ScreenShot
| Created | 2023.08.09 09:29 | Machine | s1_win7_x6402 |
| Filename | payment.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 10 detected (AIDetectMalware, malicious, high confidence, Makoob, FileRepMalware, Misc, Outbreak, confidence) | ||
| md5 | 4f11205da3e4d05588bcb5a6e518c1df | ||
| sha256 | e18ef37e6492ec36977361506b73efb434b23a3c5552edb9d0e5a3bb74094af3 | ||
| ssdeep | 6144:/zAJFlyucwHFp7VzirVN+P1HT5EzjWwM7jpz5jU:rCfv8idz5E/Mnpz54 | ||
| imphash | 076b06e6a65c9b7cca5a61be0cd82165 | ||
| impfuzzy | 48:OTFyuBX1O3VsMr+t8Alt8tz4eObGLlla5LREFpV74dT+45EQX/1EowSv0Qxly6U6:OZyuZ1WVsY42owsnUE | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 10 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| notice | Creates hidden or system file |
| notice | Drops an executable to the user AppData folder |
| info | Checks amount of memory in system |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x407070 Sleep
0x407074 SetFileAttributesA
0x407078 GetFileAttributesA
0x40707c GetTickCount
0x407080 GetModuleFileNameA
0x407084 GetCurrentProcess
0x407088 CopyFileA
0x40708c GetFileSize
0x407090 ExitProcess
0x407094 GetWindowsDirectoryA
0x407098 GetTempPathA
0x40709c GetCommandLineA
0x4070a0 GetVersion
0x4070a4 SetErrorMode
0x4070a8 lstrlenA
0x4070ac lstrcpynA
0x4070b0 ExpandEnvironmentStringsA
0x4070b4 SetEnvironmentVariableA
0x4070b8 GetFullPathNameA
0x4070bc CreateThread
0x4070c0 GetLastError
0x4070c4 CreateDirectoryA
0x4070c8 CreateProcessA
0x4070cc RemoveDirectoryA
0x4070d0 CreateFileA
0x4070d4 GetTempFileNameA
0x4070d8 ReadFile
0x4070dc WriteFile
0x4070e0 lstrcpyA
0x4070e4 MoveFileExA
0x4070e8 lstrcatA
0x4070ec GetSystemDirectoryA
0x4070f0 LoadLibraryA
0x4070f4 GetProcAddress
0x4070f8 lstrcmpiA
0x4070fc lstrcmpA
0x407100 SetCurrentDirectoryA
0x407104 MoveFileA
0x407108 CompareFileTime
0x40710c GetShortPathNameA
0x407110 SearchPathA
0x407114 CloseHandle
0x407118 SetFileTime
0x40711c GlobalLock
0x407120 GetDiskFreeSpaceA
0x407124 GlobalUnlock
0x407128 GlobalFree
0x40712c FindFirstFileA
0x407130 FindNextFileA
0x407134 DeleteFileA
0x407138 SetFilePointer
0x40713c GetPrivateProfileStringA
0x407140 FindClose
0x407144 MultiByteToWideChar
0x407148 MulDiv
0x40714c WritePrivateProfileStringA
0x407150 FreeLibrary
0x407154 LoadLibraryExA
0x407158 GetModuleHandleA
0x40715c GetExitCodeProcess
0x407160 WaitForSingleObject
0x407164 GlobalAlloc
USER32.dll
0x407188 GetSystemMenu
0x40718c SetClassLongA
0x407190 EnableMenuItem
0x407194 IsWindowEnabled
0x407198 SetWindowPos
0x40719c GetSysColor
0x4071a0 GetWindowLongA
0x4071a4 SetCursor
0x4071a8 LoadCursorA
0x4071ac CheckDlgButton
0x4071b0 GetMessagePos
0x4071b4 LoadBitmapA
0x4071b8 CallWindowProcA
0x4071bc IsWindowVisible
0x4071c0 CloseClipboard
0x4071c4 SetClipboardData
0x4071c8 EmptyClipboard
0x4071cc ScreenToClient
0x4071d0 GetWindowRect
0x4071d4 GetDlgItem
0x4071d8 CreatePopupMenu
