ScreenShot
| Created | 2023.09.04 17:15 | Machine | s1_win7_x6403 |
| Filename | gusan.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 29 detected (AIDetectMalware, Malicious, score, unsafe, Save, ZedlaF, iA8@aW5xK, high confidence, Zenpak, Uztuby, ccmw, EncPk, Static AI, Suspicious SFX, Zusy, Detected, ai score=88, iFzWrkBR7nC, Kryptik, HUEI, confidence) | ||
| md5 | 2b245ca7b7a91f0945275b6e77190e05 | ||
| sha256 | c0ca3b7b303eb521724a9304137fc6a0c4b41b1f0af8c42da41275f17a880114 | ||
| ssdeep | 49152:Hdgas7csAQzAtkF22CH7+9Z1Z1vOpYgkSQ3Su4UuhZ+yesiiFjcf:HgTAQ4HvH7QZfgpJG4tr+yesBFe | ||
| imphash | 0ae9e38912ff6bd742a1b9e5c003576a | ||
| impfuzzy | 48:J9jOXRgLy1XFjsX1Pfc++6W3CYpZBtDXMuniLFH:JdcgLy1XFgX1Pfc++V/7BtDXMuniLFH | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 29 AntiVirus engines on VirusTotal as malicious |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a suspicious process |
| notice | Drops an executable to the user AppData folder |
| notice | Yara rule detected in process memory |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (18cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x434000 GetLastError
0x434004 SetLastError
0x434008 FormatMessageW
0x43400c GetCurrentProcess
0x434010 DeviceIoControl
0x434014 SetFileTime
0x434018 CloseHandle
0x43401c CreateDirectoryW
0x434020 RemoveDirectoryW
0x434024 CreateFileW
0x434028 DeleteFileW
0x43402c CreateHardLinkW
0x434030 GetShortPathNameW
0x434034 GetLongPathNameW
0x434038 MoveFileW
0x43403c GetFileType
0x434040 GetStdHandle
0x434044 WriteFile
0x434048 ReadFile
0x43404c FlushFileBuffers
0x434050 SetEndOfFile
0x434054 SetFilePointer
0x434058 GetCurrentProcessId
0x43405c SetFileAttributesW
0x434060 GetFileAttributesW
0x434064 FindClose
0x434068 FindFirstFileW
0x43406c FindNextFileW
0x434070 InterlockedDecrement
0x434074 GetVersionExW
0x434078 GetCurrentDirectoryW
0x43407c GetFullPathNameW
0x434080 FoldStringW
0x434084 GetModuleFileNameW
0x434088 GetModuleHandleW
0x43408c FindResourceW
0x434090 FreeLibrary
0x434094 GetProcAddress
0x434098 ExitProcess
0x43409c SetThreadExecutionState
0x4340a0 Sleep
0x4340a4 LoadLibraryW
0x4340a8 GetSystemDirectoryW
0x4340ac CompareStringW
0x4340b0 AllocConsole
0x4340b4 FreeConsole
0x4340b8 AttachConsole
0x4340bc WriteConsoleW
0x4340c0 GetProcessAffinityMask
0x4340c4 CreateThread
0x4340c8 SetThreadPriority
0x4340cc InitializeCriticalSection
0x4340d0 EnterCriticalSection
0x4340d4 LeaveCriticalSection
0x4340d8 DeleteCriticalSection
0x4340dc SetEvent
0x4340e0 ResetEvent
0x4340e4 ReleaseSemaphore
0x4340e8 WaitForSingleObject
0x4340ec CreateEventW
0x4340f0 CreateSemaphoreW
0x4340f4 GetSystemTime
0x4340f8 SystemTimeToTzSpecificLocalTime
0x4340fc TzSpecificLocalTimeToSystemTime
0x434100 SystemTimeToFileTime
0x434104 FileTimeToLocalFileTime
0x434108 LocalFileTimeToFileTime
0x43410c FileTimeToSystemTime
0x434110 GetCPInfo
0x434114 IsDBCSLeadByte
0x434118 MultiByteToWideChar
0x43411c WideCharToMultiByte
0x434120 GlobalAlloc
0x434124 LockResource
0x434128 GlobalLock
