ScreenShot
| Created | 2023.08.11 09:41 | Machine | s1_win7_x6402 |
| Filename | getReasonData.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 38 detected (AIDetectMalware, ClipBanker, Malicious, score, Artemis, unsafe, Bulz, V0x2, Attribute, HighConfidence, high confidence, Infected, Wacatac, ai score=86, Chgt, R002H07HA23, Generic@AI, RDML, pZ1OF2pZAK0GjG, SyozrRQ, susgen, PossibleThreat, PALLAS, ZexaF, luW@aKRsOzhi, confidence) | ||
| md5 | 39a3b5a48178b860ba3c69dfa191e974 | ||
| sha256 | 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c | ||
| ssdeep | 3072:9jD+r9R81DhTnVZ34NeOOHqB8q5YRtU2a7JhXl56GwOAg0FuD0SOVRxPn:JqrmhLVZzdjqYRtUj62AO/OJ/ | ||
| imphash | e84e4993c2bc4df63d5fc80b1b577981 | ||
| impfuzzy | 24:LeMU4JcpVWPrBtoS1CMdlJBl3eDoros4ZMvRpOovbOPZ/AaZllLbu3:L3JcpVSrBtoS1CMDpXQZGC3RAaZll23 | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 38 AntiVirus engines on VirusTotal as malicious |
| watch | Installs itself for autorun at Windows startup |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f00c Sleep
0x41f010 GlobalAlloc
0x41f014 GlobalLock
0x41f018 OpenMutexW
0x41f01c GlobalUnlock
0x41f020 MultiByteToWideChar
0x41f024 CloseHandle
0x41f028 GetConsoleMode
0x41f02c GetConsoleOutputCP
0x41f030 FlushFileBuffers
0x41f034 CreateMutexW
0x41f038 CreateFileW
0x41f03c GetModuleFileNameW
0x41f040 WideCharToMultiByte
0x41f044 LCMapStringEx
0x41f048 EnterCriticalSection
0x41f04c LeaveCriticalSection
0x41f050 InitializeCriticalSectionEx
0x41f054 DeleteCriticalSection
0x41f058 EncodePointer
0x41f05c DecodePointer
0x41f060 CompareStringEx
0x41f064 GetCPInfo
0x41f068 GetStringTypeW
0x41f06c IsProcessorFeaturePresent
0x41f070 UnhandledExceptionFilter
0x41f074 SetUnhandledExceptionFilter
0x41f078 GetCurrentProcess
0x41f07c TerminateProcess
0x41f080 IsDebuggerPresent
0x41f084 GetStartupInfoW
0x41f088 GetModuleHandleW
0x41f08c QueryPerformanceCounter
0x41f090 GetCurrentProcessId
0x41f094 GetCurrentThreadId
0x41f098 GetSystemTimeAsFileTime
0x41f09c InitializeSListHead
0x41f0a0 RtlUnwind
0x41f0a4 RaiseException
0x41f0a8 GetLastError
0x41f0ac SetLastError
0x41f0b0 InitializeCriticalSectionAndSpinCount
0x41f0b4 TlsAlloc
0x41f0b8 TlsGetValue
0x41f0bc TlsSetValue
0x41f0c0 TlsFree
0x41f0c4 FreeLibrary
0x41f0c8 GetProcAddress
0x41f0cc LoadLibraryExW
0x41f0d0 ExitProcess
0x41f0d4 GetModuleHandleExW
0x41f0d8 GetStdHandle
0x41f0dc WriteFile
0x41f0e0 HeapReAlloc
0x41f0e4 HeapFree
0x41f0e8 HeapAlloc
0x41f0ec LCMapStringW
0x41f0f0 GetLocaleInfoW
0x41f0f4 IsValidLocale
0x41f0f8 GetUserDefaultLCID
0x41f0fc EnumSystemLocalesW
0x41f100 GetFileType
0x41f104 FindClose
0x41f108 FindFirstFileExW
0x41f10c FindNextFileW
