ScreenShot
| Created | 2023.09.12 07:41 | Machine | s1_win7_x6401 |
| Filename | WUDFHost.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 47 detected (AIDetectMalware, Stealerc, malicious, high confidence, GenericKD, Artemis, unsafe, Save, confidence, 100%, Kryptik, Eldorado, Attribute, HighConfidence, HUOO, score, Androm, DropperX, Obfuscated, fnxtw, Siggen3, Lockbit, moderate, Static AI, Suspicious PE, StopCrypt, LokiBot, Detected, R604820, ai score=80, Chgt, R002H07IB23, Generic@AI, RDML, KKA5N+pqvKy9tMpDvKvVA, susgen, GenKryptik, ERHN) | ||
| md5 | 43d6aa62427fda7e63d503d069c22f63 | ||
| sha256 | 74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60 | ||
| ssdeep | 3072:ARpsLVByCZ7CQLyCNfg6ALiF6CJnFbULE5ATYd6xZ:lLydQLyUgL0FbETYd0 | ||
| imphash | f815858bb8146375fb6d659cf6f7de7c | ||
| impfuzzy | 24:AXfaQrkrkR1IUlJcDACjTsdCuZHntT2cf6hIeRvYHfHuO2S2luHnjM/hcvIb14yS:AXfomweticf0dYHx2S2sHwavIbGylQ | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | This executable has a PDB path |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x401008 CreateFileA
0x40100c SetThreadContext
0x401010 FindFirstChangeNotificationW
0x401014 PeekNamedPipe
0x401018 SetEndOfFile
0x40101c FreeEnvironmentStringsA
0x401020 GetTickCount
0x401024 GetConsoleAliasesLengthA
0x401028 GetDateFormatA
0x40102c ReadConsoleInputA
0x401030 SizeofResource
0x401034 GetFileAttributesW
0x401038 FileTimeToSystemTime
0x40103c GlobalUnlock
0x401040 GetShortPathNameA
0x401044 FindFirstFileA
0x401048 GetLogicalDriveStringsA
0x40104c GetLastError
0x401050 SetLastError
0x401054 GetProcAddress
0x401058 GetTempFileNameW
0x40105c BackupWrite
0x401060 LoadLibraryA
0x401064 CreateHardLinkW
0x401068 SetConsoleCtrlHandler
0x40106c SetFileApisToANSI
0x401070 BeginUpdateResourceA
0x401074 OpenJobObjectW
0x401078 FoldStringA
0x40107c GetModuleHandleA
0x401080 SetCalendarInfoA
0x401084 FindFirstVolumeW
0x401088 ReadConsoleOutputCharacterW
0x40108c WriteConsoleW
0x401090 GetConsoleOutputCP
0x401094 WriteConsoleA
0x401098 CloseHandle
0x40109c VirtualAlloc
0x4010a0 HeapFree
0x4010a4 TerminateProcess
0x4010a8 GetCurrentProcess
0x4010ac UnhandledExceptionFilter
0x4010b0 SetUnhandledExceptionFilter
0x4010b4 IsDebuggerPresent
0x4010b8 GetStartupInfoW
0x4010bc HeapAlloc
0x4010c0 HeapCreate
0x4010c4 VirtualFree
0x4010c8 DeleteCriticalSection
0x4010cc LeaveCriticalSection
0x4010d0 EnterCriticalSection
0x4010d4 HeapReAlloc
0x4010d8 GetModuleHandleW
0x4010dc TlsGetValue
0x4010e0 TlsAlloc
0x4010e4 TlsSetValue
0x4010e8 TlsFree
0x4010ec InterlockedIncrement
0x4010f0 GetCurrentThreadId
0x4010f4 InterlockedDecrement
0x4010f8 SetHandleCount
0x4010fc GetStdHandle
0x401100 GetFileType
0x401104 GetStartupInfoA
0x401108 SetFilePointer
0x40110c RaiseException
0x401110 Sleep
0x401114 ExitProcess
0x401118 WriteFile
0x40111c GetModuleFileNameA
0x401120 GetModuleFileNameW
0x401124 FreeEnvironmentStringsW
0x401128 GetEnvironmentStringsW
0x40112c GetCommandLineW
0x401130 QueryPerformanceCounter
0x401134 GetCurrentProcessId
0x401138 GetSystemTimeAsFileTime
0x40113c InitializeCriticalSectionAndSpinCount
0x401140 RtlUnwind
0x401144 GetCPInfo
0x401148 GetACP
0x40114c GetOEMCP
0x401150 IsValidCodePage
