ScreenShot
| Created | 2024.06.01 08:51 | Machine | s1_win7_x6403 |
| Filename | victor.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 57 detected (AIDetectMalware, malicious, high confidence, score, Zusy, Unsafe, Save, Attribute, HighConfidence, GenKryptik, GXGC, Artemis, MalwareX, Kryptik, NKNOnXHWmNF, kkcfm, AMADEY, YXEE5Z, Real Protect, high, Krypt, Detected, ai score=82, Sabsik, Multiverze, 15JK28C, Eldorado, R650649, ZexaF, tuW@aevu2Km, BScope, Chgt, Gdhl, Static AI, Malicious PE, susgen, confidence, 100%) | ||
| md5 | 01cff6fb725465d86284505028b42cfd | ||
| sha256 | 3814ef98c5c16988df008a989038faf39943b32fb9687dc9347ac16df722e4cd | ||
| ssdeep | 6144:dKiOduIntTEob6Cehx1m0kDLnbdyvtz+YrAYhsQa75/QXoe+Q7kh:dK9fntoNwLb0vtz+tYhta7KDzkh | ||
| imphash | b17d49828275c0ff5fc68aae18e3f1a2 | ||
| impfuzzy | 24:WjsE3cpVJfK1cQDqte4GhlJBl393PiDZMv1GMAkpOovbOPZG:c3cpVJJ9te4GnpNEZGA3w | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 57 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41e000 WaitForSingleObjectEx
0x41e004 CreateThread
0x41e008 VirtualAlloc
0x41e00c FreeConsole
0x41e010 CloseHandle
0x41e014 GetCurrentThreadId
0x41e018 GetExitCodeThread
0x41e01c WideCharToMultiByte
0x41e020 EnterCriticalSection
0x41e024 LeaveCriticalSection
0x41e028 InitializeCriticalSectionEx
0x41e02c DeleteCriticalSection
0x41e030 QueryPerformanceCounter
0x41e034 ReleaseSRWLockExclusive
0x41e038 WakeAllConditionVariable
0x41e03c EncodePointer
0x41e040 DecodePointer
0x41e044 MultiByteToWideChar
0x41e048 LCMapStringEx
0x41e04c GetSystemTimeAsFileTime
0x41e050 GetModuleHandleW
0x41e054 GetProcAddress
0x41e058 GetStringTypeW
0x41e05c GetCPInfo
0x41e060 IsProcessorFeaturePresent
0x41e064 UnhandledExceptionFilter
0x41e068 SetUnhandledExceptionFilter
0x41e06c GetCurrentProcess
0x41e070 TerminateProcess
0x41e074 GetCurrentProcessId
0x41e078 InitializeSListHead
0x41e07c IsDebuggerPresent
0x41e080 GetStartupInfoW
0x41e084 CreateFileW
0x41e088 RaiseException
0x41e08c RtlUnwind
0x41e090 GetLastError
0x41e094 SetLastError
0x41e098 InitializeCriticalSectionAndSpinCount
0x41e09c TlsAlloc
0x41e0a0 TlsGetValue
0x41e0a4 TlsSetValue
0x41e0a8 TlsFree
0x41e0ac FreeLibrary
0x41e0b0 LoadLibraryExW
0x41e0b4 ExitThread
0x41e0b8 FreeLibraryAndExitThread
0x41e0bc GetModuleHandleExW
0x41e0c0 GetStdHandle
0x41e0c4 WriteFile
0x41e0c8 GetModuleFileNameW
0x41e0cc ExitProcess
0x41e0d0 HeapAlloc
0x41e0d4 HeapFree
0x41e0d8 LCMapStringW
0x41e0dc GetLocaleInfoW
0x41e0e0 IsValidLocale
0x41e0e4 GetUserDefaultLCID
0x41e0e8 EnumSystemLocalesW
0x41e0ec GetFileType
0x41e0f0 FlushFileBuffers
0x41e0f4 GetConsoleOutputCP
