ScreenShot
| Created | 2023.07.18 18:41 | Machine | s1_win7_x6403 |
| Filename | Project15.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | |||
| VT API (file) | 28 detected (Common, malicious, high confidence, GenericKD, Artemis, Save, ABRisk, NIOH, Attribute, HighConfidence, score, AsyncRAT, Infected, SGeneric, YI5WVX, Detected, ai score=82, Chgt, Static AI, Suspicious PE, PossibleThreat, confidence) | ||
| md5 | 2f8a3dfa7e89ffc2fd4166dc2db5bbe7 | ||
| sha256 | 8df2fc7eab6cc0ca190d0ffe2e58956727a8cd614ba4e7f361904f4ec0416762 | ||
| ssdeep | 6144:hkdT8kRK5AnIEyfjRohRqINPhFWi5gXhm9+utCeU4:SdbmAnYtouEhRSi+KX | ||
| imphash | c95936a7ff606d2f9826be1078f01c5a | ||
| impfuzzy | 24:c9UfDpTu9QHZ/cpVWQkRS1o0qtuBg3JBlmLoEOovbO3gv9FZYGMAZAODEO1EQOKc:c9aPcpV1gS1YtuBgPuc3y9FZjebtKS9 | ||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 28 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | Creates executable files on the filesystem |
| notice | Foreign language identified in PE resource |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| info | Collects information to fingerprint the system (MachineGuid |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Executable Download from dotted-quad Host
ET HUNTING Rejetto HTTP File Sever Response
ET POLICY PE EXE or DLL Windows file download HTTP
ET EXPLOIT_KIT DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET INFO EXE - Served Attached HTTP
ET HUNTING Rejetto HTTP File Sever Response
ET POLICY PE EXE or DLL Windows file download HTTP
ET EXPLOIT_KIT DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET INFO EXE - Served Attached HTTP
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14002d000 LocalAlloc
0x14002d008 MultiByteToWideChar
0x14002d010 FormatMessageW
0x14002d018 LoadLibraryA
0x14002d020 CloseHandle
0x14002d028 FreeConsole
0x14002d030 GetProcAddress
0x14002d038 FreeLibrary
0x14002d040 WriteConsoleW
0x14002d048 CreateFileW
0x14002d050 HeapSize
0x14002d058 GetProcessHeap
0x14002d060 SetStdHandle
0x14002d068 SetEnvironmentVariableW
0x14002d070 FreeEnvironmentStringsW
0x14002d078 GetEnvironmentStringsW
0x14002d080 GetOEMCP
0x14002d088 GetACP
0x14002d090 IsValidCodePage
0x14002d098 FindNextFileW
0x14002d0a0 FindFirstFileExW
0x14002d0a8 WideCharToMultiByte
0x14002d0b0 EnterCriticalSection
0x14002d0b8 LeaveCriticalSection
0x14002d0c0 InitializeCriticalSectionEx
0x14002d0c8 DeleteCriticalSection
0x14002d0d0 EncodePointer
0x14002d0d8 DecodePointer
0x14002d0e0 LocalFree
0x14002d0e8 LCMapStringEx
0x14002d0f0 GetStringTypeW
0x14002d0f8 GetCPInfo
0x14002d100 GetLastError
0x14002d108 QueryPerformanceCounter
0x14002d110 GetCurrentProcessId
0x14002d118 GetCurrentThreadId
0x14002d120 GetSystemTimeAsFileTime
0x14002d128 InitializeSListHead
0x14002d130 RtlCaptureContext
0x14002d138 RtlLookupFunctionEntry
0x14002d140 RtlVirtualUnwind
0x14002d148 IsDebuggerPresent
0x14002d150 UnhandledExceptionFilter
0x14002d158 SetUnhandledExceptionFilter
0x14002d160 GetStartupInfoW
0x14002d168 IsProcessorFeaturePresent
0x14002d170 GetModuleHandleW
0x14002d178 GetCurrentProcess
0x14002d180 TerminateProcess
0x14002d188 RtlUnwindEx
0x14002d190 RtlPcToFileHeader
0x14002d198 RaiseException
0x14002d1a0 SetLastError
0x14002d1a8 InitializeCriticalSectionAndSpinCount
0x14002d1b0 TlsAlloc
0x14002d1b8 TlsGetValue
0x14002d1c0 TlsSetValue
0x14002d1c8 TlsFree
0x14002d1d0 LoadLibraryExW
0x14002d1d8 GetStdHandle
0x14002d1e0 WriteFile
0x14002d1e8 GetModuleFileNameW
0x14002d1f0 ExitProcess
0x14002d1f8 GetModuleHandleExW
0x14002d200 GetCommandLineA
