ScreenShot
| Created | 2024.02.04 16:49 | Machine | s1_win7_x6403 |
| Filename | builden.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 36 detected (malicious, high confidence, score, WacatacFC, S18892752, Androm, Artemis, FileRepMalware, Misc, MSIL@AI, MSIL2, U4Lioitaj4KnhrjL, q3siw, AGEN, Generic ML PUA, mgqw, ai score=82, Wacatac, 16RKLCG, ZemsilF, Xm0@auzWHPi, GdSda, Gajl, Static AI, Malicious PE, confidence) | ||
| md5 | db95cbd1fa1fc7983128cecf51a8795f | ||
| sha256 | 5bd62fd96f6b7dab483da91e9ee74be2df8d25e180d5ac6b6c979b6815475068 | ||
| ssdeep | 24576:DLlgAikPzj9DgRq3x90Qze3uLfWDaRAuq:Dy4j9Dgax909wqSq | ||
| imphash | ae9f6a32bb8b03dce37903edbc855ba1 | ||
| impfuzzy | 48:J9F2OcLKc1XFjRWDYgeBtDX+Kc+pnCHFa:JqFLKc1XF8EdBtDX+Kc+pnMFa | ||
Network IP location
Signature (10cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 36 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
| info | This executable has a PDB path |
Rules (8cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | Is_DotNET_EXE | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x427000 GetLastError
0x427004 SetLastError
0x427008 FormatMessageW
0x42700c GetFileType
0x427010 GetStdHandle
0x427014 WriteFile
0x427018 ReadFile
0x42701c FlushFileBuffers
0x427020 SetEndOfFile
0x427024 SetFilePointer
0x427028 SetFileTime
0x42702c CloseHandle
0x427030 CreateFileW
0x427034 CreateDirectoryW
0x427038 SetFileAttributesW
0x42703c GetFileAttributesW
0x427040 DeleteFileW
0x427044 MoveFileW
0x427048 FindClose
0x42704c FindFirstFileW
0x427050 FindNextFileW
0x427054 GetVersionExW
0x427058 GetCurrentDirectoryW
0x42705c GetFullPathNameW
0x427060 FoldStringW
0x427064 GetModuleFileNameW
0x427068 GetModuleHandleW
0x42706c FindResourceW
0x427070 FreeLibrary
0x427074 GetProcAddress
0x427078 GetCurrentProcessId
0x42707c ExitProcess
0x427080 SetThreadExecutionState
0x427084 Sleep
0x427088 LoadLibraryW
0x42708c GetSystemDirectoryW
0x427090 CompareStringW
0x427094 AllocConsole
0x427098 FreeConsole
0x42709c AttachConsole
0x4270a0 WriteConsoleW
0x4270a4 TzSpecificLocalTimeToSystemTime
0x4270a8 SystemTimeToFileTime
0x4270ac FileTimeToLocalFileTime
0x4270b0 LocalFileTimeToFileTime
0x4270b4 FileTimeToSystemTime
0x4270b8 GetCPInfo
0x4270bc IsDBCSLeadByte
0x4270c0 MultiByteToWideChar
0x4270c4 WideCharToMultiByte
0x4270c8 GlobalAlloc
0x4270cc LockResource
0x4270d0 GlobalLock
0x4270d4 GlobalUnlock
0x4270d8 GlobalFree
0x4270dc LoadResource
0x4270e0 SizeofResource
0x4270e4 SetCurrentDirectoryW
0x4270e8 GetExitCodeProcess
0x4270ec WaitForSingleObject
0x4270f0 GetLocalTime
0x4270f4 GetTickCount
0x4270f8 MapViewOfFile
0x4270fc UnmapViewOfFile