0x41e0f8 GetConsoleMode
0x41e0fc ReadFile
0x41e100 GetFileSizeEx
0x41e104 SetFilePointerEx
0x41e108 ReadConsoleW
0x41e10c HeapReAlloc
0x41e110 FindClose
0x41e114 FindFirstFileExW
0x41e118 FindNextFileW
0x41e11c IsValidCodePage
0x41e120 GetACP
0x41e124 GetOEMCP
0x41e128 GetCommandLineA
0x41e12c GetCommandLineW
0x41e130 GetEnvironmentStringsW
0x41e134 FreeEnvironmentStringsW
0x41e138 SetStdHandle
0x41e13c GetProcessHeap
0x41e140 HeapSize
0x41e144 WriteConsoleW
EAT(Export Address Table) is none
KERNEL32.dll
0x41e000 WaitForSingleObjectEx
0x41e004 CreateThread
0x41e008 VirtualAlloc
0x41e00c FreeConsole
0x41e010 CloseHandle
0x41e014 GetCurrentThreadId
0x41e018 GetExitCodeThread
0x41e01c WideCharToMultiByte
0x41e020 EnterCriticalSection
0x41e024 LeaveCriticalSection
0x41e028 InitializeCriticalSectionEx
0x41e02c DeleteCriticalSection
0x41e030 QueryPerformanceCounter
0x41e034 ReleaseSRWLockExclusive
0x41e038 WakeAllConditionVariable
0x41e03c EncodePointer
0x41e040 DecodePointer
0x41e044 MultiByteToWideChar
0x41e048 LCMapStringEx
0x41e04c GetSystemTimeAsFileTime
0x41e050 GetModuleHandleW
0x41e054 GetProcAddress
0x41e058 GetStringTypeW
0x41e05c GetCPInfo
0x41e060 IsProcessorFeaturePresent
0x41e064 UnhandledExceptionFilter
0x41e068 SetUnhandledExceptionFilter
0x41e06c GetCurrentProcess
0x41e070 TerminateProcess
0x41e074 GetCurrentProcessId
0x41e078 InitializeSListHead
0x41e07c IsDebuggerPresent
0x41e080 GetStartupInfoW
0x41e084 CreateFileW
0x41e088 RaiseException
0x41e08c RtlUnwind
0x41e090 GetLastError
0x41e094 SetLastError
0x41e098 InitializeCriticalSectionAndSpinCount
0x41e09c TlsAlloc
0x41e0a0 TlsGetValue
0x41e0a4 TlsSetValue
0x41e0a8 TlsFree
0x41e0ac FreeLibrary
0x41e0b0 LoadLibraryExW
0x41e0b4 ExitThread
0x41e0b8 FreeLibraryAndExitThread
0x41e0bc GetModuleHandleExW
0x41e0c0 GetStdHandle
0x41e0c4 WriteFile
0x41e0c8 GetModuleFileNameW
0x41e0cc ExitProcess
0x41e0d0 HeapAlloc
0x41e0d4 HeapFree
0x41e0d8 LCMapStringW
0x41e0dc GetLocaleInfoW
0x41e0e0 IsValidLocale
0x41e0e4 GetUserDefaultLCID
0x41e0e8 EnumSystemLocalesW
0x41e0ec GetFileType
0x41e0f0 FlushFileBuffers
0x41e0f4 GetConsoleOutputCP
0x41e0f8 GetConsoleMode
0x41e0fc ReadFile
0x41e100 GetFileSizeEx
0x41e104 SetFilePointerEx
0x41e108 ReadConsoleW
0x41e10c HeapReAlloc
0x41e110 FindClose
0x41e114 FindFirstFileExW
0x41e118 FindNextFileW
0x41e11c IsValidCodePage
0x41e120 GetACP
0x41e124 GetOEMCP
0x41e128 GetCommandLineA
0x41e12c GetCommandLineW
0x41e130 GetEnvironmentStringsW
0x41e134 FreeEnvironmentStringsW
0x41e138 SetStdHandle
0x41e13c GetProcessHeap
0x41e140 HeapSize
0x41e144 WriteConsoleW
EAT(Export Address Table) is none