ScreenShot
| Created | 2024.07.03 18:50 | Machine | s1_win7_x6401 |
| Filename | poop.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 68 detected (AIDetectMalware, CaddyWiper, Windows, Wiper, Malicious, score, GenericRI, S27079619, Infected, Unsafe, Caddy, WIPPER, Ve2b, KillDisk, ccmw, CLASSIC, XPACK, KillMBR, YECCO, moderate, Detected, ai score=100, Malware@#tx0r9s9204l4, WXHP, R485824, CaddyBlade, Eflw, umhf4q13kVo, Static AI, Suspicious PE, susgen, confidence, 100%) | ||
| md5 | 42e52b8daf63e6e26c3aa91e7e971492 | ||
| sha256 | a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea | ||
| ssdeep | 192:76f0CW5P2Io4evFrDv2ZRJzCn7URRsjVJaZF:76fPWl24evFrT2ZR5Cn7UR0VJo | ||
| imphash | ea8609d4dad999f73ec4b6f8e7b28e55 | ||
| impfuzzy | 3:rMQmSAC09MI+AEMUKMKLn:YQUNHoKMKL | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 68 AntiVirus engines on VirusTotal as malicious |
| watch | Appends a known multi-family ransomware file extension to files that have been encrypted |
| watch | Attempts to identify installed AV products by installation directory |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates (office) documents on the filesystem |
| notice | Creates a shortcut to an executable file |
| notice | Creates executable files on the filesystem |
| notice | Steals private information from local Internet browsers |
| info | Checks amount of memory in system |
Rules (2cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
NETAPI32.dll
0x403000 DsRoleGetPrimaryDomainInformation
EAT(Export Address Table) is none
NETAPI32.dll
0x403000 DsRoleGetPrimaryDomainInformation
EAT(Export Address Table) is none