ScreenShot
| Created | 2023.11.07 19:13 | Machine | s1_win7_x6401 |
| Filename | build.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | 02f447aa40e3fd73d05c72ed4249ff4d | ||
| sha256 | 3217806522d0eb77558f5a0c1aa9dc3a77cbfd6bc64df7e2442b5d3cb8e13ae6 | ||
| ssdeep | 6144:ZIULy2HQwnuyJbuevg3B4TVJRR+ZDeCCJFpsfajLpQqO6ijn:Ztm2wwnuyJbW4TRRCmJFpsfYTOpn | ||
| imphash | fb06b251ec823ec2b055f38e217cf323 | ||
| impfuzzy | 48:kTpiOwOERAdR2KKSGJttScfr0uuSB2CQlf:StxR2HSGJttScfrkSBV0 | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x401014 GetConsoleAliasesLengthW
0x401018 SetComputerNameExA
0x40101c GetConsoleAliasExesLengthA
0x401020 FindResourceW
0x401024 BuildCommDCBAndTimeoutsA
0x401028 DeleteVolumeMountPointA
0x40102c GlobalAddAtomA
0x401030 GetCommState
0x401034 GetSystemWindowsDirectoryW
0x401038 CreateDirectoryW
0x40103c AddConsoleAliasW
0x401040 FindCloseChangeNotification
0x401044 FreeEnvironmentStringsA
0x401048 GetModuleHandleW
0x40104c GetTickCount
0x401050 CreateNamedPipeW
0x401054 GetConsoleAliasesA
0x401058 GetPriorityClass
0x40105c GetCurrencyFormatW
0x401060 LoadLibraryW
0x401064 GetExitCodeProcess
0x401068 IsProcessorFeaturePresent
0x40106c GetConsoleAliasW
0x401070 MultiByteToWideChar
0x401074 GetVolumePathNameA
0x401078 GetLastError
0x40107c InterlockedFlushSList
0x401080 FindFirstFileW
0x401084 GetProcAddress
0x401088 VirtualAlloc
0x40108c BackupWrite
0x401090 RemoveDirectoryA
0x401094 EnumSystemCodePagesW
0x401098 SearchPathA
0x40109c InterlockedExchangeAdd
0x4010a0 OpenWaitableTimerW
0x4010a4 LocalAlloc
0x4010a8 GetNumberFormatW
0x4010ac SetConsoleWindowInfo
0x4010b0 FoldStringA
0x4010b4 GlobalFindAtomW
0x4010b8 DebugSetProcessKillOnExit
0x4010bc UpdateResourceW
0x4010c0 VirtualProtect
0x4010c4 PeekConsoleInputA
0x4010c8 ReadConsoleInputW
0x4010cc GetWindowsDirectoryW
0x4010d0 SetFileAttributesW
0x4010d4 LocalFileTimeToFileTime
0x4010d8 CreateFileA
0x4010dc SetVolumeLabelA
0x4010e0 FillConsoleOutputCharacterA
0x4010e4 SetLastError
0x4010e8 GetModuleHandleA
0x4010ec HeapAlloc
0x4010f0 Sleep
0x4010f4 ExitProcess
0x4010f8 GetStartupInfoW
0x4010fc RaiseException
0x401100 RtlUnwind
0x401104 GetCPInfo
0x401108 InterlockedIncrement
0x40110c InterlockedDecrement
0x401110 GetACP
0x401114 GetOEMCP
0x401118 IsValidCodePage
0x40111c TlsGetValue
0x401120 TlsAlloc
0x401124 TlsSetValue
0x401128 TlsFree
0x40112c GetCurrentThreadId
0x401130 TerminateProcess
0x401134 GetCurrentProcess
0x401138 UnhandledExceptionFilter
0x40113c SetUnhandledExceptionFilter
0x401140 IsDebuggerPresent
0x401144 HeapFree
0x401148 DeleteCriticalSection
0x40114c LeaveCriticalSection
0x401150 EnterCriticalSection
0x401154 VirtualFree
0x401158 HeapReAlloc
0x40115c HeapCreate
0x401160 WriteFile
0x401164 GetStdHandle
0x401168 GetModuleFileNameA
0x40116c HeapSize
0x401170 LoadLibraryA
0x401174 InitializeCriticalSectionAndSpinCount
0x401178 GetModuleFileNameW
0x40117c FreeEnvironmentStringsW
0x401180 GetEnvironmentStringsW
0x401184 GetCommandLineW
0x401188 SetHandleCount
0x40118c GetFileType
0x401190 GetStartupInfoA
0x401194 QueryPerformanceCounter
0x401198 GetCurrentProcessId
0x40119c GetSystemTimeAsFileTime
0x4011a0 LCMapStringA
0x4011a4 WideCharToMultiByte
0x4011a8 LCMapStringW
0x4011ac GetStringTypeA
0x4011b0 GetStringTypeW
0x4011b4 GetLocaleInfoA
USER32.dll