0x41f110 IsValidCodePage
0x41f114 GetACP
0x41f118 GetOEMCP
0x41f11c GetCommandLineA
0x41f120 GetCommandLineW
0x41f124 GetEnvironmentStringsW
0x41f128 FreeEnvironmentStringsW
0x41f12c GetProcessHeap
0x41f130 SetStdHandle
0x41f134 SetFilePointerEx
0x41f138 HeapSize
0x41f13c WriteConsoleW
USER32.dll
0x41f144 EmptyClipboard
0x41f148 GetClipboardData
0x41f14c SetClipboardData
0x41f150 CloseClipboard
0x41f154 OpenClipboard
ADVAPI32.dll
0x41f000 RegCreateKeyW
0x41f004 RegSetValueExW
EAT(Export Address Table) is none
KERNEL32.dll
0x41f00c Sleep
0x41f010 GlobalAlloc
0x41f014 GlobalLock
0x41f018 OpenMutexW
0x41f01c GlobalUnlock
0x41f020 MultiByteToWideChar
0x41f024 CloseHandle
0x41f028 GetConsoleMode
0x41f02c GetConsoleOutputCP
0x41f030 FlushFileBuffers
0x41f034 CreateMutexW
0x41f038 CreateFileW
0x41f03c GetModuleFileNameW
0x41f040 WideCharToMultiByte
0x41f044 LCMapStringEx
0x41f048 EnterCriticalSection
0x41f04c LeaveCriticalSection
0x41f050 InitializeCriticalSectionEx
0x41f054 DeleteCriticalSection
0x41f058 EncodePointer
0x41f05c DecodePointer
0x41f060 CompareStringEx
0x41f064 GetCPInfo
0x41f068 GetStringTypeW
0x41f06c IsProcessorFeaturePresent
0x41f070 UnhandledExceptionFilter
0x41f074 SetUnhandledExceptionFilter
0x41f078 GetCurrentProcess
0x41f07c TerminateProcess
0x41f080 IsDebuggerPresent
0x41f084 GetStartupInfoW
0x41f088 GetModuleHandleW
0x41f08c QueryPerformanceCounter
0x41f090 GetCurrentProcessId
0x41f094 GetCurrentThreadId
0x41f098 GetSystemTimeAsFileTime
0x41f09c InitializeSListHead
0x41f0a0 RtlUnwind
0x41f0a4 RaiseException
0x41f0a8 GetLastError
0x41f0ac SetLastError
0x41f0b0 InitializeCriticalSectionAndSpinCount
0x41f0b4 TlsAlloc
0x41f0b8 TlsGetValue
0x41f0bc TlsSetValue
0x41f0c0 TlsFree
0x41f0c4 FreeLibrary
0x41f0c8 GetProcAddress
0x41f0cc LoadLibraryExW
0x41f0d0 ExitProcess
0x41f0d4 GetModuleHandleExW
0x41f0d8 GetStdHandle
0x41f0dc WriteFile
0x41f0e0 HeapReAlloc
0x41f0e4 HeapFree
0x41f0e8 HeapAlloc
0x41f0ec LCMapStringW
0x41f0f0 GetLocaleInfoW
0x41f0f4 IsValidLocale
0x41f0f8 GetUserDefaultLCID
0x41f0fc EnumSystemLocalesW
0x41f100 GetFileType
0x41f104 FindClose
0x41f108 FindFirstFileExW
0x41f10c FindNextFileW
0x41f110 IsValidCodePage
0x41f114 GetACP
0x41f118 GetOEMCP
0x41f11c GetCommandLineA
0x41f120 GetCommandLineW
0x41f124 GetEnvironmentStringsW
0x41f128 FreeEnvironmentStringsW
0x41f12c GetProcessHeap
0x41f130 SetStdHandle
0x41f134 SetFilePointerEx
0x41f138 HeapSize
0x41f13c WriteConsoleW
USER32.dll
0x41f144 EmptyClipboard
0x41f148 GetClipboardData
0x41f14c SetClipboardData
0x41f150 CloseClipboard
0x41f154 OpenClipboard
ADVAPI32.dll
0x41f000 RegCreateKeyW
0x41f004 RegSetValueExW
EAT(Export Address Table) is none