ScreenShot
| Created | 2023.06.22 09:04 | Machine | s1_win7_x6401 |
| Filename | DaHost.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 45 detected (AIDetectMalware, malicious, high confidence, GuLoader, Vhdi, confidence, 100%, EORS, Attribute, HighConfidence, NSIS, score, HPDefender, InjectorX, hgzlz, YXDFTZ, Static AI, Suspicious PE, Leonem, ai score=84, Detected, Artemis, unsafe, CLASSIC, Igent, b0lKKU, CKER) | ||
| md5 | 0b359f7313105869be34d6abe847c38b | ||
| sha256 | 2d4627af839c6b59921cd5aa0aac4c9231dd8ff72a3465521cf7c516e2283539 | ||
| ssdeep | 6144:WpkXGhfZ2DXQfQDz+uImr8SbCp6Hs0Z0ku1LEhJXqgia4wclye433bFTW:vqugI2VOopP062nElye4HbFTW | ||
| imphash | e2a592076b17ef8bfb48b7e03965a3fc | ||
| impfuzzy | 48:Brdj692h5OyxYArOA8ltkz+eOxHALlla/35LFzn7+P9KQJ445EQl/KAEowSv0WbO:Brjh5txSH28dXJuKsI | ||
Network IP location
Signature (11cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 45 AntiVirus engines on VirusTotal as malicious |
| watch | Enumerates services |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a shortcut to an executable file |
| notice | Creates executable files on the filesystem |
| notice | Creates hidden or system file |
| notice | Drops an executable to the user AppData folder |
| notice | Queries for potentially installed applications |
| info | Checks amount of memory in system |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (9cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | NSIS_Installer | Null Soft Installer | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | Lnk_Format_Zero | LNK Format | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x408070 SetCurrentDirectoryW
0x408074 GetFileAttributesW
0x408078 GetFullPathNameW
0x40807c Sleep
0x408080 GetTickCount
0x408084 GetFileSize
0x408088 GetModuleFileNameW
0x40808c MoveFileW
0x408090 SetFileAttributesW
0x408094 GetCurrentProcess
0x408098 ExitProcess
0x40809c SetEnvironmentVariableW
0x4080a0 GetWindowsDirectoryW
0x4080a4 GetTempPathW
0x4080a8 GetCommandLineW
0x4080ac GetVersion
0x4080b0 SetErrorMode
0x4080b4 lstrlenW
0x4080b8 WaitForSingleObject
0x4080bc CopyFileW
0x4080c0 CompareFileTime
0x4080c4 GlobalLock
0x4080c8 CreateThread
0x4080cc GetLastError
0x4080d0 CreateDirectoryW
0x4080d4 CreateProcessW
0x4080d8 RemoveDirectoryW
0x4080dc lstrcmpiA
0x4080e0 CreateFileW
0x4080e4 GetTempFileNameW
0x4080e8 WriteFile
0x4080ec lstrcpyA
0x4080f0 lstrcpyW
0x4080f4 MoveFileExW
0x4080f8 lstrcatW
0x4080fc GetSystemDirectoryW
0x408100 GetProcAddress
0x408104 GetModuleHandleA
0x408108 GlobalFree
0x40810c GlobalAlloc
0x408110 GetShortPathNameW
0x408114 SearchPathW
0x408118 lstrcmpiW
0x40811c SetFileTime
0x408120 CloseHandle
0x408124 ExpandEnvironmentStringsW
0x408128 lstrcmpW
0x40812c GlobalUnlock
0x408130 lstrcpynW
0x408134 GetDiskFreeSpaceW
0x408138 GetExitCodeProcess
0x40813c FindFirstFileW
0x408140 FindNextFileW
0x408144 DeleteFileW
0x408148 SetFilePointer
0x40814c ReadFile
0x408150 FindClose
0x408154 MulDiv
0x408158 MultiByteToWideChar
0x40815c lstrlenA
0x408160 WideCharToMultiByte
0x408164 GetPrivateProfileStringW
0x408168 WritePrivateProfileStringW
0x40816c FreeLibrary
0x408170 LoadLibraryExW
0x408174 GetModuleHandleW
USER32.dll
0x408198 GetSystemMenu