0x4071dc GetSystemMetrics
0x4071e0 SetDlgItemTextA
0x4071e4 GetDlgItemTextA
0x4071e8 MessageBoxIndirectA
0x4071ec CharPrevA
0x4071f0 DispatchMessageA
0x4071f4 PeekMessageA
0x4071f8 GetDC
0x4071fc ReleaseDC
0x407200 EnableWindow
0x407204 InvalidateRect
0x407208 SendMessageA
0x40720c DefWindowProcA
0x407210 BeginPaint
0x407214 GetClientRect
0x407218 FillRect
0x40721c EndDialog
0x407220 RegisterClassA
0x407224 SystemParametersInfoA
0x407228 CreateWindowExA
0x40722c GetClassInfoA
0x407230 DialogBoxParamA
0x407234 CharNextA
0x407238 ExitWindowsEx
0x40723c LoadImageA
0x407240 CreateDialogParamA
0x407244 SetTimer
0x407248 SetWindowTextA
0x40724c SetWindowLongA
0x407250 SetForegroundWindow
0x407254 ShowWindow
0x407258 IsWindow
0x40725c SendMessageTimeoutA
0x407260 FindWindowExA
0x407264 OpenClipboard
0x407268 TrackPopupMenu
0x40726c AppendMenuA
0x407270 DrawTextA
0x407274 EndPaint
0x407278 DestroyWindow
0x40727c wsprintfA
0x407280 PostQuitMessage
GDI32.dll
0x40704c SelectObject
0x407050 SetBkMode
0x407054 CreateFontIndirectA
0x407058 SetTextColor
0x40705c DeleteObject
0x407060 GetDeviceCaps
0x407064 CreateBrushIndirect
0x407068 SetBkColor
SHELL32.dll
0x40716c SHGetSpecialFolderLocation
0x407170 SHGetPathFromIDListA
0x407174 SHBrowseForFolderA
0x407178 SHGetFileInfoA
0x40717c ShellExecuteA
0x407180 SHFileOperationA
ADVAPI32.dll
0x407000 RegDeleteKeyA
0x407004 SetFileSecurityA
0x407008 OpenProcessToken
0x40700c LookupPrivilegeValueA
0x407010 AdjustTokenPrivileges
0x407014 RegOpenKeyExA
0x407018 RegEnumValueA
0x40701c RegDeleteValueA
0x407020 RegCloseKey
0x407024 RegCreateKeyExA
0x407028 RegSetValueExA
0x40702c RegQueryValueExA
0x407030 RegEnumKeyA
COMCTL32.dll
0x407038 ImageList_AddMasked
0x40703c None
0x407040 ImageList_Destroy
0x407044 ImageList_Create
ole32.dll
0x407288 OleUninitialize
0x40728c OleInitialize
0x407290 CoTaskMemFree
0x407294 CoCreateInstance
EAT(Export Address Table) is none
KERNEL32.dll
0x407070 Sleep
0x407074 SetFileAttributesA
0x407078 GetFileAttributesA
0x40707c GetTickCount
0x407080 GetModuleFileNameA
0x407084 GetCurrentProcess
0x407088 CopyFileA
0x40708c GetFileSize
0x407090 ExitProcess
0x407094 GetWindowsDirectoryA
0x407098 GetTempPathA
0x40709c GetCommandLineA
0x4070a0 GetVersion
0x4070a4 SetErrorMode
0x4070a8 lstrlenA
0x4070ac lstrcpynA
0x4070b0 ExpandEnvironmentStringsA
0x4070b4 SetEnvironmentVariableA
0x4070b8 GetFullPathNameA
0x4070bc CreateThread
0x4070c0 GetLastError
0x4070c4 CreateDirectoryA
0x4070c8 CreateProcessA
0x4070cc RemoveDirectoryA
0x4070d0 CreateFileA
0x4070d4 GetTempFileNameA
0x4070d8 ReadFile
0x4070dc WriteFile
0x4070e0 lstrcpyA
0x4070e4 MoveFileExA
0x4070e8 lstrcatA
0x4070ec GetSystemDirectoryA
0x4070f0 LoadLibraryA
0x4070f4 GetProcAddress
0x4070f8 lstrcmpiA
0x4070fc lstrcmpA
0x407100 SetCurrentDirectoryA
0x407104 MoveFileA
0x407108 CompareFileTime
0x40710c GetShortPathNameA
0x407110 SearchPathA
0x407114 CloseHandle
