ScreenShot
| Created | 2023.07.12 17:39 | Machine | s1_win7_x6401 |
| Filename | firmresource.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 27 detected (Artemis, GenKryptik, malicious, high confidence, score, TrojanX, CLOUD, Static AI, Malicious SFX, Wacatac, Detected, R559295, unsafe, Ader, Hjgl, NDAoF, confidence) | ||
| md5 | ae830ab4838b8fb88af7a8fcf0071d1b | ||
| sha256 | 114210ddeecbf5dd4320338e5a3c5a156841ae1390732a2b71e324f161e32932 | ||
| ssdeep | 3072:mahKyd2n31VgV5MtpUNPgaGR1aLERyofnUQNkRRLFvVCurpLDmFpJ/OVH:mahOPgSpUNo1agvnDNkf/z93m3J/O | ||
| imphash | 4cea7ae85c87ddc7295d39ff9cda31d1 | ||
| impfuzzy | 48:mPkNSpUOU4iLeyMuM9QBt3S1W8KEl4LTFGACupNXR6x9pg1go5E95dSva5pUrz+L:ikmUZ4iLfMuMqBt3S1WwfSbmaeGipT | ||
Network IP location
Signature (14cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 27 AntiVirus engines on VirusTotal as malicious |
| watch | A process attempted to delay the analysis task. |
| watch | Installs itself for autorun at Windows startup |
| watch | Looks for the Windows Idle Time to determine the uptime |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Creates executable files on the filesystem |
| notice | Drops an executable to the user AppData folder |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (12cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_RL_Gen_Zero | Win32 Trojan Emotet | binaries (upload) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Win32_Trojan_PWS_Net_1_Zero | Win32 Trojan PWS .NET Azorult | binaries (download) |
| info | CAB_file_format | CAB archive file | binaries (upload) |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0x140009128 GetTokenInformation
0x140009130 RegDeleteValueA
0x140009138 RegOpenKeyExA
0x140009140 RegQueryInfoKeyA
0x140009148 FreeSid
0x140009150 OpenProcessToken
0x140009158 RegSetValueExA
0x140009160 RegCreateKeyExA
0x140009168 LookupPrivilegeValueA
0x140009170 AllocateAndInitializeSid
0x140009178 RegQueryValueExA
0x140009180 EqualSid
0x140009188 RegCloseKey
0x140009190 AdjustTokenPrivileges
KERNEL32.dll
0x1400091e8 _lopen
0x1400091f0 _llseek
0x1400091f8 CompareStringA
0x140009200 GetLastError
0x140009208 GetFileAttributesA
0x140009210 GetSystemDirectoryA
0x140009218 LoadLibraryA
0x140009220 DeleteFileA
0x140009228 GlobalAlloc
0x140009230 GlobalFree
0x140009238 CloseHandle
0x140009240 WritePrivateProfileStringA
0x140009248 IsDBCSLeadByte
0x140009250 GetWindowsDirectoryA
0x140009258 SetFileAttributesA
0x140009260 GetProcAddress
0x140009268 GlobalLock
0x140009270 LocalFree
0x140009278 RemoveDirectoryA
0x140009280 FreeLibrary
0x140009288 _lclose
0x140009290 CreateDirectoryA
0x140009298 GetPrivateProfileIntA
0x1400092a0 GetPrivateProfileStringA
0x1400092a8 GlobalUnlock
0x1400092b0 ReadFile
0x1400092b8 SizeofResource
0x1400092c0 WriteFile
0x1400092c8 GetDriveTypeA
0x1400092d0 LoadLibraryExA
0x1400092d8 SetFileTime
0x1400092e0 SetFilePointer
0x1400092e8 FindResourceA
0x1400092f0 CreateMutexA
0x1400092f8 GetVolumeInformationA
0x140009300 WaitForSingleObject
0x140009308 GetCurrentDirectoryA
0x140009310 FreeResource
0x140009318 GetVersion
0x140009320 SetCurrentDirectoryA
0x140009328 GetTempPathA
0x140009330 LocalFileTimeToFileTime
0x140009338 CreateFileA
0x140009340 SetEvent
0x140009348 TerminateThread
0x140009350 GetVersionExA
0x140009358 LockResource
0x140009360 GetSystemInfo
0x140009368 CreateThread
0x140009370 ResetEvent
0x140009378 LoadResource