0x40819c SetClassLongW
0x4081a0 IsWindowEnabled
0x4081a4 EnableMenuItem
0x4081a8 SetWindowPos
0x4081ac GetSysColor
0x4081b0 GetWindowLongW
0x4081b4 SetCursor
0x4081b8 LoadCursorW
0x4081bc CheckDlgButton
0x4081c0 GetMessagePos
0x4081c4 LoadBitmapW
0x4081c8 CallWindowProcW
0x4081cc IsWindowVisible
0x4081d0 CloseClipboard
0x4081d4 SetClipboardData
0x4081d8 EmptyClipboard
0x4081dc OpenClipboard
0x4081e0 wsprintfW
0x4081e4 ScreenToClient
0x4081e8 GetWindowRect
0x4081ec GetSystemMetrics
0x4081f0 SetDlgItemTextW
0x4081f4 GetDlgItemTextW
0x4081f8 MessageBoxIndirectW
0x4081fc CharPrevW
0x408200 CharNextA
0x408204 wsprintfA
0x408208 DispatchMessageW
0x40820c PeekMessageW
0x408210 GetDC
0x408214 ReleaseDC
0x408218 EnableWindow
0x40821c InvalidateRect
0x408220 SendMessageW
0x408224 DefWindowProcW
0x408228 BeginPaint
0x40822c GetClientRect
0x408230 FillRect
0x408234 EndDialog
0x408238 RegisterClassW
0x40823c SystemParametersInfoW
0x408240 CreateWindowExW
0x408244 GetClassInfoW
0x408248 DialogBoxParamW
0x40824c CharNextW
0x408250 ExitWindowsEx
0x408254 DestroyWindow
0x408258 LoadImageW
0x40825c SetTimer
0x408260 SetWindowTextW
0x408264 PostQuitMessage
0x408268 ShowWindow
0x40826c GetDlgItem
0x408270 IsWindow
0x408274 SetWindowLongW
0x408278 FindWindowExW
0x40827c TrackPopupMenu
0x408280 AppendMenuW
0x408284 CreatePopupMenu
0x408288 DrawTextW
0x40828c EndPaint
0x408290 CreateDialogParamW
0x408294 SendMessageTimeoutW
0x408298 SetForegroundWindow
GDI32.dll
0x40804c SelectObject
0x408050 SetBkMode
0x408054 CreateFontIndirectW
0x408058 SetTextColor
0x40805c DeleteObject
0x408060 GetDeviceCaps
0x408064 CreateBrushIndirect
0x408068 SetBkColor
SHELL32.dll
0x40817c SHGetSpecialFolderLocation
0x408180 SHGetPathFromIDListW
0x408184 SHBrowseForFolderW
0x408188 SHGetFileInfoW
0x40818c ShellExecuteW
0x408190 SHFileOperationW
ADVAPI32.dll
0x408000 RegDeleteKeyW
0x408004 SetFileSecurityW
0x408008 OpenProcessToken
0x40800c LookupPrivilegeValueW
0x408010 AdjustTokenPrivileges
0x408014 RegOpenKeyExW
0x408018 RegEnumValueW
0x40801c RegDeleteValueW
0x408020 RegCloseKey
0x408024 RegCreateKeyExW
0x408028 RegSetValueExW
0x40802c RegQueryValueExW
0x408030 RegEnumKeyW
COMCTL32.dll
0x408038 ImageList_AddMasked
0x40803c None
0x408040 ImageList_Destroy
0x408044 ImageList_Create
ole32.dll
0x4082a0 OleUninitialize
0x4082a4 OleInitialize
0x4082a8 CoTaskMemFree
0x4082ac CoCreateInstance
EAT(Export Address Table) is none
KERNEL32.dll
0x408070 SetCurrentDirectoryW
0x408074 GetFileAttributesW
0x408078 GetFullPathNameW
0x40807c Sleep
0x408080 GetTickCount
0x408084 GetFileSize
0x408088 GetModuleFileNameW
0x40808c MoveFileW
0x408090 SetFileAttributesW
0x408094 GetCurrentProcess
0x408098 ExitProcess
0x40809c SetEnvironmentVariableW
0x4080a0 GetWindowsDirectoryW
0x4080a4 GetTempPathW
0x4080a8 GetCommandLineW
0x4080ac GetVersion
0x4080b0 SetErrorMode
0x4080b4 lstrlenW
0x4080b8 WaitForSingleObject
0x4080bc CopyFileW
0x4080c0 CompareFileTime
0x4080c4 GlobalLock
0x4080c8 CreateThread
0x4080cc GetLastError
0x4080d0 CreateDirectoryW
0x4080d4 CreateProcessW
0x4080d8 RemoveDirectoryW
0x4080dc lstrcmpiA
0x4080e0 CreateFileW
0x4080e4 GetTempFileNameW
0x4080e8 WriteFile
0x4080ec lstrcpyA
0x4080f0 lstrcpyW
0x4080f4 MoveFileExW
