ScreenShot
| Created | 2024.06.27 10:22 | Machine | s1_win7_x6401 |
| Filename | 3.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 26 detected (AIDetectMalware, malicious, high confidence, score, Lockbit, Unsafe, Attribute, HighConfidence, Generic@AI, RDMK, cmRtazoj8MmqBcu9E, HykISLQhwp, Real Protect, high, Stealc, Detected, Wacapew, Kryptik, Eldorado, ZexaF, tq0@a4k@1shG, BScope, MxResIcn, HBBY, confidence, 100%) | ||
| md5 | 84c6c6c2620a690c0cc77fc438396837 | ||
| sha256 | 120e438e6a60737beb463dbdba06d7f1d10c2c6ff486c4f4b465461184838b85 | ||
| ssdeep | 3072:4ENLPmPeEsmgzkEsDhV6aKrRj+5bt4LtVTqG1Ek1E5xTEqS:4ELPmPvsrzRBaUlq81zN3 | ||
| imphash | cc367e44f45c02a5e408ca3a25546c56 | ||
| impfuzzy | 24:jlTk1qiskrNdJDojGeCjxvsYykPFp4SqchQHuOZyvDh/J3ISlRSFalrjMc1GSSLr:2Ndwo5sYTqchwuDjhSFaRBSey3 | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 26 AntiVirus engines on VirusTotal as malicious |
| notice | Foreign language identified in PE resource |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x40f010 GetCommProperties
0x40f014 GetModuleHandleW
0x40f018 GetTickCount
0x40f01c EnumCalendarInfoExW
0x40f020 GetConsoleTitleA
0x40f024 ReadConsoleOutputA
0x40f028 GlobalAlloc
0x40f02c LoadLibraryW
0x40f030 SetVolumeMountPointA
0x40f034 lstrcpynW
0x40f038 LocalReAlloc
0x40f03c WriteConsoleW
0x40f040 GetModuleFileNameW
0x40f044 GetConsoleAliasesW
0x40f048 InterlockedExchange
0x40f04c CreateJobObjectW
0x40f050 GetProcAddress
0x40f054 LoadLibraryA
0x40f058 UnhandledExceptionFilter
0x40f05c AddAtomA
0x40f060 OpenJobObjectW
0x40f064 FoldStringW
0x40f068 lstrcatW
0x40f06c BuildCommDCBA
0x40f070 PurgeComm
0x40f074 FindFirstVolumeW
0x40f078 GlobalAddAtomW
0x40f07c OpenFileMappingA
0x40f080 AreFileApisANSI
0x40f084 GetNumaNodeProcessorMask
0x40f088 GetConsoleAliasExesLengthA
0x40f08c GetLastError
0x40f090 GetComputerNameA
0x40f094 CreateFileA
0x40f098 GetStartupInfoW
0x40f09c TerminateProcess
0x40f0a0 GetCurrentProcess
0x40f0a4 SetUnhandledExceptionFilter
0x40f0a8 IsDebuggerPresent
0x40f0ac HeapAlloc
0x40f0b0 EnterCriticalSection
0x40f0b4 LeaveCriticalSection
0x40f0b8 Sleep
0x40f0bc ExitProcess
0x40f0c0 WriteFile
0x40f0c4 GetStdHandle
0x40f0c8 GetModuleFileNameA
0x40f0cc FreeEnvironmentStringsW
0x40f0d0 GetEnvironmentStringsW
0x40f0d4 GetCommandLineW
0x40f0d8 SetHandleCount
0x40f0dc GetFileType
0x40f0e0 GetStartupInfoA
0x40f0e4 DeleteCriticalSection
0x40f0e8 TlsGetValue
0x40f0ec TlsAlloc
0x40f0f0 TlsSetValue
0x40f0f4 TlsFree
0x40f0f8 InterlockedIncrement
0x40f0fc SetLastError
0x40f100 GetCurrentThreadId
0x40f104 InterlockedDecrement
0x40f108 HeapCreate
0x40f10c VirtualFree
0x40f110 HeapFree
0x40f114 QueryPerformanceCounter
0x40f118 GetCurrentProcessId
0x40f11c GetSystemTimeAsFileTime
0x40f120 VirtualAlloc
0x40f124 HeapReAlloc
0x40f128 RtlUnwind
0x40f12c GetCPInfo
0x40f130 GetACP
0x40f134 GetOEMCP
0x40f138 IsValidCodePage
0x40f13c MultiByteToWideChar
0x40f140 WideCharToMultiByte
0x40f144 InitializeCriticalSectionAndSpinCount
0x40f148 GetConsoleCP
0x40f14c GetConsoleMode
