ScreenShot
| Created | 2023.10.17 10:04 | Machine | s1_win7_x6401 |
| Filename | 1 | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 2 detected (Bitrep, Generic@AI, RDML, 2oGF09Y, lvba50YYSY6mcA) | ||
| md5 | 2a8cb72531364c728a5d258ae273f69e | ||
| sha256 | 9ec36a5e74861894d8f738e486956fd52899a780dbd759853b1ea8093645e090 | ||
| ssdeep | 12288:HNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSvPJINR:HthTiP+ffCfB5Lf0F7Z1EKPeNR | ||
| imphash | 91c9c82d5da6c673b4454be0c166d822 | ||
| impfuzzy | 12:VA/DzqYOZxIBy21TAmgOtHSXIThdZ4CMXu/:V0DBauDuOtHSXGJWy | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| notice | File has been identified by 2 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| info | Checks amount of memory in system |
| info | One or more processes crashed |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.DLL
0x53e6d0 LoadLibraryA
0x53e6d4 GetProcAddress
0x53e6d8 VirtualProtect
0x53e6dc VirtualAlloc
0x53e6e0 VirtualFree
0x53e6e4 ExitProcess
ADVAPI32.dll
0x53e6ec FreeSid
COMCTL32.dll
0x53e6f4 None
comdlg32.dll
0x53e6fc GetFileTitleA
GDI32.dll
0x53e704 SaveDC
NETAPI32.dll
0x53e70c Netbios
ole32.dll
0x53e714 CoInitialize
OLEAUT32.dll
0x53e71c RegisterTypeLib
oledlg.dll
0x53e724 None
OLEPRO32.DLL
0x53e72c None
SHELL32.dll
0x53e734 DragFinish
urlmon.dll
0x53e73c URLDownloadToFileA
USER32.dll
0x53e744 GetDC
VERSION.dll
0x53e74c VerQueryValueA
WININET.dll
0x53e754 FtpOpenFileA
WINMM.dll
0x53e75c timeGetTime
WINSPOOL.DRV
0x53e764 OpenPrinterA
EAT(Export Address Table) is none
KERNEL32.DLL
0x53e6d0 LoadLibraryA
0x53e6d4 GetProcAddress
0x53e6d8 VirtualProtect
0x53e6dc VirtualAlloc
0x53e6e0 VirtualFree
0x53e6e4 ExitProcess
ADVAPI32.dll
0x53e6ec FreeSid
COMCTL32.dll
0x53e6f4 None
comdlg32.dll
0x53e6fc GetFileTitleA
GDI32.dll
0x53e704 SaveDC
NETAPI32.dll
0x53e70c Netbios
ole32.dll
0x53e714 CoInitialize
OLEAUT32.dll
0x53e71c RegisterTypeLib
oledlg.dll
0x53e724 None
OLEPRO32.DLL
0x53e72c None
SHELL32.dll
0x53e734 DragFinish
urlmon.dll
0x53e73c URLDownloadToFileA
USER32.dll
0x53e744 GetDC
VERSION.dll
0x53e74c VerQueryValueA
WININET.dll
0x53e754 FtpOpenFileA
WINMM.dll
0x53e75c timeGetTime
WINSPOOL.DRV
0x53e764 OpenPrinterA
EAT(Export Address Table) is none