0x4080f8 lstrcatW
0x4080fc GetSystemDirectoryW
0x408100 GetProcAddress
0x408104 GetModuleHandleA
0x408108 GlobalFree
0x40810c GlobalAlloc
0x408110 GetShortPathNameW
0x408114 SearchPathW
0x408118 lstrcmpiW
0x40811c SetFileTime
0x408120 CloseHandle
0x408124 ExpandEnvironmentStringsW
0x408128 lstrcmpW
0x40812c GlobalUnlock
0x408130 lstrcpynW
0x408134 GetDiskFreeSpaceW
0x408138 GetExitCodeProcess
0x40813c FindFirstFileW
0x408140 FindNextFileW
0x408144 DeleteFileW
0x408148 SetFilePointer
0x40814c ReadFile
0x408150 FindClose
0x408154 MulDiv
0x408158 MultiByteToWideChar
0x40815c lstrlenA
0x408160 WideCharToMultiByte
0x408164 GetPrivateProfileStringW
0x408168 WritePrivateProfileStringW
0x40816c FreeLibrary
0x408170 LoadLibraryExW
0x408174 GetModuleHandleW
USER32.dll
0x408198 GetSystemMenu
0x40819c SetClassLongW
0x4081a0 IsWindowEnabled
0x4081a4 EnableMenuItem
0x4081a8 SetWindowPos
0x4081ac GetSysColor
0x4081b0 GetWindowLongW
0x4081b4 SetCursor
0x4081b8 LoadCursorW
0x4081bc CheckDlgButton
0x4081c0 GetMessagePos
0x4081c4 LoadBitmapW
0x4081c8 CallWindowProcW
0x4081cc IsWindowVisible
0x4081d0 CloseClipboard
0x4081d4 SetClipboardData
0x4081d8 EmptyClipboard
0x4081dc OpenClipboard
0x4081e0 wsprintfW
0x4081e4 ScreenToClient
0x4081e8 GetWindowRect
0x4081ec GetSystemMetrics
0x4081f0 SetDlgItemTextW
0x4081f4 GetDlgItemTextW
0x4081f8 MessageBoxIndirectW
0x4081fc CharPrevW
0x408200 CharNextA
0x408204 wsprintfA
0x408208 DispatchMessageW
0x40820c PeekMessageW
0x408210 GetDC
0x408214 ReleaseDC
0x408218 EnableWindow
0x40821c InvalidateRect
0x408220 SendMessageW
0x408224 DefWindowProcW
0x408228 BeginPaint
0x40822c GetClientRect
0x408230 FillRect
0x408234 EndDialog
0x408238 RegisterClassW
0x40823c SystemParametersInfoW
0x408240 CreateWindowExW
0x408244 GetClassInfoW
0x408248 DialogBoxParamW
0x40824c CharNextW
0x408250 ExitWindowsEx
0x408254 DestroyWindow
0x408258 LoadImageW
0x40825c SetTimer
0x408260 SetWindowTextW
0x408264 PostQuitMessage
0x408268 ShowWindow
0x40826c GetDlgItem
0x408270 IsWindow
0x408274 SetWindowLongW
0x408278 FindWindowExW
0x40827c TrackPopupMenu
0x408280 AppendMenuW
0x408284 CreatePopupMenu
0x408288 DrawTextW
0x40828c EndPaint
0x408290 CreateDialogParamW
0x408294 SendMessageTimeoutW
0x408298 SetForegroundWindow
GDI32.dll
0x40804c SelectObject
0x408050 SetBkMode
0x408054 CreateFontIndirectW
0x408058 SetTextColor
0x40805c DeleteObject
0x408060 GetDeviceCaps
0x408064 CreateBrushIndirect
0x408068 SetBkColor
SHELL32.dll
0x40817c SHGetSpecialFolderLocation
0x408180 SHGetPathFromIDListW
0x408184 SHBrowseForFolderW
0x408188 SHGetFileInfoW
0x40818c ShellExecuteW
0x408190 SHFileOperationW
ADVAPI32.dll
0x408000 RegDeleteKeyW
0x408004 SetFileSecurityW
0x408008 OpenProcessToken
0x40800c LookupPrivilegeValueW
0x408010 AdjustTokenPrivileges
0x408014 RegOpenKeyExW
0x408018 RegEnumValueW
0x40801c RegDeleteValueW
0x408020 RegCloseKey
0x408024 RegCreateKeyExW
0x408028 RegSetValueExW
0x40802c RegQueryValueExW
0x408030 RegEnumKeyW
COMCTL32.dll
0x408038 ImageList_AddMasked
0x40803c None
0x408040 ImageList_Destroy
0x408044 ImageList_Create
ole32.dll
0x4082a0 OleUninitialize
0x4082a4 OleInitialize
0x4082a8 CoTaskMemFree
0x4082ac CoCreateInstance
EAT(Export Address Table) is none