ScreenShot
| Created | 2023.06.27 19:53 | Machine | s1_win7_x6401 |
| Filename | as.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 52 detected (AIDetectMalware, Lazy, IGENERIC, Save, Kryptik, malicious, confidence, 100%, Eldorado, Attribute, HighConfidence, high confidence, HTWT, score, BotX, RedLineSteal, tiwkq, Packed2, REDLINE, YXDFVZ, Artemis, moderate, Static AI, Malicious PE, ai score=84, Amadey, Detected, TrojanX, R588236, GenericRXWE, BScope, unsafe, GdSda, Generic@AI, RDML, L9IZbOmENfYsFm2mtVZYgA, TitanStealer, susgen, GenKryptik, GLAP, ZexaF, zu0@aKGhc7mi) | ||
| md5 | 58c867b6280648039f05f3702e565474 | ||
| sha256 | d6b5e39bcbf51127c1f73ca3b28d4d3d2520614bf7ccfad2383132826010c435 | ||
| ssdeep | 6144:SQeFkAE/kiQY4A69E8gpthuEt0M2ywAO+imU9h3uT+t70eKAgw:ShFkP/XQDA69EJtWYIh3uT+t70eKr | ||
| imphash | 9af3e93e35221a2c8c04a3cc05e589b2 | ||
| impfuzzy | 24:WjKVDo/cpVWcfS1jtbGhlJBl39LoEOovbO3gv9FZ6GMAkEZHu9J:+cpV5fS1jtbGnpJc3y9FZ+ | ||
Network IP location
Signature (16cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 52 AntiVirus engines on VirusTotal as malicious |
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local FTP client softwares |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x42c000 WaitForSingleObject
0x42c004 Sleep
0x42c008 CreateThread
0x42c00c VirtualAlloc
0x42c010 VirtualProtect
0x42c014 GetModuleHandleA
0x42c018 GetProcAddress
0x42c01c LoadLibraryA
0x42c020 lstrlenW
0x42c024 AddAtomW
0x42c028 CreateFileW
0x42c02c WideCharToMultiByte
0x42c030 EnterCriticalSection
0x42c034 LeaveCriticalSection
0x42c038 InitializeCriticalSectionEx
0x42c03c DeleteCriticalSection
0x42c040 EncodePointer
0x42c044 DecodePointer
0x42c048 MultiByteToWideChar
0x42c04c LCMapStringEx
0x42c050 GetStringTypeW
0x42c054 GetCPInfo
0x42c058 IsProcessorFeaturePresent
0x42c05c QueryPerformanceCounter
0x42c060 GetCurrentProcessId
0x42c064 GetCurrentThreadId
0x42c068 GetSystemTimeAsFileTime
0x42c06c InitializeSListHead
0x42c070 IsDebuggerPresent
0x42c074 UnhandledExceptionFilter
0x42c078 SetUnhandledExceptionFilter
0x42c07c GetStartupInfoW
0x42c080 GetModuleHandleW
0x42c084 GetCurrentProcess
0x42c088 TerminateProcess
0x42c08c RaiseException
0x42c090 RtlUnwind
0x42c094 GetLastError
0x42c098 SetLastError
0x42c09c InitializeCriticalSectionAndSpinCount
0x42c0a0 TlsAlloc
0x42c0a4 TlsGetValue
0x42c0a8 TlsSetValue
0x42c0ac TlsFree
0x42c0b0 FreeLibrary
0x42c0b4 LoadLibraryExW
0x42c0b8 GetStdHandle
0x42c0bc WriteFile
0x42c0c0 GetModuleFileNameW
0x42c0c4 ExitProcess
0x42c0c8 GetModuleHandleExW
0x42c0cc GetCommandLineA
0x42c0d0 GetCommandLineW
0x42c0d4 HeapAlloc
0x42c0d8 HeapFree
0x42c0dc GetFileType
0x42c0e0 CompareStringW
0x42c0e4 LCMapStringW
0x42c0e8 GetLocaleInfoW
0x42c0ec IsValidLocale