0x43412c GlobalUnlock
0x434130 GlobalFree
0x434134 LoadResource
0x434138 SizeofResource
0x43413c SetCurrentDirectoryW
0x434140 GetTimeFormatW
0x434144 GetDateFormatW
0x434148 LocalFree
0x43414c GetExitCodeProcess
0x434150 GetLocalTime
0x434154 GetTickCount
0x434158 MapViewOfFile
0x43415c UnmapViewOfFile
0x434160 CreateFileMappingW
0x434164 OpenFileMappingW
0x434168 GetCommandLineW
0x43416c SetEnvironmentVariableW
0x434170 ExpandEnvironmentStringsW
0x434174 GetTempPathW
0x434178 MoveFileExW
0x43417c GetLocaleInfoW
0x434180 GetNumberFormatW
0x434184 DecodePointer
0x434188 SetFilePointerEx
0x43418c GetConsoleMode
0x434190 GetConsoleCP
0x434194 HeapSize
0x434198 SetStdHandle
0x43419c GetProcessHeap
0x4341a0 FreeEnvironmentStringsW
0x4341a4 GetEnvironmentStringsW
0x4341a8 GetCommandLineA
0x4341ac GetOEMCP
0x4341b0 RaiseException
0x4341b4 GetSystemInfo
0x4341b8 VirtualProtect
0x4341bc VirtualQuery
0x4341c0 LoadLibraryExA
0x4341c4 IsProcessorFeaturePresent
0x4341c8 IsDebuggerPresent
0x4341cc UnhandledExceptionFilter
0x4341d0 SetUnhandledExceptionFilter
0x4341d4 GetStartupInfoW
0x4341d8 QueryPerformanceCounter
0x4341dc GetCurrentThreadId
0x4341e0 GetSystemTimeAsFileTime
0x4341e4 InitializeSListHead
0x4341e8 TerminateProcess
0x4341ec RtlUnwind
0x4341f0 EncodePointer
0x4341f4 InitializeCriticalSectionAndSpinCount
0x4341f8 TlsAlloc
0x4341fc TlsGetValue
0x434200 TlsSetValue
0x434204 TlsFree
0x434208 LoadLibraryExW
0x43420c QueryPerformanceFrequency
0x434210 GetModuleHandleExW
0x434214 GetModuleFileNameA
0x434218 GetACP
0x43421c HeapFree
0x434220 HeapReAlloc
0x434224 HeapAlloc
0x434228 GetStringTypeW
0x43422c LCMapStringW
0x434230 FindFirstFileExA
0x434234 FindNextFileA
0x434238 IsValidCodePage
OLEAUT32.dll
0x434240 SysAllocString
0x434244 SysFreeString
0x434248 VariantClear
gdiplus.dll
0x434250 GdipAlloc
0x434254 GdipDisposeImage
0x434258 GdipCloneImage
0x43425c GdipCreateBitmapFromStream
0x434260 GdipCreateBitmapFromStreamICM
0x434264 GdipCreateHBITMAPFromBitmap
0x434268 GdiplusStartup
0x43426c GdiplusShutdown
0x434270 GdipFree
EAT(Export Address Table) Library
KERNEL32.dll
0x434000 GetLastError
0x434004 SetLastError
0x434008 FormatMessageW
0x43400c GetCurrentProcess
0x434010 DeviceIoControl
0x434014 SetFileTime
0x434018 CloseHandle
0x43401c CreateDirectoryW
0x434020 RemoveDirectoryW
0x434024 CreateFileW
0x434028 DeleteFileW
0x43402c CreateHardLinkW
0x434030 GetShortPathNameW
0x434034 GetLongPathNameW
0x434038 MoveFileW
0x43403c GetFileType
0x434040 GetStdHandle
0x434044 WriteFile
0x434048 ReadFile
0x43404c FlushFileBuffers
0x434050 SetEndOfFile
0x434054 SetFilePointer
0x434058 GetCurrentProcessId
0x43405c SetFileAttributesW
0x434060 GetFileAttributesW
0x434064 FindClose
0x434068 FindFirstFileW
0x43406c FindNextFileW
0x434070 InterlockedDecrement
0x434074 GetVersionExW
0x434078 GetCurrentDirectoryW
0x43407c GetFullPathNameW
0x434080 FoldStringW
0x434084 GetModuleFileNameW
0x434088 GetModuleHandleW
0x43408c FindResourceW
0x434090 FreeLibrary
0x434094 GetProcAddress
0x434098 ExitProcess
