ScreenShot
| Created | 2023.09.26 11:27 | Machine | s1_win7_x6401 |
| Filename | rc | ||
| Type | PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 11d10cfdac2a8c8dd30f80d6a2dad667 | ||
| sha256 | 8b9022ce84b39a17c4dd4f48a0fdacf89f8f35a1e03e2b7131cd8e35990d3d24 | ||
| ssdeep | 192:IU5z9i9veq2pJk+/qcJklyJOEtuF08TjsvGQwrgAhp:9z9SvWJH/IwJOUuF08UeQwrgC | ||
| imphash | fd410436ce0407a0a8f79bfce8af0bc3 | ||
| impfuzzy | 6:9mRxybmRxn5X0ZRHmRxT7mRx8Jt0yRlbmARrKXVNIV5GGaJvuqBYq0IquZzwD3:YRJRJJoARZqRNqBrKlaRa91Kq0iZzwD3 | ||
Network IP location
Signature (0cnts)
| Level | Description |
|---|
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x1f6969128 DeleteCriticalSection
0x1f6969130 EnterCriticalSection
0x1f6969138 GetLastError
0x1f6969140 InitializeCriticalSection
0x1f6969148 LeaveCriticalSection
0x1f6969150 Sleep
0x1f6969158 TlsGetValue
0x1f6969160 VirtualProtect
0x1f6969168 VirtualQuery
0x1f6969170 WinExec
msvcrt.dll
0x1f6969180 __iob_func
0x1f6969188 _amsg_exit
0x1f6969190 _initterm
0x1f6969198 _lock
0x1f69691a0 _unlock
0x1f69691a8 abort
0x1f69691b0 calloc
0x1f69691b8 free
0x1f69691c0 fwrite
0x1f69691c8 realloc
0x1f69691d0 strlen
0x1f69691d8 strncmp
0x1f69691e0 vfprintf
USER32.dll
0x1f69691f0 MessageBoxA
EAT(Export Address Table) Library
0x1f6963000 hash
0x1f69613a0 reverseString
0x1f69613f0 xlAutoOpen
KERNEL32.dll
0x1f6969128 DeleteCriticalSection
0x1f6969130 EnterCriticalSection
0x1f6969138 GetLastError
0x1f6969140 InitializeCriticalSection
0x1f6969148 LeaveCriticalSection
0x1f6969150 Sleep
0x1f6969158 TlsGetValue
0x1f6969160 VirtualProtect
0x1f6969168 VirtualQuery
0x1f6969170 WinExec
msvcrt.dll
0x1f6969180 __iob_func
0x1f6969188 _amsg_exit
0x1f6969190 _initterm
0x1f6969198 _lock
0x1f69691a0 _unlock
0x1f69691a8 abort
0x1f69691b0 calloc
0x1f69691b8 free
0x1f69691c0 fwrite
0x1f69691c8 realloc
0x1f69691d0 strlen
0x1f69691d8 strncmp
0x1f69691e0 vfprintf
USER32.dll
0x1f69691f0 MessageBoxA
EAT(Export Address Table) Library
0x1f6963000 hash
0x1f69613a0 reverseString
0x1f69613f0 xlAutoOpen