0x42c0f0 GetUserDefaultLCID
0x42c0f4 EnumSystemLocalesW
0x42c0f8 CloseHandle
0x42c0fc FlushFileBuffers
0x42c100 GetConsoleOutputCP
0x42c104 GetConsoleMode
0x42c108 ReadFile
0x42c10c GetFileSizeEx
0x42c110 SetFilePointerEx
0x42c114 ReadConsoleW
0x42c118 HeapReAlloc
0x42c11c FindClose
0x42c120 FindFirstFileExW
0x42c124 FindNextFileW
0x42c128 IsValidCodePage
0x42c12c GetACP
0x42c130 GetOEMCP
0x42c134 GetEnvironmentStringsW
0x42c138 FreeEnvironmentStringsW
0x42c13c SetEnvironmentVariableW
0x42c140 SetStdHandle
0x42c144 GetProcessHeap
0x42c148 HeapSize
0x42c14c WriteConsoleW
EAT(Export Address Table) is none
KERNEL32.dll
0x42c000 WaitForSingleObject
0x42c004 Sleep
0x42c008 CreateThread
0x42c00c VirtualAlloc
0x42c010 VirtualProtect
0x42c014 GetModuleHandleA
0x42c018 GetProcAddress
0x42c01c LoadLibraryA
0x42c020 lstrlenW
0x42c024 AddAtomW
0x42c028 CreateFileW
0x42c02c WideCharToMultiByte
0x42c030 EnterCriticalSection
0x42c034 LeaveCriticalSection
0x42c038 InitializeCriticalSectionEx
0x42c03c DeleteCriticalSection
0x42c040 EncodePointer
0x42c044 DecodePointer
0x42c048 MultiByteToWideChar
0x42c04c LCMapStringEx
0x42c050 GetStringTypeW
0x42c054 GetCPInfo
0x42c058 IsProcessorFeaturePresent
0x42c05c QueryPerformanceCounter
0x42c060 GetCurrentProcessId
0x42c064 GetCurrentThreadId
0x42c068 GetSystemTimeAsFileTime
0x42c06c InitializeSListHead
0x42c070 IsDebuggerPresent
0x42c074 UnhandledExceptionFilter
0x42c078 SetUnhandledExceptionFilter
0x42c07c GetStartupInfoW
0x42c080 GetModuleHandleW
0x42c084 GetCurrentProcess
0x42c088 TerminateProcess
0x42c08c RaiseException
0x42c090 RtlUnwind
0x42c094 GetLastError
0x42c098 SetLastError
0x42c09c InitializeCriticalSectionAndSpinCount
0x42c0a0 TlsAlloc
0x42c0a4 TlsGetValue
0x42c0a8 TlsSetValue
0x42c0ac TlsFree
0x42c0b0 FreeLibrary
0x42c0b4 LoadLibraryExW
0x42c0b8 GetStdHandle
0x42c0bc WriteFile
0x42c0c0 GetModuleFileNameW
0x42c0c4 ExitProcess
0x42c0c8 GetModuleHandleExW
0x42c0cc GetCommandLineA
0x42c0d0 GetCommandLineW
0x42c0d4 HeapAlloc
0x42c0d8 HeapFree
0x42c0dc GetFileType
0x42c0e0 CompareStringW
0x42c0e4 LCMapStringW
0x42c0e8 GetLocaleInfoW
0x42c0ec IsValidLocale
0x42c0f0 GetUserDefaultLCID
0x42c0f4 EnumSystemLocalesW
0x42c0f8 CloseHandle
0x42c0fc FlushFileBuffers
0x42c100 GetConsoleOutputCP
0x42c104 GetConsoleMode
0x42c108 ReadFile
0x42c10c GetFileSizeEx
0x42c110 SetFilePointerEx
0x42c114 ReadConsoleW
0x42c118 HeapReAlloc
0x42c11c FindClose
0x42c120 FindFirstFileExW
0x42c124 FindNextFileW
0x42c128 IsValidCodePage
0x42c12c GetACP
0x42c130 GetOEMCP
0x42c134 GetEnvironmentStringsW
0x42c138 FreeEnvironmentStringsW
0x42c13c SetEnvironmentVariableW
0x42c140 SetStdHandle
0x42c144 GetProcessHeap
0x42c148 HeapSize
0x42c14c WriteConsoleW
EAT(Export Address Table) is none