0x43409c SetThreadExecutionState
0x4340a0 Sleep
0x4340a4 LoadLibraryW
0x4340a8 GetSystemDirectoryW
0x4340ac CompareStringW
0x4340b0 AllocConsole
0x4340b4 FreeConsole
0x4340b8 AttachConsole
0x4340bc WriteConsoleW
0x4340c0 GetProcessAffinityMask
0x4340c4 CreateThread
0x4340c8 SetThreadPriority
0x4340cc InitializeCriticalSection
0x4340d0 EnterCriticalSection
0x4340d4 LeaveCriticalSection
0x4340d8 DeleteCriticalSection
0x4340dc SetEvent
0x4340e0 ResetEvent
0x4340e4 ReleaseSemaphore
0x4340e8 WaitForSingleObject
0x4340ec CreateEventW
0x4340f0 CreateSemaphoreW
0x4340f4 GetSystemTime
0x4340f8 SystemTimeToTzSpecificLocalTime
0x4340fc TzSpecificLocalTimeToSystemTime
0x434100 SystemTimeToFileTime
0x434104 FileTimeToLocalFileTime
0x434108 LocalFileTimeToFileTime
0x43410c FileTimeToSystemTime
0x434110 GetCPInfo
0x434114 IsDBCSLeadByte
0x434118 MultiByteToWideChar
0x43411c WideCharToMultiByte
0x434120 GlobalAlloc
0x434124 LockResource
0x434128 GlobalLock
0x43412c GlobalUnlock
0x434130 GlobalFree
0x434134 LoadResource
0x434138 SizeofResource
0x43413c SetCurrentDirectoryW
0x434140 GetTimeFormatW
0x434144 GetDateFormatW
0x434148 LocalFree
0x43414c GetExitCodeProcess
0x434150 GetLocalTime
0x434154 GetTickCount
0x434158 MapViewOfFile
0x43415c UnmapViewOfFile
0x434160 CreateFileMappingW
0x434164 OpenFileMappingW
0x434168 GetCommandLineW
0x43416c SetEnvironmentVariableW
0x434170 ExpandEnvironmentStringsW
0x434174 GetTempPathW
0x434178 MoveFileExW
0x43417c GetLocaleInfoW
0x434180 GetNumberFormatW
0x434184 DecodePointer
0x434188 SetFilePointerEx
0x43418c GetConsoleMode
0x434190 GetConsoleCP
0x434194 HeapSize
0x434198 SetStdHandle
0x43419c GetProcessHeap
0x4341a0 FreeEnvironmentStringsW
0x4341a4 GetEnvironmentStringsW
0x4341a8 GetCommandLineA
0x4341ac GetOEMCP
0x4341b0 RaiseException
0x4341b4 GetSystemInfo
0x4341b8 VirtualProtect
0x4341bc VirtualQuery
0x4341c0 LoadLibraryExA
0x4341c4 IsProcessorFeaturePresent
0x4341c8 IsDebuggerPresent
0x4341cc UnhandledExceptionFilter
0x4341d0 SetUnhandledExceptionFilter
0x4341d4 GetStartupInfoW
0x4341d8 QueryPerformanceCounter
0x4341dc GetCurrentThreadId
0x4341e0 GetSystemTimeAsFileTime
0x4341e4 InitializeSListHead
0x4341e8 TerminateProcess
0x4341ec RtlUnwind
0x4341f0 EncodePointer
0x4341f4 InitializeCriticalSectionAndSpinCount
0x4341f8 TlsAlloc
0x4341fc TlsGetValue
0x434200 TlsSetValue
0x434204 TlsFree
0x434208 LoadLibraryExW
0x43420c QueryPerformanceFrequency
0x434210 GetModuleHandleExW
0x434214 GetModuleFileNameA
0x434218 GetACP
0x43421c HeapFree
0x434220 HeapReAlloc
0x434224 HeapAlloc
0x434228 GetStringTypeW
0x43422c LCMapStringW
0x434230 FindFirstFileExA
0x434234 FindNextFileA
0x434238 IsValidCodePage
OLEAUT32.dll
0x434240 SysAllocString
0x434244 SysFreeString
0x434248 VariantClear
gdiplus.dll
0x434250 GdipAlloc
0x434254 GdipDisposeImage
0x434258 GdipCloneImage
0x43425c GdipCreateBitmapFromStream
0x434260 GdipCreateBitmapFromStreamICM
0x434264 GdipCreateHBITMAPFromBitmap
0x434268 GdiplusStartup
0x43426c GdiplusShutdown
0x434270 GdipFree
EAT(Export Address Table) Library