0x427100 CreateFileMappingW
0x427104 OpenFileMappingW
0x427108 GetCommandLineW
0x42710c SetEnvironmentVariableW
0x427110 ExpandEnvironmentStringsW
0x427114 GetTempPathW
0x427118 MoveFileExW
0x42711c GetLocaleInfoW
0x427120 GetTimeFormatW
0x427124 GetDateFormatW
0x427128 GetNumberFormatW
0x42712c SetFilePointerEx
0x427130 GetConsoleMode
0x427134 GetConsoleCP
0x427138 HeapSize
0x42713c SetStdHandle
0x427140 GetProcessHeap
0x427144 RaiseException
0x427148 GetSystemInfo
0x42714c VirtualProtect
0x427150 VirtualQuery
0x427154 LoadLibraryExA
0x427158 IsProcessorFeaturePresent
0x42715c IsDebuggerPresent
0x427160 UnhandledExceptionFilter
0x427164 SetUnhandledExceptionFilter
0x427168 GetStartupInfoW
0x42716c QueryPerformanceCounter
0x427170 GetCurrentThreadId
0x427174 GetSystemTimeAsFileTime
0x427178 InitializeSListHead
0x42717c GetCurrentProcess
0x427180 TerminateProcess
0x427184 RtlUnwind
0x427188 EncodePointer
0x42718c EnterCriticalSection
0x427190 LeaveCriticalSection
0x427194 DeleteCriticalSection
0x427198 InitializeCriticalSectionAndSpinCount
0x42719c TlsAlloc
0x4271a0 TlsGetValue
0x4271a4 TlsSetValue
0x4271a8 TlsFree
0x4271ac LoadLibraryExW
0x4271b0 QueryPerformanceFrequency
0x4271b4 GetModuleHandleExW
0x4271b8 GetModuleFileNameA
0x4271bc GetACP
0x4271c0 HeapFree
0x4271c4 HeapAlloc
0x4271c8 HeapReAlloc
0x4271cc GetStringTypeW
0x4271d0 LCMapStringW
0x4271d4 FindFirstFileExA
0x4271d8 FindNextFileA
0x4271dc IsValidCodePage
0x4271e0 GetOEMCP
0x4271e4 GetCommandLineA
0x4271e8 GetEnvironmentStringsW
0x4271ec FreeEnvironmentStringsW
0x4271f0 DecodePointer
gdiplus.dll
0x4271f8 GdiplusShutdown
0x4271fc GdiplusStartup
0x427200 GdipCreateHBITMAPFromBitmap
0x427204 GdipCreateBitmapFromStreamICM
0x427208 GdipCreateBitmapFromStream
0x42720c GdipDisposeImage
0x427210 GdipCloneImage
0x427214 GdipFree
0x427218 GdipAlloc
EAT(Export Address Table) Library
KERNEL32.dll
0x427000 GetLastError
0x427004 SetLastError
0x427008 FormatMessageW
0x42700c GetFileType
0x427010 GetStdHandle
0x427014 WriteFile
0x427018 ReadFile
0x42701c FlushFileBuffers
0x427020 SetEndOfFile
0x427024 SetFilePointer
0x427028 SetFileTime
0x42702c CloseHandle
0x427030 CreateFileW
0x427034 CreateDirectoryW
0x427038 SetFileAttributesW
0x42703c GetFileAttributesW
0x427040 DeleteFileW
0x427044 MoveFileW
0x427048 FindClose
0x42704c FindFirstFileW
0x427050 FindNextFileW
0x427054 GetVersionExW
0x427058 GetCurrentDirectoryW
0x42705c GetFullPathNameW
0x427060 FoldStringW
0x427064 GetModuleFileNameW
0x427068 GetModuleHandleW
0x42706c FindResourceW
0x427070 FreeLibrary
0x427074 GetProcAddress
0x427078 GetCurrentProcessId
0x42707c ExitProcess
0x427080 SetThreadExecutionState