0x407118 SetFileTime
0x40711c GlobalLock
0x407120 GetDiskFreeSpaceA
0x407124 GlobalUnlock
0x407128 GlobalFree
0x40712c FindFirstFileA
0x407130 FindNextFileA
0x407134 DeleteFileA
0x407138 SetFilePointer
0x40713c GetPrivateProfileStringA
0x407140 FindClose
0x407144 MultiByteToWideChar
0x407148 MulDiv
0x40714c WritePrivateProfileStringA
0x407150 FreeLibrary
0x407154 LoadLibraryExA
0x407158 GetModuleHandleA
0x40715c GetExitCodeProcess
0x407160 WaitForSingleObject
0x407164 GlobalAlloc
USER32.dll
0x407188 GetSystemMenu
0x40718c SetClassLongA
0x407190 EnableMenuItem
0x407194 IsWindowEnabled
0x407198 SetWindowPos
0x40719c GetSysColor
0x4071a0 GetWindowLongA
0x4071a4 SetCursor
0x4071a8 LoadCursorA
0x4071ac CheckDlgButton
0x4071b0 GetMessagePos
0x4071b4 LoadBitmapA
0x4071b8 CallWindowProcA
0x4071bc IsWindowVisible
0x4071c0 CloseClipboard
0x4071c4 SetClipboardData
0x4071c8 EmptyClipboard
0x4071cc ScreenToClient
0x4071d0 GetWindowRect
0x4071d4 GetDlgItem
0x4071d8 CreatePopupMenu
0x4071dc GetSystemMetrics
0x4071e0 SetDlgItemTextA
0x4071e4 GetDlgItemTextA
0x4071e8 MessageBoxIndirectA
0x4071ec CharPrevA
0x4071f0 DispatchMessageA
0x4071f4 PeekMessageA
0x4071f8 GetDC
0x4071fc ReleaseDC
0x407200 EnableWindow
0x407204 InvalidateRect
0x407208 SendMessageA
0x40720c DefWindowProcA
0x407210 BeginPaint
0x407214 GetClientRect
0x407218 FillRect
0x40721c EndDialog
0x407220 RegisterClassA
0x407224 SystemParametersInfoA
0x407228 CreateWindowExA
0x40722c GetClassInfoA
0x407230 DialogBoxParamA
0x407234 CharNextA
0x407238 ExitWindowsEx
0x40723c LoadImageA
0x407240 CreateDialogParamA
0x407244 SetTimer
0x407248 SetWindowTextA
0x40724c SetWindowLongA
0x407250 SetForegroundWindow
0x407254 ShowWindow
0x407258 IsWindow
0x40725c SendMessageTimeoutA
0x407260 FindWindowExA
0x407264 OpenClipboard
0x407268 TrackPopupMenu
0x40726c AppendMenuA
0x407270 DrawTextA
0x407274 EndPaint
0x407278 DestroyWindow
0x40727c wsprintfA
0x407280 PostQuitMessage
GDI32.dll
0x40704c SelectObject
0x407050 SetBkMode
0x407054 CreateFontIndirectA
0x407058 SetTextColor
0x40705c DeleteObject
0x407060 GetDeviceCaps
0x407064 CreateBrushIndirect
0x407068 SetBkColor
SHELL32.dll
0x40716c SHGetSpecialFolderLocation
0x407170 SHGetPathFromIDListA
0x407174 SHBrowseForFolderA
0x407178 SHGetFileInfoA
0x40717c ShellExecuteA
0x407180 SHFileOperationA
ADVAPI32.dll
0x407000 RegDeleteKeyA
0x407004 SetFileSecurityA
0x407008 OpenProcessToken
0x40700c LookupPrivilegeValueA
0x407010 AdjustTokenPrivileges
0x407014 RegOpenKeyExA
0x407018 RegEnumValueA
0x40701c RegDeleteValueA
0x407020 RegCloseKey
0x407024 RegCreateKeyExA
0x407028 RegSetValueExA
0x40702c RegQueryValueExA
0x407030 RegEnumKeyA
COMCTL32.dll
0x407038 ImageList_AddMasked
0x40703c None
0x407040 ImageList_Destroy
0x407044 ImageList_Create
ole32.dll
0x407288 OleUninitialize
0x40728c OleInitialize
0x407290 CoTaskMemFree
0x407294 CoCreateInstance
EAT(Export Address Table) is none