ScreenShot
| Created | 2024.05.03 07:53 | Machine | s1_win7_x6401 |
| Filename | mtls.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 36 detected (AIDetectMalware, Sliver, Malicious, score, DeepScan, Marte, HackTool, Implant, 64bit, uwccg, Genus, Attribute, HighConfidence, a variant of WinGo, Artemis, MalGO, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=89, R598949, Static AI, Malicious PE, susgen, D9OKG) | ||
| md5 | 3b65343bff4c7397ed19ef22efaae899 | ||
| sha256 | 9ff7ad76b41e17a34223b0c5e7081a7a93ecb7124dab07050bd24fcc8d0a4a7e | ||
| ssdeep | 98304:0C0n6j9BjOWR+UKyA0uGJj0BmuUwmyCal5bXSDHELZZmBtv45xyDtoG:0Ch/NR+UKyA0uymmuUwLPl5bXSDkLW | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 36 AntiVirus engines on VirusTotal as malicious |
| watch | Detects the presence of Wine emulator |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x12c1040 WriteFile
0x12c1048 WriteConsoleW
0x12c1050 WaitForMultipleObjects
0x12c1058 WaitForSingleObject
0x12c1060 VirtualQuery
0x12c1068 VirtualFree
0x12c1070 VirtualAlloc
0x12c1078 TlsAlloc
0x12c1080 SwitchToThread
0x12c1088 SuspendThread
0x12c1090 SetWaitableTimer
0x12c1098 SetUnhandledExceptionFilter
0x12c10a0 SetProcessPriorityBoost
0x12c10a8 SetEvent
0x12c10b0 SetErrorMode
0x12c10b8 SetConsoleCtrlHandler
0x12c10c0 ResumeThread
0x12c10c8 PostQueuedCompletionStatus
0x12c10d0 LoadLibraryA
0x12c10d8 LoadLibraryW
0x12c10e0 SetThreadContext
0x12c10e8 GetThreadContext
0x12c10f0 GetSystemInfo
0x12c10f8 GetSystemDirectoryA
0x12c1100 GetStdHandle
0x12c1108 GetQueuedCompletionStatusEx
0x12c1110 GetProcessAffinityMask
0x12c1118 GetProcAddress
0x12c1120 GetEnvironmentStringsW
0x12c1128 GetConsoleMode
0x12c1130 FreeEnvironmentStringsW
0x12c1138 ExitProcess
0x12c1140 DuplicateHandle
0x12c1148 CreateWaitableTimerExW
0x12c1150 CreateThread
0x12c1158 CreateIoCompletionPort
0x12c1160 CreateFileA
0x12c1168 CreateEventA
0x12c1170 CloseHandle
0x12c1178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x12c1040 WriteFile
0x12c1048 WriteConsoleW
0x12c1050 WaitForMultipleObjects
0x12c1058 WaitForSingleObject
0x12c1060 VirtualQuery
0x12c1068 VirtualFree
0x12c1070 VirtualAlloc
0x12c1078 TlsAlloc
0x12c1080 SwitchToThread
0x12c1088 SuspendThread
0x12c1090 SetWaitableTimer
0x12c1098 SetUnhandledExceptionFilter
0x12c10a0 SetProcessPriorityBoost
0x12c10a8 SetEvent
0x12c10b0 SetErrorMode
0x12c10b8 SetConsoleCtrlHandler
0x12c10c0 ResumeThread
0x12c10c8 PostQueuedCompletionStatus
0x12c10d0 LoadLibraryA
0x12c10d8 LoadLibraryW
0x12c10e0 SetThreadContext
0x12c10e8 GetThreadContext
0x12c10f0 GetSystemInfo
0x12c10f8 GetSystemDirectoryA
0x12c1100 GetStdHandle
0x12c1108 GetQueuedCompletionStatusEx
0x12c1110 GetProcessAffinityMask
0x12c1118 GetProcAddress
0x12c1120 GetEnvironmentStringsW
0x12c1128 GetConsoleMode
0x12c1130 FreeEnvironmentStringsW
0x12c1138 ExitProcess
0x12c1140 DuplicateHandle
0x12c1148 CreateWaitableTimerExW
0x12c1150 CreateThread
0x12c1158 CreateIoCompletionPort
0x12c1160 CreateFileA
0x12c1168 CreateEventA
0x12c1170 CloseHandle
0x12c1178 AddVectoredExceptionHandler
EAT(Export Address Table) is none