ScreenShot
| Created | 2024.07.03 18:41 | Machine | s1_win7_x6401 |
| Filename | ok.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 38 detected (AIDetectMalware, Sliver, Malicious, score, Unsafe, Dump, Marte, HackTool, Implant, 64bit, uwccg, Attribute, HighConfidence, a variant of WinGo, MalwareX, MalGO, CLASSIC, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=80, SuspGolang, R598949, Fwnw, Static AI, Malicious PE, susgen, confidence, 100%) | ||
| md5 | 2a5bdb0a785762ab4982d360bd4c37e5 | ||
| sha256 | ee49efe382aed3b7137265e3cb8ad53e30d38765b686a7f235ade461f726a162 | ||
| ssdeep | 98304:em53m3zrVW4COL2A0m1eSsE9PIWtdFTeE8QcEEUOwi9M9W+EZIPI:7Jm3zr86zF1eSTZDtdFF5c9UxK | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 38 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x12d9040 WriteFile
0x12d9048 WriteConsoleW
0x12d9050 WaitForMultipleObjects
0x12d9058 WaitForSingleObject
0x12d9060 VirtualQuery
0x12d9068 VirtualFree
0x12d9070 VirtualAlloc
0x12d9078 TlsAlloc
0x12d9080 SwitchToThread
0x12d9088 SuspendThread
0x12d9090 SetWaitableTimer
0x12d9098 SetUnhandledExceptionFilter
0x12d90a0 SetProcessPriorityBoost
0x12d90a8 SetEvent
0x12d90b0 SetErrorMode
0x12d90b8 SetConsoleCtrlHandler
0x12d90c0 ResumeThread
0x12d90c8 PostQueuedCompletionStatus
0x12d90d0 LoadLibraryA
0x12d90d8 LoadLibraryW
0x12d90e0 SetThreadContext
0x12d90e8 GetThreadContext
0x12d90f0 GetSystemInfo
0x12d90f8 GetSystemDirectoryA
0x12d9100 GetStdHandle
0x12d9108 GetQueuedCompletionStatusEx
0x12d9110 GetProcessAffinityMask
0x12d9118 GetProcAddress
0x12d9120 GetEnvironmentStringsW
0x12d9128 GetConsoleMode
0x12d9130 FreeEnvironmentStringsW
0x12d9138 ExitProcess
0x12d9140 DuplicateHandle
0x12d9148 CreateWaitableTimerExW
0x12d9150 CreateThread
0x12d9158 CreateIoCompletionPort
0x12d9160 CreateFileA
0x12d9168 CreateEventA
0x12d9170 CloseHandle
0x12d9178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x12d9040 WriteFile
0x12d9048 WriteConsoleW
0x12d9050 WaitForMultipleObjects
0x12d9058 WaitForSingleObject
0x12d9060 VirtualQuery
0x12d9068 VirtualFree
0x12d9070 VirtualAlloc
0x12d9078 TlsAlloc
0x12d9080 SwitchToThread
0x12d9088 SuspendThread
0x12d9090 SetWaitableTimer
0x12d9098 SetUnhandledExceptionFilter
0x12d90a0 SetProcessPriorityBoost
0x12d90a8 SetEvent
0x12d90b0 SetErrorMode
0x12d90b8 SetConsoleCtrlHandler
0x12d90c0 ResumeThread
0x12d90c8 PostQueuedCompletionStatus
0x12d90d0 LoadLibraryA
0x12d90d8 LoadLibraryW
0x12d90e0 SetThreadContext
0x12d90e8 GetThreadContext
0x12d90f0 GetSystemInfo
0x12d90f8 GetSystemDirectoryA
0x12d9100 GetStdHandle
0x12d9108 GetQueuedCompletionStatusEx
0x12d9110 GetProcessAffinityMask
0x12d9118 GetProcAddress
0x12d9120 GetEnvironmentStringsW
0x12d9128 GetConsoleMode
0x12d9130 FreeEnvironmentStringsW
0x12d9138 ExitProcess
0x12d9140 DuplicateHandle
0x12d9148 CreateWaitableTimerExW
0x12d9150 CreateThread
0x12d9158 CreateIoCompletionPort
0x12d9160 CreateFileA
0x12d9168 CreateEventA
0x12d9170 CloseHandle
0x12d9178 AddVectoredExceptionHandler
EAT(Export Address Table) is none