0x427084 Sleep
0x427088 LoadLibraryW
0x42708c GetSystemDirectoryW
0x427090 CompareStringW
0x427094 AllocConsole
0x427098 FreeConsole
0x42709c AttachConsole
0x4270a0 WriteConsoleW
0x4270a4 TzSpecificLocalTimeToSystemTime
0x4270a8 SystemTimeToFileTime
0x4270ac FileTimeToLocalFileTime
0x4270b0 LocalFileTimeToFileTime
0x4270b4 FileTimeToSystemTime
0x4270b8 GetCPInfo
0x4270bc IsDBCSLeadByte
0x4270c0 MultiByteToWideChar
0x4270c4 WideCharToMultiByte
0x4270c8 GlobalAlloc
0x4270cc LockResource
0x4270d0 GlobalLock
0x4270d4 GlobalUnlock
0x4270d8 GlobalFree
0x4270dc LoadResource
0x4270e0 SizeofResource
0x4270e4 SetCurrentDirectoryW
0x4270e8 GetExitCodeProcess
0x4270ec WaitForSingleObject
0x4270f0 GetLocalTime
0x4270f4 GetTickCount
0x4270f8 MapViewOfFile
0x4270fc UnmapViewOfFile
0x427100 CreateFileMappingW
0x427104 OpenFileMappingW
0x427108 GetCommandLineW
0x42710c SetEnvironmentVariableW
0x427110 ExpandEnvironmentStringsW
0x427114 GetTempPathW
0x427118 MoveFileExW
0x42711c GetLocaleInfoW
0x427120 GetTimeFormatW
0x427124 GetDateFormatW
0x427128 GetNumberFormatW
0x42712c SetFilePointerEx
0x427130 GetConsoleMode
0x427134 GetConsoleCP
0x427138 HeapSize
0x42713c SetStdHandle
0x427140 GetProcessHeap
0x427144 RaiseException
0x427148 GetSystemInfo
0x42714c VirtualProtect
0x427150 VirtualQuery
0x427154 LoadLibraryExA
0x427158 IsProcessorFeaturePresent
0x42715c IsDebuggerPresent
0x427160 UnhandledExceptionFilter
0x427164 SetUnhandledExceptionFilter
0x427168 GetStartupInfoW
0x42716c QueryPerformanceCounter
0x427170 GetCurrentThreadId
0x427174 GetSystemTimeAsFileTime
0x427178 InitializeSListHead
0x42717c GetCurrentProcess
0x427180 TerminateProcess
0x427184 RtlUnwind
0x427188 EncodePointer
0x42718c EnterCriticalSection
0x427190 LeaveCriticalSection
0x427194 DeleteCriticalSection
0x427198 InitializeCriticalSectionAndSpinCount
0x42719c TlsAlloc
0x4271a0 TlsGetValue
0x4271a4 TlsSetValue
0x4271a8 TlsFree
0x4271ac LoadLibraryExW
0x4271b0 QueryPerformanceFrequency
0x4271b4 GetModuleHandleExW
0x4271b8 GetModuleFileNameA
0x4271bc GetACP
0x4271c0 HeapFree
0x4271c4 HeapAlloc
0x4271c8 HeapReAlloc
0x4271cc GetStringTypeW
0x4271d0 LCMapStringW
0x4271d4 FindFirstFileExA
0x4271d8 FindNextFileA
0x4271dc IsValidCodePage
0x4271e0 GetOEMCP
0x4271e4 GetCommandLineA
0x4271e8 GetEnvironmentStringsW
0x4271ec FreeEnvironmentStringsW
0x4271f0 DecodePointer
gdiplus.dll
0x4271f8 GdiplusShutdown
0x4271fc GdiplusStartup
0x427200 GdipCreateHBITMAPFromBitmap
0x427204 GdipCreateBitmapFromStreamICM
0x427208 GdipCreateBitmapFromStream
0x42720c GdipDisposeImage
0x427210 GdipCloneImage
0x427214 GdipFree
0x427218 GdipAlloc
EAT(Export Address Table) Library