0x401154 SetStdHandle
0x401158 HeapSize
0x40115c LCMapStringA
0x401160 WideCharToMultiByte
0x401164 MultiByteToWideChar
0x401168 LCMapStringW
0x40116c GetStringTypeA
0x401170 GetStringTypeW
0x401174 GetLocaleInfoA
0x401178 GetConsoleCP
0x40117c GetConsoleMode
0x401180 FlushFileBuffers
USER32.dll
0x401188 GetMessageExtraInfo
0x40118c LoadMenuA
0x401190 DdeQueryStringW
0x401194 GetClassInfoExW
0x401198 GetKeyNameTextW
0x40119c CharToOemBuffW
0x4011a0 SetClipboardViewer
GDI32.dll
0x401000 CreateDCA
EAT(Export Address Table) is none
KERNEL32.dll
0x401008 CreateFileA
0x40100c SetThreadContext
0x401010 FindFirstChangeNotificationW
0x401014 PeekNamedPipe
0x401018 SetEndOfFile
0x40101c FreeEnvironmentStringsA
0x401020 GetTickCount
0x401024 GetConsoleAliasesLengthA
0x401028 GetDateFormatA
0x40102c ReadConsoleInputA
0x401030 SizeofResource
0x401034 GetFileAttributesW
0x401038 FileTimeToSystemTime
0x40103c GlobalUnlock
0x401040 GetShortPathNameA
0x401044 FindFirstFileA
0x401048 GetLogicalDriveStringsA
0x40104c GetLastError
0x401050 SetLastError
0x401054 GetProcAddress
0x401058 GetTempFileNameW
0x40105c BackupWrite
0x401060 LoadLibraryA
0x401064 CreateHardLinkW
0x401068 SetConsoleCtrlHandler
0x40106c SetFileApisToANSI
0x401070 BeginUpdateResourceA
0x401074 OpenJobObjectW
0x401078 FoldStringA
0x40107c GetModuleHandleA
0x401080 SetCalendarInfoA
0x401084 FindFirstVolumeW
0x401088 ReadConsoleOutputCharacterW
0x40108c WriteConsoleW
0x401090 GetConsoleOutputCP
0x401094 WriteConsoleA
0x401098 CloseHandle
0x40109c VirtualAlloc
0x4010a0 HeapFree
0x4010a4 TerminateProcess
0x4010a8 GetCurrentProcess
0x4010ac UnhandledExceptionFilter
0x4010b0 SetUnhandledExceptionFilter
0x4010b4 IsDebuggerPresent
0x4010b8 GetStartupInfoW
0x4010bc HeapAlloc
0x4010c0 HeapCreate
0x4010c4 VirtualFree
0x4010c8 DeleteCriticalSection
0x4010cc LeaveCriticalSection
0x4010d0 EnterCriticalSection
0x4010d4 HeapReAlloc
0x4010d8 GetModuleHandleW
0x4010dc TlsGetValue
0x4010e0 TlsAlloc
0x4010e4 TlsSetValue
0x4010e8 TlsFree
0x4010ec InterlockedIncrement
0x4010f0 GetCurrentThreadId
0x4010f4 InterlockedDecrement
0x4010f8 SetHandleCount
0x4010fc GetStdHandle
0x401100 GetFileType
0x401104 GetStartupInfoA
0x401108 SetFilePointer
0x40110c RaiseException
0x401110 Sleep
0x401114 ExitProcess
0x401118 WriteFile
0x40111c GetModuleFileNameA
0x401120 GetModuleFileNameW
0x401124 FreeEnvironmentStringsW
0x401128 GetEnvironmentStringsW
0x40112c GetCommandLineW
0x401130 QueryPerformanceCounter
0x401134 GetCurrentProcessId
0x401138 GetSystemTimeAsFileTime
0x40113c InitializeCriticalSectionAndSpinCount
0x401140 RtlUnwind
0x401144 GetCPInfo
0x401148 GetACP
0x40114c GetOEMCP
0x401150 IsValidCodePage
0x401154 SetStdHandle
0x401158 HeapSize
0x40115c LCMapStringA
0x401160 WideCharToMultiByte
0x401164 MultiByteToWideChar
0x401168 LCMapStringW
0x40116c GetStringTypeA
0x401170 GetStringTypeW
0x401174 GetLocaleInfoA
0x401178 GetConsoleCP
0x40117c GetConsoleMode
0x401180 FlushFileBuffers
USER32.dll
0x401188 GetMessageExtraInfo
0x40118c LoadMenuA
0x401190 DdeQueryStringW
0x401194 GetClassInfoExW
0x401198 GetKeyNameTextW
0x40119c CharToOemBuffW
0x4011a0 SetClipboardViewer
GDI32.dll
0x401000 CreateDCA
EAT(Export Address Table) is none