ScreenShot
| Created | 2023.12.15 08:42 | Machine | s1_win7_x6403 |
| Filename | psaux.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | |||
| md5 | bd84bdff727b82364685f4179170d81e | ||
| sha256 | df8485aad922f0e8858f691f9b0b116c8ce1d74b1f0e7cb7128e294e879bbb1c | ||
| ssdeep | 98304:zKaYjw5U5R5BHH6/gffAZMmuYC5es4rw2iSqsw9OE7ONkozhkrfHzF4EFEO:+VBHa/gf4ZMxYSes4rw2irsw9ra2 | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x12b7040 WriteFile
0x12b7048 WriteConsoleW
0x12b7050 WaitForMultipleObjects
0x12b7058 WaitForSingleObject
0x12b7060 VirtualQuery
0x12b7068 VirtualFree
0x12b7070 VirtualAlloc
0x12b7078 TlsAlloc
0x12b7080 SwitchToThread
0x12b7088 SuspendThread
0x12b7090 SetWaitableTimer
0x12b7098 SetUnhandledExceptionFilter
0x12b70a0 SetProcessPriorityBoost
0x12b70a8 SetEvent
0x12b70b0 SetErrorMode
0x12b70b8 SetConsoleCtrlHandler
0x12b70c0 ResumeThread
0x12b70c8 PostQueuedCompletionStatus
0x12b70d0 LoadLibraryA
0x12b70d8 LoadLibraryW
0x12b70e0 SetThreadContext
0x12b70e8 GetThreadContext
0x12b70f0 GetSystemInfo
0x12b70f8 GetSystemDirectoryA
0x12b7100 GetStdHandle
0x12b7108 GetQueuedCompletionStatusEx
0x12b7110 GetProcessAffinityMask
0x12b7118 GetProcAddress
0x12b7120 GetEnvironmentStringsW
0x12b7128 GetConsoleMode
0x12b7130 FreeEnvironmentStringsW
0x12b7138 ExitProcess
0x12b7140 DuplicateHandle
0x12b7148 CreateWaitableTimerExW
0x12b7150 CreateThread
0x12b7158 CreateIoCompletionPort
0x12b7160 CreateFileA
0x12b7168 CreateEventA
0x12b7170 CloseHandle
0x12b7178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x12b7040 WriteFile
0x12b7048 WriteConsoleW
0x12b7050 WaitForMultipleObjects
0x12b7058 WaitForSingleObject
0x12b7060 VirtualQuery
0x12b7068 VirtualFree
0x12b7070 VirtualAlloc
0x12b7078 TlsAlloc
0x12b7080 SwitchToThread
0x12b7088 SuspendThread
0x12b7090 SetWaitableTimer
0x12b7098 SetUnhandledExceptionFilter
0x12b70a0 SetProcessPriorityBoost
0x12b70a8 SetEvent
0x12b70b0 SetErrorMode
0x12b70b8 SetConsoleCtrlHandler
0x12b70c0 ResumeThread
0x12b70c8 PostQueuedCompletionStatus
0x12b70d0 LoadLibraryA
0x12b70d8 LoadLibraryW
0x12b70e0 SetThreadContext
0x12b70e8 GetThreadContext
0x12b70f0 GetSystemInfo
0x12b70f8 GetSystemDirectoryA
0x12b7100 GetStdHandle
0x12b7108 GetQueuedCompletionStatusEx
0x12b7110 GetProcessAffinityMask
0x12b7118 GetProcAddress
0x12b7120 GetEnvironmentStringsW
0x12b7128 GetConsoleMode
0x12b7130 FreeEnvironmentStringsW
0x12b7138 ExitProcess
0x12b7140 DuplicateHandle
0x12b7148 CreateWaitableTimerExW
0x12b7150 CreateThread
0x12b7158 CreateIoCompletionPort
0x12b7160 CreateFileA
0x12b7168 CreateEventA
0x12b7170 CloseHandle
0x12b7178 AddVectoredExceptionHandler
EAT(Export Address Table) is none