW
0x14002a2e0 SetStdHandle
0x14002a2e8 DeleteFileW
0x14002a2f0 ReadFile
0x14002a2f8 GetStdHandle
0x14002a300 WriteFile
0x14002a308 ExitProcess
0x14002a310 GetModuleHandleExW
0x14002a318 HeapFree
0x14002a320 GetConsoleMode
0x14002a328 ReadConsoleW
0x14002a330 SetFilePointerEx
0x14002a338 GetConsoleOutputCP
0x14002a340 GetFileSizeEx
0x14002a348 HeapAlloc
0x14002a350 FlsAlloc
0x14002a358 FlsGetValue
0x14002a360 FlsSetValue
0x14002a368 FlsFree
0x14002a370 CompareStringW
0x14002a378 LCMapStringW
ADVAPI32.dll
0x14002a000 OpenProcessToken
0x14002a008 GetTokenInformation
0x14002a010 ConvertStringSecurityDescriptorToSecurityDescriptorW
0x14002a018 ConvertSidToStringSidW
GDI32.dll
0x14002a038 SelectObject
0x14002a040 DeleteObject
0x14002a048 CreateFontIndirectW
EAT(Export Address Table) is none
USER32.dll
0x14002a388 CreateWindowExW
0x14002a390 MessageBoxW
0x14002a398 MessageBoxA
0x14002a3a0 SystemParametersInfoW
0x14002a3a8 DestroyIcon
0x14002a3b0 SetWindowLongPtrW
0x14002a3b8 GetWindowLongPtrW
0x14002a3c0 GetClientRect
0x14002a3c8 InvalidateRect
0x14002a3d0 ReleaseDC
0x14002a3d8 GetDC
0x14002a3e0 DrawTextW
0x14002a3e8 GetDialogBaseUnits
0x14002a3f0 EndDialog
0x14002a3f8 DialogBoxIndirectParamW
0x14002a400 MoveWindow
0x14002a408 SendMessageW
COMCTL32.dll
0x14002a028 None
KERNEL32.dll
0x14002a058 IsValidCodePage
0x14002a060 GetStringTypeW
0x14002a068 GetFileAttributesExW
0x14002a070 HeapReAlloc
0x14002a078 FlushFileBuffers
0x14002a080 GetCurrentDirectoryW
0x14002a088 GetACP
0x14002a090 GetOEMCP
0x14002a098 GetModuleHandleW
0x14002a0a0 MulDiv
0x14002a0a8 GetLastError
0x14002a0b0 SetDllDirectoryW
0x14002a0b8 GetModuleFileNameW
0x14002a0c0 GetProcAddress
0x14002a0c8 GetCommandLineW
0x14002a0d0 GetEnvironmentVariableW
0x14002a0d8 GetCPInfo
0x14002a0e0 ExpandEnvironmentStringsW
0x14002a0e8 CreateDirectoryW
0x14002a0f0 GetTempPathW
0x14002a0f8 WaitForSingleObject
0x14002a100 Sleep
0x14002a108 GetExitCodeProcess
0x14002a110 CreateProcessW
0x14002a118 GetStartupInfoW
0x14002a120 FreeLibrary
0x14002a128 LoadLibraryExW
0x14002a130 SetConsoleCtrlHandler
0x14002a138 FindClose
0x14002a140 FindFirstFileExW
0x14002a148 CloseHandle
0x14002a150 GetCurrentProcess
0x14002a158 LocalFree
0x14002a160 FormatMessageW
0x14002a168 MultiByteToWideChar
0x14002a170 WideCharToMultiByte
0x14002a178 GetEnvironmentStringsW
0x14002a180 FreeEnvironmentStringsW
0x14002a188 GetProcessHeap
0x14002a190 GetTimeZoneInformation
0x14002a198 HeapSize
0x14002a1a0 WriteConsoleW
0x14002a1a8 SetEndOfFile
0x14002a1b0 SetEnvironmentVariableW
0x14002a1b8 RtlUnwindEx
0x14002a1c0 RtlCaptureContext
0x14002a1c8 RtlLookupFunctionEntry
0x14002a1d0 RtlVirtualUnwind
0x14002a1d8 UnhandledExceptionFilter
0x14002a1e0 SetUnhandledExceptionFilter
0x14002a1e8 TerminateProcess
0x14002a1f0 IsProcessorFeaturePresent
0x14002a1f8 QueryPerformanceCounter
0x14002a200 GetCurrentProcessId
0x14002a208 GetCurrentThreadId
0x14002a210 GetSystemTimeAsFileTime
0x14002a218 InitializeSListHead
0x14002a220 IsDebuggerPresent
0x14002a228 SetLastError
0x14002a230 EnterCriticalSection
0x14002a238 LeaveCriticalSection
0x14002a240 DeleteCriticalSection
0x14002a248 InitializeCriticalSectionAndSpinCount
0x14002a250 TlsAlloc
0x14002a258 TlsGetValue
0x14002a260 TlsSetValue
0x14002a268 TlsFree
0x14002a270 EncodePointer
0x14002a278 RaiseException
0x14002a280 RtlPcToFileHeader
0x14002a288 GetCommandLineA
0x14002a290 CreateFileW
0x14002a298 GetDriveTypeW
0x14002a2a0 GetFileInformationByHandle
0x14002a2a8 GetFileType
0x14002a2b0 PeekNamedPipe
0x14002a2b8 SystemTimeToTzSpecificLocalTime
0x14002a2c0 FileTimeToSystemTime
0x14002a2c8 GetFullPathNameW
0x14002a2d0 RemoveDirectoryW
0x14002a2d8 FindNextFileW
0x14002a2e0 SetStdHandle
0x14002a2e8 DeleteFileW
0x14002a2f0 ReadFile
0x14002a2f8 GetStdHandle
0x14002a300 WriteFile
0x14002a308 ExitProcess
0x14002a310 GetModuleHandleExW
0x14002a318 HeapFree
0x14002a320 GetConsoleMode
0x14002a328 ReadConsoleW
0x14002a330 SetFilePointerEx
0x14002a338 GetConsoleOutputCP
0x14002a340 GetFileSizeEx
0x14002a348 HeapAlloc
0x14002a350 FlsAlloc
0x14002a358 FlsGetValue
0x14002a360 FlsSetValue
0x14002a368 FlsFree
0x14002a370 CompareStringW
0x14002a378 LCMapStringW
ADVAPI32.dll
0x14002a000 OpenProcessToken
0x14002a008 GetTokenInformation
0x14002a010 ConvertStringSecurityDescriptorToSecurityDescriptorW
0x14002a018 ConvertSidToStringSidW
GDI32.dll
0x14002a038 SelectObject
0x14002a040 DeleteObject
0x14002a048 CreateFontIndirectW
EAT(Export Address Table) is none