ScreenShot
| Created | 2024.05.03 07:57 | Machine | s1_win7_x6401 |
| Filename | HSTS.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 45 detected (AIDetectMalware, Sliver, Malicious, score, DeepScan, Marte, unsafe, HackTool, Implant, 64bit, uwccg, Attribute, HighConfidence, a variant of WinGo, Artemis, FileRepMalware, MalGO, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=85, Etgl, Static AI, Malicious PE, D9OKG) | ||
| md5 | f970eb941bf3666823b761cea657061c | ||
| sha256 | 22dacef022f62c901300e147bb9668998bd18aeac3673916b6a4270c03e82839 | ||
| ssdeep | 98304:735VqWVnuufsZcXVbcD9QCfGiqI00LmAkFgjQEXu8q8Tv:z5VqOnqZcXVb61PW0LrkFgjpdqS | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 45 AntiVirus engines on VirusTotal as malicious |
| watch | Detects the presence of Wine emulator |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x1272040 WriteFile
0x1272048 WriteConsoleW
0x1272050 WaitForMultipleObjects
0x1272058 WaitForSingleObject
0x1272060 VirtualQuery
0x1272068 VirtualFree
0x1272070 VirtualAlloc
0x1272078 TlsAlloc
0x1272080 SwitchToThread
0x1272088 SuspendThread
0x1272090 SetWaitableTimer
0x1272098 SetUnhandledExceptionFilter
0x12720a0 SetProcessPriorityBoost
0x12720a8 SetEvent
0x12720b0 SetErrorMode
0x12720b8 SetConsoleCtrlHandler
0x12720c0 ResumeThread
0x12720c8 PostQueuedCompletionStatus
0x12720d0 LoadLibraryA
0x12720d8 LoadLibraryW
0x12720e0 SetThreadContext
0x12720e8 GetThreadContext
0x12720f0 GetSystemInfo
0x12720f8 GetSystemDirectoryA
0x1272100 GetStdHandle
0x1272108 GetQueuedCompletionStatusEx
0x1272110 GetProcessAffinityMask
0x1272118 GetProcAddress
0x1272120 GetEnvironmentStringsW
0x1272128 GetConsoleMode
0x1272130 FreeEnvironmentStringsW
0x1272138 ExitProcess
0x1272140 DuplicateHandle
0x1272148 CreateWaitableTimerExW
0x1272150 CreateThread
0x1272158 CreateIoCompletionPort
0x1272160 CreateFileA
0x1272168 CreateEventA
0x1272170 CloseHandle
0x1272178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x1272040 WriteFile
0x1272048 WriteConsoleW
0x1272050 WaitForMultipleObjects
0x1272058 WaitForSingleObject
0x1272060 VirtualQuery
0x1272068 VirtualFree
0x1272070 VirtualAlloc
0x1272078 TlsAlloc
0x1272080 SwitchToThread
0x1272088 SuspendThread
0x1272090 SetWaitableTimer
0x1272098 SetUnhandledExceptionFilter
0x12720a0 SetProcessPriorityBoost
0x12720a8 SetEvent
0x12720b0 SetErrorMode
0x12720b8 SetConsoleCtrlHandler
0x12720c0 ResumeThread
0x12720c8 PostQueuedCompletionStatus
0x12720d0 LoadLibraryA
0x12720d8 LoadLibraryW
0x12720e0 SetThreadContext
0x12720e8 GetThreadContext
0x12720f0 GetSystemInfo
0x12720f8 GetSystemDirectoryA
0x1272100 GetStdHandle
0x1272108 GetQueuedCompletionStatusEx
0x1272110 GetProcessAffinityMask
0x1272118 GetProcAddress
0x1272120 GetEnvironmentStringsW
0x1272128 GetConsoleMode
0x1272130 FreeEnvironmentStringsW
0x1272138 ExitProcess
0x1272140 DuplicateHandle
0x1272148 CreateWaitableTimerExW
0x1272150 CreateThread
0x1272158 CreateIoCompletionPort
0x1272160 CreateFileA
0x1272168 CreateEventA
0x1272170 CloseHandle
0x1272178 AddVectoredExceptionHandler
EAT(Export Address Table) is none