0x4011c4 LoadMenuW
0x4011c8 CharToOemBuffW
0x4011cc ChangeDisplaySettingsW
GDI32.dll
0x401000 GetCharWidthA
0x401004 GetCharacterPlacementA
0x401008 GetCharABCWidthsFloatA
0x40100c GetBoundsRect
SHELL32.dll
0x4011bc ShellAboutW
EAT(Export Address Table) is none
KERNEL32.dll
0x401014 GetConsoleAliasesLengthW
0x401018 SetComputerNameExA
0x40101c GetConsoleAliasExesLengthA
0x401020 FindResourceW
0x401024 BuildCommDCBAndTimeoutsA
0x401028 DeleteVolumeMountPointA
0x40102c GlobalAddAtomA
0x401030 GetCommState
0x401034 GetSystemWindowsDirectoryW
0x401038 CreateDirectoryW
0x40103c AddConsoleAliasW
0x401040 FindCloseChangeNotification
0x401044 FreeEnvironmentStringsA
0x401048 GetModuleHandleW
0x40104c GetTickCount
0x401050 CreateNamedPipeW
0x401054 GetConsoleAliasesA
0x401058 GetPriorityClass
0x40105c GetCurrencyFormatW
0x401060 LoadLibraryW
0x401064 GetExitCodeProcess
0x401068 IsProcessorFeaturePresent
0x40106c GetConsoleAliasW
0x401070 MultiByteToWideChar
0x401074 GetVolumePathNameA
0x401078 GetLastError
0x40107c InterlockedFlushSList
0x401080 FindFirstFileW
0x401084 GetProcAddress
0x401088 VirtualAlloc
0x40108c BackupWrite
0x401090 RemoveDirectoryA
0x401094 EnumSystemCodePagesW
0x401098 SearchPathA
0x40109c InterlockedExchangeAdd
0x4010a0 OpenWaitableTimerW
0x4010a4 LocalAlloc
0x4010a8 GetNumberFormatW
0x4010ac SetConsoleWindowInfo
0x4010b0 FoldStringA
0x4010b4 GlobalFindAtomW
0x4010b8 DebugSetProcessKillOnExit
0x4010bc UpdateResourceW
0x4010c0 VirtualProtect
0x4010c4 PeekConsoleInputA
0x4010c8 ReadConsoleInputW
0x4010cc GetWindowsDirectoryW
0x4010d0 SetFileAttributesW
0x4010d4 LocalFileTimeToFileTime
0x4010d8 CreateFileA
0x4010dc SetVolumeLabelA
0x4010e0 FillConsoleOutputCharacterA
0x4010e4 SetLastError
0x4010e8 GetModuleHandleA
0x4010ec HeapAlloc
0x4010f0 Sleep
0x4010f4 ExitProcess
0x4010f8 GetStartupInfoW
0x4010fc RaiseException
0x401100 RtlUnwind
0x401104 GetCPInfo
0x401108 InterlockedIncrement
0x40110c InterlockedDecrement
0x401110 GetACP
0x401114 GetOEMCP
0x401118 IsValidCodePage
0x40111c TlsGetValue
0x401120 TlsAlloc
0x401124 TlsSetValue
0x401128 TlsFree
0x40112c GetCurrentThreadId
0x401130 TerminateProcess
0x401134 GetCurrentProcess
0x401138 UnhandledExceptionFilter
0x40113c SetUnhandledExceptionFilter
0x401140 IsDebuggerPresent
0x401144 HeapFree
0x401148 DeleteCriticalSection
0x40114c LeaveCriticalSection
0x401150 EnterCriticalSection
0x401154 VirtualFree
0x401158 HeapReAlloc
0x40115c HeapCreate
0x401160 WriteFile
0x401164 GetStdHandle
0x401168 GetModuleFileNameA
0x40116c HeapSize
0x401170 LoadLibraryA
0x401174 InitializeCriticalSectionAndSpinCount
0x401178 GetModuleFileNameW
0x40117c FreeEnvironmentStringsW
0x401180 GetEnvironmentStringsW
0x401184 GetCommandLineW
0x401188 SetHandleCount
0x40118c GetFileType
0x401190 GetStartupInfoA
0x401194 QueryPerformanceCounter
0x401198 GetCurrentProcessId
0x40119c GetSystemTimeAsFileTime
0x4011a0 LCMapStringA
0x4011a4 WideCharToMultiByte
0x4011a8 LCMapStringW
0x4011ac GetStringTypeA
0x4011b0 GetStringTypeW
0x4011b4 GetLocaleInfoA
USER32.dll
0x4011c4 LoadMenuW
0x4011c8 CharToOemBuffW
0x4011cc ChangeDisplaySettingsW
GDI32.dll
0x401000 GetCharWidthA
0x401004 GetCharacterPlacementA
0x401008 GetCharABCWidthsFloatA
0x40100c GetBoundsRect
SHELL32.dll
0x4011bc ShellAboutW
EAT(Export Address Table) is none