0x140009380 ExitProcess
0x140009388 GetModuleHandleW
0x140009390 CreateProcessA
0x140009398 FormatMessageA
0x1400093a0 GetTempFileNameA
0x1400093a8 DosDateTimeToFileTime
0x1400093b0 CreateEventA
0x1400093b8 GetExitCodeProcess
0x1400093c0 ExpandEnvironmentStringsA
0x1400093c8 LocalAlloc
0x1400093d0 lstrcmpA
0x1400093d8 FindNextFileA
0x1400093e0 GetCurrentProcess
0x1400093e8 FindFirstFileA
0x1400093f0 GetModuleFileNameA
0x1400093f8 GetShortPathNameA
0x140009400 Sleep
0x140009408 GetStartupInfoW
0x140009410 RtlCaptureContext
0x140009418 RtlLookupFunctionEntry
0x140009420 RtlVirtualUnwind
0x140009428 UnhandledExceptionFilter
0x140009430 SetUnhandledExceptionFilter
0x140009438 TerminateProcess
0x140009440 QueryPerformanceCounter
0x140009448 GetCurrentProcessId
0x140009450 GetCurrentThreadId
0x140009458 GetSystemTimeAsFileTime
0x140009460 GetTickCount
0x140009468 EnumResourceLanguagesA
0x140009470 GetDiskFreeSpaceA
0x140009478 MulDiv
0x140009480 FindClose
GDI32.dll
0x1400091d8 GetDeviceCaps
USER32.dll
0x140009490 ShowWindow
0x140009498 MsgWaitForMultipleObjects
0x1400094a0 SetWindowPos
0x1400094a8 GetDC
0x1400094b0 GetWindowRect
0x1400094b8 DispatchMessageA
0x1400094c0 GetSystemMetrics
0x1400094c8 CallWindowProcA
0x1400094d0 SetWindowTextA
0x1400094d8 MessageBoxA
0x1400094e0 SendDlgItemMessageA
0x1400094e8 SendMessageA
0x1400094f0 GetDlgItem
0x1400094f8 DialogBoxIndirectParamA
0x140009500 GetWindowLongPtrA
0x140009508 SetWindowLongPtrA
0x140009510 SetForegroundWindow
0x140009518 ReleaseDC
0x140009520 EnableWindow
0x140009528 CharNextA
0x140009530 LoadStringA
0x140009538 CharPrevA
0x140009540 EndDialog
0x140009548 MessageBeep
0x140009550 ExitWindowsEx
0x140009558 SetDlgItemTextA
0x140009560 CharUpperA
0x140009568 GetDesktopWindow
0x140009570 PeekMessageA
0x140009578 GetDlgItemTextA
msvcrt.dll
0x1400095a8 ?terminate@@YAXXZ
0x1400095b0 _commode
0x1400095b8 _fmode
0x1400095c0 _acmdln
0x1400095c8 __C_specific_handler
0x1400095d0 memset
0x1400095d8 __setusermatherr
0x1400095e0 _ismbblead
0x1400095e8 _cexit
0x1400095f0 _exit
0x1400095f8 exit
0x140009600 __set_app_type
0x140009608 __getmainargs
0x140009610 _amsg_exit
0x140009618 _XcptFilter
0x140009620 memcpy_s
0x140009628 _vsnprintf
0x140009630 _initterm
0x140009638 memcpy
COMCTL32.dll
0x1400091a0 None
Cabinet.dll
0x1400091b0 None
0x1400091b8 None
0x1400091c0 None
0x1400091c8 None
VERSION.dll
0x140009588 VerQueryValueA
0x140009590 GetFileVersionInfoSizeA
0x140009598 GetFileVersionInfoA
EAT(Export Address Table) is none
ADVAPI32.dll
0x140009128 GetTokenInformation
0x140009130 RegDeleteValueA
0x140009138 RegOpenKeyExA
0x140009140 RegQueryInfoKeyA
0x140009148 FreeSid
0x140009150 OpenProcessToken
0x140009158 RegSetValueExA
0x140009160 RegCreateKeyExA
0x140009168 LookupPrivilegeValueA
0x140009170 AllocateAndInitializeSid
0x140009178 RegQueryValueExA
0x140009180 EqualSid
0x140009188 RegCloseKey
0x140009190 AdjustTokenPrivileges
KERNEL32.dll
0x1400091e8 _lopen
0x1400091f0 _llseek
0x1400091f8 CompareStringA
0x140009200 GetLastError
0x140009208 GetFileAttributesA
0x140009210 GetSystemDirectoryA
0x140009218 LoadLibraryA
0x140009220 DeleteFileA
0x140009228 GlobalAlloc
0x140009230 GlobalFree
0x140009238 CloseHandle
0x140009240 WritePrivateProfileStringA
0x140009248 IsDBCSLeadByte
0x140009250 GetWindowsDirectoryA
0x140009258 SetFileAttributesA
0x140009260 GetProcAddress
0x140009268 GlobalLock
