ScreenShot
| Created | 2023.10.27 07:38 | Machine | s1_win7_x6403 |
| Filename | EasySup.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 32 detected (AIDetectMalware, RedLineNET, Artemis, unsafe, Save, Attribute, HighConfidence, malicious, high confidence, GenKryptik, GPLS, Mine, Kryptik, NGnqaWXxXjL, Cinoshi, Zbot, Eldorado, hilgh, Casdet, score, BScope, TrojanPSW, RedLine, Chgt, Kqil, Static AI, Malicious PE, CrypterX, confidence, 100%) | ||
| md5 | 0630254696658572f31b822013f00a6a | ||
| sha256 | 4b881729396aae4d3e2db8717899acf7a07a0979075f633e83c2e397ba1d0498 | ||
| ssdeep | 49152:e5ZyS3M73PwAERsyxudJziMv6nWPdofD4Oj03DC:e5ZyS3KwAERJxudJpd04n | ||
| imphash | 66bc811ac894535ffcee36d78d1ccd29 | ||
| impfuzzy | 24:WjKNDo7kNdZ+fcslmMZt/OovRB7dOJ3CFQHRyvuT4PjMdZA5l7F:HdZ+fcdMZt2QZMOuc8Zu7 | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 32 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates an executable file in a user folder |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (10cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | MPRESS_Zero | MPRESS packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | url_file_format | Microsoft Windows Internet Shortcut File Format | binaries (download) |
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 InterlockedIncrement
0x41f028 InterlockedDecrement
0x41f02c WideCharToMultiByte
0x41f030 InterlockedExchange
0x41f034 InitializeCriticalSection
0x41f038 DeleteCriticalSection
0x41f03c EnterCriticalSection
0x41f040 LeaveCriticalSection
0x41f044 MultiByteToWideChar
0x41f048 GetLastError
0x41f04c HeapFree
0x41f050 HeapAlloc
0x41f054 GetSystemTimeAsFileTime
0x41f058 RtlUnwind
0x41f05c RaiseException
0x41f060 TerminateProcess
0x41f064 GetCurrentProcess
0x41f068 UnhandledExceptionFilter
0x41f06c SetUnhandledExceptionFilter
0x41f070 IsDebuggerPresent
0x41f074 GetCommandLineA
0x41f078 GetCPInfo
0x41f07c LCMapStringA
0x41f080 LCMapStringW
0x41f084 HeapCreate
0x41f088 VirtualFree
0x41f08c HeapReAlloc
0x41f090 GetModuleHandleW
0x41f094 ExitProcess
0x41f098 WriteFile
0x41f09c GetStdHandle
0x41f0a0 GetModuleFileNameA
0x41f0a4 ReadFile
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetConsoleCP
0x41f0ec GetConsoleMode
0x41f0f0 FlushFileBuffers
0x41f0f4 SetFilePointer
0x41f0f8 CloseHandle
0x41f0fc HeapSize
0x41f100 GetACP
0x41f104 GetOEMCP
0x41f108 IsValidCodePage
0x41f10c GetUserDefaultLCID
0x41f110 GetLocaleInfoA
0x41f114 EnumSystemLocalesA
0x41f118 IsValidLocale
0x41f11c GetStringTypeA
0x41f120 GetStringTypeW
0x41f124 InitializeCriticalSectionAndSpinCount
0x41f128 SetStdHandle
0x41f12c WriteConsoleA
0x41f130 GetConsoleOutputCP
0x41f134 WriteConsoleW
0x41f138 GetLocaleInfoW
0x41f13c CreateFileA
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 InterlockedIncrement
0x41f028 InterlockedDecrement
0x41f02c WideCharToMultiByte
0x41f030 InterlockedExchange
0x41f034 InitializeCriticalSection
0x41f038 DeleteCriticalSection
0x41f03c EnterCriticalSection
0x41f040 LeaveCriticalSection
0x41f044 MultiByteToWideChar
0x41f048 GetLastError
0x41f04c HeapFree
0x41f050 HeapAlloc
0x41f054 GetSystemTimeAsFileTime
0x41f058 RtlUnwind
0x41f05c RaiseException
0x41f060 TerminateProcess
0x41f064 GetCurrentProcess
0x41f068 UnhandledExceptionFilter
0x41f06c SetUnhandledExceptionFilter
0x41f070 IsDebuggerPresent
0x41f074 GetCommandLineA
0x41f078 GetCPInfo
0x41f07c LCMapStringA
0x41f080 LCMapStringW
0x41f084 HeapCreate
0x41f088 VirtualFree
0x41f08c HeapReAlloc
0x41f090 GetModuleHandleW
0x41f094 ExitProcess
0x41f098 WriteFile
0x41f09c GetStdHandle
0x41f0a0 GetModuleFileNameA
0x41f0a4 ReadFile
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetConsoleCP
0x41f0ec GetConsoleMode
0x41f0f0 FlushFileBuffers
0x41f0f4 SetFilePointer
0x41f0f8 CloseHandle
0x41f0fc HeapSize
0x41f100 GetACP
0x41f104 GetOEMCP
0x41f108 IsValidCodePage
0x41f10c GetUserDefaultLCID
0x41f110 GetLocaleInfoA
0x41f114 EnumSystemLocalesA
0x41f118 IsValidLocale
0x41f11c GetStringTypeA
0x41f120 GetStringTypeW
0x41f124 InitializeCriticalSectionAndSpinCount
0x41f128 SetStdHandle
0x41f12c WriteConsoleA
0x41f130 GetConsoleOutputCP
0x41f134 WriteConsoleW
0x41f138 GetLocaleInfoW
0x41f13c CreateFileA
EAT(Export Address Table) is none