ScreenShot
| Created | 2024.07.09 10:00 | Machine | s1_win7_x6401 |
| Filename | EXACT_ITEM.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 34 detected (AIDetectMalware, Sliver, Malicious, score, Dump, Tango, Marte, Unsafe, HackTool, Implant, 64bit, uwccg, Attribute, HighConfidence, a variant of WinGo, MalGO, CLASSIC, Tool, SBeacon, SILVER, SMYXCFWAZ, WinGo, Shellcoderunner, Detected, AGEN, ai score=80, SuspGolang, Static AI, Malicious PE, confidence, 100%) | ||
| md5 | 9babf09115135e3726636ed32790bd36 | ||
| sha256 | c3892920df52a2b4ba986c2eafeb5c2481a419c32fad3307f20ff03548542247 | ||
| ssdeep | 98304:f938kMnCQcjlV+JkylkA88U80OPVq6rE0wshqDGEzjQYBg:98xCQI3tylS8UUPU6rXwshq/NS | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 34 AntiVirus engines on VirusTotal as malicious |
| watch | Detects the presence of Wine emulator |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0x12da040 WriteFile
0x12da048 WriteConsoleW
0x12da050 WaitForMultipleObjects
0x12da058 WaitForSingleObject
0x12da060 VirtualQuery
0x12da068 VirtualFree
0x12da070 VirtualAlloc
0x12da078 TlsAlloc
0x12da080 SwitchToThread
0x12da088 SuspendThread
0x12da090 SetWaitableTimer
0x12da098 SetUnhandledExceptionFilter
0x12da0a0 SetProcessPriorityBoost
0x12da0a8 SetEvent
0x12da0b0 SetErrorMode
0x12da0b8 SetConsoleCtrlHandler
0x12da0c0 ResumeThread
0x12da0c8 PostQueuedCompletionStatus
0x12da0d0 LoadLibraryA
0x12da0d8 LoadLibraryW
0x12da0e0 SetThreadContext
0x12da0e8 GetThreadContext
0x12da0f0 GetSystemInfo
0x12da0f8 GetSystemDirectoryA
0x12da100 GetStdHandle
0x12da108 GetQueuedCompletionStatusEx
0x12da110 GetProcessAffinityMask
0x12da118 GetProcAddress
0x12da120 GetEnvironmentStringsW
0x12da128 GetConsoleMode
0x12da130 FreeEnvironmentStringsW
0x12da138 ExitProcess
0x12da140 DuplicateHandle
0x12da148 CreateWaitableTimerExW
0x12da150 CreateThread
0x12da158 CreateIoCompletionPort
0x12da160 CreateFileA
0x12da168 CreateEventA
0x12da170 CloseHandle
0x12da178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x12da040 WriteFile
0x12da048 WriteConsoleW
0x12da050 WaitForMultipleObjects
0x12da058 WaitForSingleObject
0x12da060 VirtualQuery
0x12da068 VirtualFree
0x12da070 VirtualAlloc
0x12da078 TlsAlloc
0x12da080 SwitchToThread
0x12da088 SuspendThread
0x12da090 SetWaitableTimer
0x12da098 SetUnhandledExceptionFilter
0x12da0a0 SetProcessPriorityBoost
0x12da0a8 SetEvent
0x12da0b0 SetErrorMode
0x12da0b8 SetConsoleCtrlHandler
0x12da0c0 ResumeThread
0x12da0c8 PostQueuedCompletionStatus
0x12da0d0 LoadLibraryA
0x12da0d8 LoadLibraryW
0x12da0e0 SetThreadContext
0x12da0e8 GetThreadContext
0x12da0f0 GetSystemInfo
0x12da0f8 GetSystemDirectoryA
0x12da100 GetStdHandle
0x12da108 GetQueuedCompletionStatusEx
0x12da110 GetProcessAffinityMask
0x12da118 GetProcAddress
0x12da120 GetEnvironmentStringsW
0x12da128 GetConsoleMode
0x12da130 FreeEnvironmentStringsW
0x12da138 ExitProcess
0x12da140 DuplicateHandle
0x12da148 CreateWaitableTimerExW
0x12da150 CreateThread
0x12da158 CreateIoCompletionPort
0x12da160 CreateFileA
0x12da168 CreateEventA
0x12da170 CloseHandle
0x12da178 AddVectoredExceptionHandler
EAT(Export Address Table) is none