0x140009270 LocalFree
0x140009278 RemoveDirectoryA
0x140009280 FreeLibrary
0x140009288 _lclose
0x140009290 CreateDirectoryA
0x140009298 GetPrivateProfileIntA
0x1400092a0 GetPrivateProfileStringA
0x1400092a8 GlobalUnlock
0x1400092b0 ReadFile
0x1400092b8 SizeofResource
0x1400092c0 WriteFile
0x1400092c8 GetDriveTypeA
0x1400092d0 LoadLibraryExA
0x1400092d8 SetFileTime
0x1400092e0 SetFilePointer
0x1400092e8 FindResourceA
0x1400092f0 CreateMutexA
0x1400092f8 GetVolumeInformationA
0x140009300 WaitForSingleObject
0x140009308 GetCurrentDirectoryA
0x140009310 FreeResource
0x140009318 GetVersion
0x140009320 SetCurrentDirectoryA
0x140009328 GetTempPathA
0x140009330 LocalFileTimeToFileTime
0x140009338 CreateFileA
0x140009340 SetEvent
0x140009348 TerminateThread
0x140009350 GetVersionExA
0x140009358 LockResource
0x140009360 GetSystemInfo
0x140009368 CreateThread
0x140009370 ResetEvent
0x140009378 LoadResource
0x140009380 ExitProcess
0x140009388 GetModuleHandleW
0x140009390 CreateProcessA
0x140009398 FormatMessageA
0x1400093a0 GetTempFileNameA
0x1400093a8 DosDateTimeToFileTime
0x1400093b0 CreateEventA
0x1400093b8 GetExitCodeProcess
0x1400093c0 ExpandEnvironmentStringsA
0x1400093c8 LocalAlloc
0x1400093d0 lstrcmpA
0x1400093d8 FindNextFileA
0x1400093e0 GetCurrentProcess
0x1400093e8 FindFirstFileA
0x1400093f0 GetModuleFileNameA
0x1400093f8 GetShortPathNameA
0x140009400 Sleep
0x140009408 GetStartupInfoW
0x140009410 RtlCaptureContext
0x140009418 RtlLookupFunctionEntry
0x140009420 RtlVirtualUnwind
0x140009428 UnhandledExceptionFilter
0x140009430 SetUnhandledExceptionFilter
0x140009438 TerminateProcess
0x140009440 QueryPerformanceCounter
0x140009448 GetCurrentProcessId
0x140009450 GetCurrentThreadId
0x140009458 GetSystemTimeAsFileTime
0x140009460 GetTickCount
0x140009468 EnumResourceLanguagesA
0x140009470 GetDiskFreeSpaceA
0x140009478 MulDiv
0x140009480 FindClose
GDI32.dll
0x1400091d8 GetDeviceCaps
USER32.dll
0x140009490 ShowWindow
0x140009498 MsgWaitForMultipleObjects
0x1400094a0 SetWindowPos
0x1400094a8 GetDC
0x1400094b0 GetWindowRect
0x1400094b8 DispatchMessageA
0x1400094c0 GetSystemMetrics
0x1400094c8 CallWindowProcA
0x1400094d0 SetWindowTextA
0x1400094d8 MessageBoxA
0x1400094e0 SendDlgItemMessageA
0x1400094e8 SendMessageA
0x1400094f0 GetDlgItem
0x1400094f8 DialogBoxIndirectParamA
0x140009500 GetWindowLongPtrA
0x140009508 SetWindowLongPtrA
0x140009510 SetForegroundWindow
0x140009518 ReleaseDC
0x140009520 EnableWindow
0x140009528 CharNextA
0x140009530 LoadStringA
0x140009538 CharPrevA
0x140009540 EndDialog
0x140009548 MessageBeep
0x140009550 ExitWindowsEx
0x140009558 SetDlgItemTextA
0x140009560 CharUpperA
0x140009568 GetDesktopWindow
0x140009570 PeekMessageA
0x140009578 GetDlgItemTextA
msvcrt.dll
0x1400095a8 ?terminate@@YAXXZ
0x1400095b0 _commode
0x1400095b8 _fmode
0x1400095c0 _acmdln
0x1400095c8 __C_specific_handler
0x1400095d0 memset
0x1400095d8 __setusermatherr
0x1400095e0 _ismbblead
0x1400095e8 _cexit
0x1400095f0 _exit
0x1400095f8 exit
0x140009600 __set_app_type
0x140009608 __getmainargs
0x140009610 _amsg_exit
0x140009618 _XcptFilter
0x140009620 memcpy_s
0x140009628 _vsnprintf
0x140009630 _initterm
0x140009638 memcpy
COMCTL32.dll
0x1400091a0 None
Cabinet.dll
0x1400091b0 None
0x1400091b8 None
0x1400091c0 None
0x1400091c8 None
VERSION.dll
0x140009588 VerQueryValueA
0x140009590 GetFileVersionInfoSizeA
0x140009598 GetFileVersionInfoA
EAT(Export Address Table) is none