0x14002d208 GetCommandLineW
0x14002d210 HeapAlloc
0x14002d218 HeapFree
0x14002d220 GetFileType
0x14002d228 CompareStringW
0x14002d230 LCMapStringW
0x14002d238 GetLocaleInfoW
0x14002d240 IsValidLocale
0x14002d248 GetUserDefaultLCID
0x14002d250 EnumSystemLocalesW
0x14002d258 FlushFileBuffers
0x14002d260 GetConsoleOutputCP
0x14002d268 GetConsoleMode
0x14002d270 ReadFile
0x14002d278 GetFileSizeEx
0x14002d280 SetFilePointerEx
0x14002d288 ReadConsoleW
0x14002d290 HeapReAlloc
0x14002d298 FindClose
0x14002d2a0 RtlUnwind
ole32.dll
0x14002d2d8 CoGetObject
0x14002d2e0 CoUninitialize
0x14002d2e8 CLSIDFromString
0x14002d2f0 CoInitializeEx
OLEAUT32.dll
0x14002d2b0 VariantInit
0x14002d2b8 SysAllocString
0x14002d2c0 VariantClear
0x14002d2c8 SysFreeString
urlmon.dll
0x14002d300 URLDownloadToFileW
EAT(Export Address Table) is none
KERNEL32.dll
0x14002d000 LocalAlloc
0x14002d008 MultiByteToWideChar
0x14002d010 FormatMessageW
0x14002d018 LoadLibraryA
0x14002d020 CloseHandle
0x14002d028 FreeConsole
0x14002d030 GetProcAddress
0x14002d038 FreeLibrary
0x14002d040 WriteConsoleW
0x14002d048 CreateFileW
0x14002d050 HeapSize
0x14002d058 GetProcessHeap
0x14002d060 SetStdHandle
0x14002d068 SetEnvironmentVariableW
0x14002d070 FreeEnvironmentStringsW
0x14002d078 GetEnvironmentStringsW
0x14002d080 GetOEMCP
0x14002d088 GetACP
0x14002d090 IsValidCodePage
0x14002d098 FindNextFileW
0x14002d0a0 FindFirstFileExW
0x14002d0a8 WideCharToMultiByte
0x14002d0b0 EnterCriticalSection
0x14002d0b8 LeaveCriticalSection
0x14002d0c0 InitializeCriticalSectionEx
0x14002d0c8 DeleteCriticalSection
0x14002d0d0 EncodePointer
0x14002d0d8 DecodePointer
0x14002d0e0 LocalFree
0x14002d0e8 LCMapStringEx
0x14002d0f0 GetStringTypeW
0x14002d0f8 GetCPInfo
0x14002d100 GetLastError
0x14002d108 QueryPerformanceCounter
0x14002d110 GetCurrentProcessId
0x14002d118 GetCurrentThreadId
0x14002d120 GetSystemTimeAsFileTime
0x14002d128 InitializeSListHead
0x14002d130 RtlCaptureContext
0x14002d138 RtlLookupFunctionEntry
0x14002d140 RtlVirtualUnwind
0x14002d148 IsDebuggerPresent
0x14002d150 UnhandledExceptionFilter
0x14002d158 SetUnhandledExceptionFilter
0x14002d160 GetStartupInfoW
0x14002d168 IsProcessorFeaturePresent
0x14002d170 GetModuleHandleW
0x14002d178 GetCurrentProcess
0x14002d180 TerminateProcess
0x14002d188 RtlUnwindEx
0x14002d190 RtlPcToFileHeader
0x14002d198 RaiseException
0x14002d1a0 SetLastError
0x14002d1a8 InitializeCriticalSectionAndSpinCount
0x14002d1b0 TlsAlloc
0x14002d1b8 TlsGetValue
0x14002d1c0 TlsSetValue
0x14002d1c8 TlsFree
0x14002d1d0 LoadLibraryExW
0x14002d1d8 GetStdHandle
0x14002d1e0 WriteFile
0x14002d1e8 GetModuleFileNameW
0x14002d1f0 ExitProcess
0x14002d1f8 GetModuleHandleExW
0x14002d200 GetCommandLineA
0x14002d208 GetCommandLineW
0x14002d210 HeapAlloc
0x14002d218 HeapFree
0x14002d220 GetFileType
0x14002d228 CompareStringW
0x14002d230 LCMapStringW
0x14002d238 GetLocaleInfoW
0x14002d240 IsValidLocale
0x14002d248 GetUserDefaultLCID
0x14002d250 EnumSystemLocalesW
0x14002d258 FlushFileBuffers
0x14002d260 GetConsoleOutputCP
0x14002d268 GetConsoleMode
0x14002d270 ReadFile
0x14002d278 GetFileSizeEx
0x14002d280 SetFilePointerEx
0x14002d288 ReadConsoleW
0x14002d290 HeapReAlloc
0x14002d298 FindClose
0x14002d2a0 RtlUnwind
ole32.dll
0x14002d2d8 CoGetObject
0x14002d2e0 CoUninitialize
0x14002d2e8 CLSIDFromString
0x14002d2f0 CoInitializeEx
OLEAUT32.dll
0x14002d2b0 VariantInit
0x14002d2b8 SysAllocString
0x14002d2c0 VariantClear
0x14002d2c8 SysFreeString
urlmon.dll
0x14002d300 URLDownloadToFileW
EAT(Export Address Table) is none