ScreenShot
| Created | 2023.11.04 10:33 | Machine | s1_win7_x6401 |
| Filename | ams.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 54 detected (AIDetectMalware, GenericKD, Sabsik, Artemis, PasswordStealer, Save, malicious, ZexaF, XuY@aqQ1, Attribute, HighConfidence, high confidence, Kryptik, HVCX, score, Redline, kcyhjj, 073mD2RYL6H, hmcwl, RedLineNET, high, Static AI, Malicious PE, Detected, ai score=86, GenKryptik, Amadey, Eldorado, R617866, unsafe, Genetic, R002H0DJV23, Gencirc, GPLS, PWSX, confidence, 100%) | ||
| md5 | 5d26beb8eae1bcf1ba1fc82359f06df2 | ||
| sha256 | 5f0a841a24fe65880413ade13e1f90e07330640f5d0e8e06509a22201c4cb1b1 | ||
| ssdeep | 12288:kPoLpN82bScWfTvDb1XY7L7ezvBq0mBb3EKR234sLw5P6fyxEEi9NgyUI0L:dN82Mi34HsbHL5P6BEi9MI0L | ||
| imphash | 1c05bda56b45141cb2325783d2af620e | ||
| impfuzzy | 48:JdZ+fceMZt2QZcOucBZublNbWge187b6i:TZ+fceMZtHZcXcrublSi | ||
Network IP location
Signature (10cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 54 AntiVirus engines on VirusTotal as malicious |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 CreateEventW
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
kernel32.dll
0x4c672c ExploreEndpoint
0x4c6730 MonitorArtifact
0x4c6734 VisualizeDatabase
0x4c6738 AuthorizeInterface
user32.dll
0x4c6740 ExplorePermission
0x4c6744 AuthorizeModule
0x4c6748 AutomateInterface
advapi32.dll
0x4c6750 OptimizeConfiguration
0x4c6754 MonitorException
0x4c6758 GenerateAlgorithm
0x4c675c ExploreInterface
0x4c6760 DetectLog
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 CreateEventW
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
kernel32.dll
0x4c672c ExploreEndpoint
0x4c6730 MonitorArtifact
0x4c6734 VisualizeDatabase
0x4c6738 AuthorizeInterface
user32.dll
0x4c6740 ExplorePermission
0x4c6744 AuthorizeModule
0x4c6748 AutomateInterface
advapi32.dll
0x4c6750 OptimizeConfiguration
0x4c6754 MonitorException
0x4c6758 GenerateAlgorithm
0x4c675c ExploreInterface
0x4c6760 DetectLog
EAT(Export Address Table) is none