ScreenShot
| Created | 2024.07.10 16:10 | Machine | s1_win7_x6401 |
| Filename | Plugin_0703.exe.bak | ||
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 7fb098ac9cc8d730ac0ea7111805a553 | ||
| sha256 | ee0f53a93732a97a9ee313f167c06c0f8c9bc044fe78f2e926520b92f9dfcb61 | ||
| ssdeep | 98304:YwlrM3j/MWbPvP+PpaCdppTctirYpJxPHE7OIGya7j86/rDO98:pSkWbPvPcacTcMrkJtHE7OxH7j862m | ||
| imphash | c56a25fa4336eeb10723b3537ba4876d | ||
| impfuzzy | 48:Rbp7O5fUOQMEvz9KJ1mshKQ59USvrzd8tGRoACpNwtEX5E+ul54LK6x9paVcM:dp65fU9MmzkPmsImupM | ||
Network IP location
Signature (19cnts)
| Level | Description |
|---|---|
| watch | Created a service where a service was also not started |
| watch | Installs itself for autorun at Windows startup |
| watch | Operates on local firewall's policies and settings |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates a shortcut to an executable file |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | Foreign language identified in PE resource |
| notice | Queries for potentially installed applications |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Repeatedly searches for a not-found process |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Terminates another process |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | Queries for the computername |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
Rules (18cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_RL_Gen_Zero | Win32 Trojan Emotet | binaries (upload) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | CAB_file_format | CAB archive file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | lnk_file_format | Microsoft Windows Shortcut File Format | binaries (download) |
| info | Lnk_Format_Zero | LNK Format | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | zip_file_format | ZIP file format | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
ADVAPI32.dll
0x1001000 RegCloseKey
0x1001004 EqualSid
0x1001008 AllocateAndInitializeSid
0x100100c GetTokenInformation
0x1001010 OpenProcessToken
0x1001014 AdjustTokenPrivileges
0x1001018 LookupPrivilegeValueA
0x100101c FreeSid
0x1001020 RegDeleteValueA
0x1001024 RegOpenKeyExA
0x1001028 RegSetValueExA
0x100102c RegQueryValueExA
0x1001030 RegCreateKeyExA
0x1001034 RegQueryInfoKeyA
KERNEL32.dll
0x100104c lstrcatA
0x1001050 GetFileAttributesA
0x1001054 GetShortPathNameA
0x1001058 LocalAlloc
0x100105c GetLastError
0x1001060 GetCurrentProcess
0x1001064 GetPrivateProfileIntA
0x1001068 lstrcmpiA
0x100106c lstrcpyA
0x1001070 GetModuleFileNameA
0x1001074 FreeLibrary
0x1001078 GetPrivateProfileStringA
0x100107c lstrlenA
0x1001080 GetSystemDirectoryA
0x1001084 RemoveDirectoryA
0x1001088 GetProcAddress
0x100108c FindNextFileA
0x1001090 DeleteFileA
0x1001094 SetFileAttributesA
0x1001098 lstrcmpA
0x100109c FindFirstFileA
0x10010a0 _lclose
0x10010a4 _llseek
0x10010a8 _lopen
0x10010ac WritePrivateProfileStringA
0x10010b0 GetWindowsDirectoryA
0x10010b4 LoadLibraryA
0x10010b8 FindClose
0x10010bc GlobalFree
0x10010c0 GlobalUnlock
0x10010c4 GlobalLock
0x10010c8 GlobalAlloc
0x10010cc IsDBCSLeadByte
0x10010d0 ExitProcess
0x10010d4 CloseHandle
0x10010d8 GetStartupInfoA
0x10010dc GetCommandLineA
0x10010e0 LoadResource
0x10010e4 FindResourceA
0x10010e8 CreateMutexA
0x10010ec SetEvent
0x10010f0 CreateEventA
0x10010f4 SetCurrentDirectoryA
0x10010f8 CreateThread
0x10010fc ResetEvent
0x1001100 TerminateThread
0x1001104 LocalFree
0x1001108 FormatMessageA
0x100110c GetExitCodeProcess
0x1001110 WaitForSingleObject
0x1001114 CreateProcessA
0x1001118 GetTempPathA
0x100111c FreeResource
0x1001120 LockResource
0x1001124 SizeofResource
0x1001128 CreateFileA
0x100112c ReadFile
0x1001130 WriteFile
0x1001134 SetFilePointer
0x1001138 SetFileTime
0x100113c LocalFileTimeToFileTime
0x1001140 DosDateTimeToFileTime
0x1001144 GetTempFileNameA
0x1001148 GetSystemInfo
0x100114c GetDriveTypeA
0x1001150 lstrcpynA
0x1001154 GetVolumeInformationA
0x1001158 GetCurrentDirectoryA
0x100115c LoadLibraryExA
0x1001160 GetModuleHandleA
0x1001164 CreateDirectoryA
0x1001168 ExpandEnvironmentStringsA
0x100116c GetVersionExA
0x1001170 GetDiskFreeSpaceA
