ScreenShot
| Created | 2024.07.03 18:38 | Machine | s1_win7_x6401 |
| Filename | EERIE_EAVE.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 40 detected (AIDetectMalware, Sliver, Malicious, score, Artemis, Dump, Marte, Unsafe, Save, Attribute, HighConfidence, a variant of WinGo, HackTool, MalwareX, MalGO, CLASSIC, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=88, SuspGolang, Ijgl, Static AI, Malicious PE, susgen, confidence, 100%) | ||
| md5 | e515e4872f4891fb598b503c34036b8c | ||
| sha256 | 12fb501b09774d1d6b620d88be3fe6e78a3423c2a484d2f5771ec152f6c6c42f | ||
| ssdeep | 98304:m3aJvBMT7eoPpAV69xFPYSWCmwWmnDN6ERbascUik:uaFCXpAV67RYKs4Dllcy | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 40 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x1412040 WriteFile
0x1412048 WriteConsoleW
0x1412050 WaitForMultipleObjects
0x1412058 WaitForSingleObject
0x1412060 VirtualQuery
0x1412068 VirtualFree
0x1412070 VirtualAlloc
0x1412078 TlsAlloc
0x1412080 SwitchToThread
0x1412088 SuspendThread
0x1412090 SetWaitableTimer
0x1412098 SetUnhandledExceptionFilter
0x14120a0 SetProcessPriorityBoost
0x14120a8 SetEvent
0x14120b0 SetErrorMode
0x14120b8 SetConsoleCtrlHandler
0x14120c0 ResumeThread
0x14120c8 PostQueuedCompletionStatus
0x14120d0 LoadLibraryA
0x14120d8 LoadLibraryW
0x14120e0 SetThreadContext
0x14120e8 GetThreadContext
0x14120f0 GetSystemInfo
0x14120f8 GetSystemDirectoryA
0x1412100 GetStdHandle
0x1412108 GetQueuedCompletionStatusEx
0x1412110 GetProcessAffinityMask
0x1412118 GetProcAddress
0x1412120 GetEnvironmentStringsW
0x1412128 GetConsoleMode
0x1412130 FreeEnvironmentStringsW
0x1412138 ExitProcess
0x1412140 DuplicateHandle
0x1412148 CreateWaitableTimerExW
0x1412150 CreateThread
0x1412158 CreateIoCompletionPort
0x1412160 CreateFileA
0x1412168 CreateEventA
0x1412170 CloseHandle
0x1412178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x1412040 WriteFile
0x1412048 WriteConsoleW
0x1412050 WaitForMultipleObjects
0x1412058 WaitForSingleObject
0x1412060 VirtualQuery
0x1412068 VirtualFree
0x1412070 VirtualAlloc
0x1412078 TlsAlloc
0x1412080 SwitchToThread
0x1412088 SuspendThread
0x1412090 SetWaitableTimer
0x1412098 SetUnhandledExceptionFilter
0x14120a0 SetProcessPriorityBoost
0x14120a8 SetEvent
0x14120b0 SetErrorMode
0x14120b8 SetConsoleCtrlHandler
0x14120c0 ResumeThread
0x14120c8 PostQueuedCompletionStatus
0x14120d0 LoadLibraryA
0x14120d8 LoadLibraryW
0x14120e0 SetThreadContext
0x14120e8 GetThreadContext
0x14120f0 GetSystemInfo
0x14120f8 GetSystemDirectoryA
0x1412100 GetStdHandle
0x1412108 GetQueuedCompletionStatusEx
0x1412110 GetProcessAffinityMask
0x1412118 GetProcAddress
0x1412120 GetEnvironmentStringsW
0x1412128 GetConsoleMode
0x1412130 FreeEnvironmentStringsW
0x1412138 ExitProcess
0x1412140 DuplicateHandle
0x1412148 CreateWaitableTimerExW
0x1412150 CreateThread
0x1412158 CreateIoCompletionPort
0x1412160 CreateFileA
0x1412168 CreateEventA
0x1412170 CloseHandle
0x1412178 AddVectoredExceptionHandler
EAT(Export Address Table) is none