0x40f150 FlushFileBuffers
0x40f154 LCMapStringA
0x40f158 LCMapStringW
0x40f15c GetStringTypeA
0x40f160 GetStringTypeW
0x40f164 GetLocaleInfoA
0x40f168 ReadFile
0x40f16c SetFilePointer
0x40f170 HeapSize
0x40f174 CloseHandle
0x40f178 WriteConsoleA
0x40f17c GetConsoleOutputCP
0x40f180 SetStdHandle
0x40f184 GetModuleHandleA
USER32.dll
0x40f18c LoadIconA
GDI32.dll
0x40f008 GetCharWidth32W
ADVAPI32.dll
0x40f000 EnumDependentServicesW
ole32.dll
0x40f194 CoTaskMemFree
EAT(Export Address Table) is none
KERNEL32.dll
0x40f010 GetCommProperties
0x40f014 GetModuleHandleW
0x40f018 GetTickCount
0x40f01c EnumCalendarInfoExW
0x40f020 GetConsoleTitleA
0x40f024 ReadConsoleOutputA
0x40f028 GlobalAlloc
0x40f02c LoadLibraryW
0x40f030 SetVolumeMountPointA
0x40f034 lstrcpynW
0x40f038 LocalReAlloc
0x40f03c WriteConsoleW
0x40f040 GetModuleFileNameW
0x40f044 GetConsoleAliasesW
0x40f048 InterlockedExchange
0x40f04c CreateJobObjectW
0x40f050 GetProcAddress
0x40f054 LoadLibraryA
0x40f058 UnhandledExceptionFilter
0x40f05c AddAtomA
0x40f060 OpenJobObjectW
0x40f064 FoldStringW
0x40f068 lstrcatW
0x40f06c BuildCommDCBA
0x40f070 PurgeComm
0x40f074 FindFirstVolumeW
0x40f078 GlobalAddAtomW
0x40f07c OpenFileMappingA
0x40f080 AreFileApisANSI
0x40f084 GetNumaNodeProcessorMask
0x40f088 GetConsoleAliasExesLengthA
0x40f08c GetLastError
0x40f090 GetComputerNameA
0x40f094 CreateFileA
0x40f098 GetStartupInfoW
0x40f09c TerminateProcess
0x40f0a0 GetCurrentProcess
0x40f0a4 SetUnhandledExceptionFilter
0x40f0a8 IsDebuggerPresent
0x40f0ac HeapAlloc
0x40f0b0 EnterCriticalSection
0x40f0b4 LeaveCriticalSection
0x40f0b8 Sleep
0x40f0bc ExitProcess
0x40f0c0 WriteFile
0x40f0c4 GetStdHandle
0x40f0c8 GetModuleFileNameA
0x40f0cc FreeEnvironmentStringsW
0x40f0d0 GetEnvironmentStringsW
0x40f0d4 GetCommandLineW
0x40f0d8 SetHandleCount
0x40f0dc GetFileType
0x40f0e0 GetStartupInfoA
0x40f0e4 DeleteCriticalSection
0x40f0e8 TlsGetValue
0x40f0ec TlsAlloc
0x40f0f0 TlsSetValue
0x40f0f4 TlsFree
0x40f0f8 InterlockedIncrement
0x40f0fc SetLastError
0x40f100 GetCurrentThreadId
0x40f104 InterlockedDecrement
0x40f108 HeapCreate
0x40f10c VirtualFree
0x40f110 HeapFree
0x40f114 QueryPerformanceCounter
0x40f118 GetCurrentProcessId
0x40f11c GetSystemTimeAsFileTime
0x40f120 VirtualAlloc
0x40f124 HeapReAlloc
0x40f128 RtlUnwind
0x40f12c GetCPInfo
0x40f130 GetACP
0x40f134 GetOEMCP
0x40f138 IsValidCodePage
0x40f13c MultiByteToWideChar
0x40f140 WideCharToMultiByte
0x40f144 InitializeCriticalSectionAndSpinCount
0x40f148 GetConsoleCP
0x40f14c GetConsoleMode
0x40f150 FlushFileBuffers
0x40f154 LCMapStringA
0x40f158 LCMapStringW
0x40f15c GetStringTypeA
0x40f160 GetStringTypeW
0x40f164 GetLocaleInfoA
0x40f168 ReadFile
0x40f16c SetFilePointer
0x40f170 HeapSize
0x40f174 CloseHandle
0x40f178 WriteConsoleA
0x40f17c GetConsoleOutputCP
0x40f180 SetStdHandle
0x40f184 GetModuleHandleA
USER32.dll
0x40f18c LoadIconA
GDI32.dll
0x40f008 GetCharWidth32W
ADVAPI32.dll
0x40f000 EnumDependentServicesW
ole32.dll
0x40f194 CoTaskMemFree
EAT(Export Address Table) is none