0x1001174 MulDiv
GDI32.dll
0x1001044 GetDeviceCaps
USER32.dll
0x100117c wsprintfA
0x1001180 ExitWindowsEx
0x1001184 CharNextA
0x1001188 CharUpperA
0x100118c EndDialog
0x1001190 GetDesktopWindow
0x1001194 CharPrevA
0x1001198 GetWindowLongA
0x100119c CallWindowProcA
0x10011a0 GetDlgItem
0x10011a4 SetForegroundWindow
0x10011a8 SetWindowTextA
0x10011ac SendDlgItemMessageA
0x10011b0 SetWindowLongA
0x10011b4 EnableWindow
0x10011b8 SendMessageA
0x10011bc LoadStringA
0x10011c0 MsgWaitForMultipleObjects
0x10011c4 PeekMessageA
0x10011c8 MessageBoxA
0x10011cc SetWindowPos
0x10011d0 ReleaseDC
0x10011d4 GetDC
0x10011d8 GetWindowRect
0x10011dc ShowWindow
0x10011e0 DialogBoxIndirectParamA
0x10011e4 SetDlgItemTextA
0x10011e8 MessageBeep
0x10011ec GetDlgItemTextA
0x10011f0 DispatchMessageA
COMCTL32.dll
0x100103c None
VERSION.dll
0x10011f8 GetFileVersionInfoA
0x10011fc VerQueryValueA
0x1001200 GetFileVersionInfoSizeA
EAT(Export Address Table) is none
ADVAPI32.dll
0x1001000 RegCloseKey
0x1001004 EqualSid
0x1001008 AllocateAndInitializeSid
0x100100c GetTokenInformation
0x1001010 OpenProcessToken
0x1001014 AdjustTokenPrivileges
0x1001018 LookupPrivilegeValueA
0x100101c FreeSid
0x1001020 RegDeleteValueA
0x1001024 RegOpenKeyExA
0x1001028 RegSetValueExA
0x100102c RegQueryValueExA
0x1001030 RegCreateKeyExA
0x1001034 RegQueryInfoKeyA
KERNEL32.dll
0x100104c lstrcatA
0x1001050 GetFileAttributesA
0x1001054 GetShortPathNameA
0x1001058 LocalAlloc
0x100105c GetLastError
0x1001060 GetCurrentProcess
0x1001064 GetPrivateProfileIntA
0x1001068 lstrcmpiA
0x100106c lstrcpyA
0x1001070 GetModuleFileNameA
0x1001074 FreeLibrary
0x1001078 GetPrivateProfileStringA
0x100107c lstrlenA
0x1001080 GetSystemDirectoryA
0x1001084 RemoveDirectoryA
0x1001088 GetProcAddress
0x100108c FindNextFileA
0x1001090 DeleteFileA
0x1001094 SetFileAttributesA
0x1001098 lstrcmpA
0x100109c FindFirstFileA
0x10010a0 _lclose
0x10010a4 _llseek
0x10010a8 _lopen
0x10010ac WritePrivateProfileStringA
0x10010b0 GetWindowsDirectoryA
0x10010b4 LoadLibraryA
0x10010b8 FindClose
0x10010bc GlobalFree
0x10010c0 GlobalUnlock
0x10010c4 GlobalLock
0x10010c8 GlobalAlloc
0x10010cc IsDBCSLeadByte
0x10010d0 ExitProcess
0x10010d4 CloseHandle
0x10010d8 GetStartupInfoA
0x10010dc GetCommandLineA
0x10010e0 LoadResource
0x10010e4 FindResourceA
0x10010e8 CreateMutexA
0x10010ec SetEvent
0x10010f0 CreateEventA
0x10010f4 SetCurrentDirectoryA
0x10010f8 CreateThread
0x10010fc ResetEvent
0x1001100 TerminateThread
0x1001104 LocalFree
0x1001108 FormatMessageA
0x100110c GetExitCodeProcess
0x1001110 WaitForSingleObject
0x1001114 CreateProcessA
0x1001118 GetTempPathA
0x100111c FreeResource
0x1001120 LockResource
0x1001124 SizeofResource
0x1001128 CreateFileA
0x100112c ReadFile
0x1001130 WriteFile
0x1001134 SetFilePointer
0x1001138 SetFileTime
0x100113c LocalFileTimeToFileTime
0x1001140 DosDateTimeToFileTime
0x1001144 GetTempFileNameA
0x1001148 GetSystemInfo
0x100114c GetDriveTypeA
0x1001150 lstrcpynA
0x1001154 GetVolumeInformationA
0x1001158 GetCurrentDirectoryA
0x100115c LoadLibraryExA
0x1001160 GetModuleHandleA
0x1001164 CreateDirectoryA
0x1001168 ExpandEnvironmentStringsA
0x100116c GetVersionExA
0x1001170 GetDiskFreeSpaceA
0x1001174 MulDiv
GDI32.dll
0x1001044 GetDeviceCaps
USER32.dll
0x100117c wsprintfA
0x1001180 ExitWindowsEx
0x1001184 CharNextA
0x1001188 CharUpperA
0x100118c EndDialog
0x1001190 GetDesktopWindow
0x1001194 CharPrevA
0x1001198 GetWindowLongA
0x100119c CallWindowProcA
0x10011a0 GetDlgItem
0x10011a4 SetForegroundWindow
0x10011a8 SetWindowTextA
0x10011ac SendDlgItemMessageA
0x10011b0 SetWindowLongA
0x10011b4 EnableWindow
0x10011b8 SendMessageA
0x10011bc LoadStringA
0x10011c0 MsgWaitForMultipleObjects
0x10011c4 PeekMessageA
0x10011c8 MessageBoxA
0x10011cc SetWindowPos
0x10011d0 ReleaseDC
0x10011d4 GetDC
0x10011d8 GetWindowRect
0x10011dc ShowWindow
0x10011e0 DialogBoxIndirectParamA
0x10011e4 SetDlgItemTextA
0x10011e8 MessageBeep
0x10011ec GetDlgItemTextA
0x10011f0 DispatchMessageA
COMCTL32.dll
0x100103c None
VERSION.dll
0x10011f8 GetFileVersionInfoA
0x10011fc VerQueryValueA
0x1001200 GetFileVersionInfoSizeA
EAT(Export Address Table) is none