ScreenShot
| Created | 2024.04.17 22:30 | Machine | s1_win7_x6401 |
| Filename | example3.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 18 detected (AIDetectMalware, Fragtor, unsafe, malicious, high confidence, score, ai score=83, MUPX, Gen@24tbus, ZexaCO, cu0@a0wCsifi, Genetic, Static AI, Suspicious PE, susgen) | ||
| md5 | 9272f0b3dff945cedf3921f87cb718aa | ||
| sha256 | c535bc922819db75e4f1db455282c9a68f95d8dfad442b9c3a23d3d13f1a1765 | ||
| ssdeep | 768:iNow93ch8kgnXfRc1xC8oSUns9wRDd86rV86KcgsnUnj/nqvwSc+:iNow19nJSTSs9wRisV86Kc9Mjivtc+ | ||
| imphash | d2506e5c6095ce0b51d4422d2d76ff83 | ||
| impfuzzy | 3:oTEKCROXvbsWBJAEPw1MO/OywS9KTXzhAXwEQaxRGU3A1LMRMExJKJAEjnQLgGRY:omRgdBJAEoZ/OEGDzyRZGc9KJAmnugGY | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 18 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (2cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0x41a43c RegCloseKey
KERNEL32.DLL
0x41a444 LoadLibraryA
0x41a448 ExitProcess
0x41a44c GetProcAddress
0x41a450 VirtualProtect
MSVCRT.dll
0x41a458 exit
ole32.dll
0x41a460 CoInitialize
OLEAUT32.dll
0x41a468 SysFreeString
USER32.dll
0x41a470 wsprintfA
EAT(Export Address Table) is none
ADVAPI32.dll
0x41a43c RegCloseKey
KERNEL32.DLL
0x41a444 LoadLibraryA
0x41a448 ExitProcess
0x41a44c GetProcAddress
0x41a450 VirtualProtect
MSVCRT.dll
0x41a458 exit
ole32.dll
0x41a460 CoInitialize
OLEAUT32.dll
0x41a468 SysFreeString
USER32.dll
0x41a470 wsprintfA
EAT(Export Address Table) is none