ScreenShot
| Created | 2024.07.19 12:53 | Machine | s1_win7_x6403 |
| Filename | 66990947b9f24_crypted.exe#1 | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 46 detected (AIDetectMalware, malicious, high confidence, score, Unsafe, Save, Attribute, HighConfidence, GenKryptik, GZLE, Artemis, PWSX, Lazy, Reline, Convagent, CLOUD, kvrxb, RedLineNET, METASTEALER, YXEGRZ, high, LummaStealer, Detected, RedLine, NV36C4, Kryptik, Eldorado, ZexaF, FqW@aqXOtOl, BScope, TrojanPSW, Vidar, Chgt, GZGT, confidence, 100%, GOAZ) | ||
| md5 | ae74c6d6ed392c35afafedfc9316d163 | ||
| sha256 | f408c8ba5781966f6ce1da805de79deb4a5e3c9dfbe097493123257e6112bf71 | ||
| ssdeep | 12288:m6LAu5tBQFA2pAmR+IhIiI82uJhktKFB22Ce:m6H5oFRVIohrpZ | ||
| imphash | 5c03f97b5f3e812ef89246641eaba2fa | ||
| impfuzzy | 24:+m8TjlzDFEkBKAWokbJcpVJ+c1t8CbJBl39r9OovbO3kFZMv5GMACEZHu9U:G7v/W/cpVJh1t8C7pZo30FZGK | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 46 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
USER32.dll
0x425170 OffsetRect
ADVAPI32.dll
0x425000 DeleteAce
KERNEL32.dll
0x425008 SetStdHandle
0x42500c HeapSize
0x425010 CreateFileW
0x425014 WaitForSingleObject
0x425018 CreateThread
0x42501c VirtualAlloc
0x425020 GetModuleHandleW
0x425024 GetProcAddress
0x425028 RaiseException
0x42502c InitOnceBeginInitialize
0x425030 InitOnceComplete
0x425034 CloseHandle
0x425038 GetCurrentThreadId
0x42503c ReleaseSRWLockExclusive
0x425040 AcquireSRWLockExclusive
0x425044 TryAcquireSRWLockExclusive
0x425048 WakeAllConditionVariable
0x42504c SleepConditionVariableSRW
0x425050 WideCharToMultiByte
0x425054 GetLastError
0x425058 FreeLibraryWhenCallbackReturns
0x42505c CreateThreadpoolWork
0x425060 SubmitThreadpoolWork
0x425064 CloseThreadpoolWork
0x425068 GetModuleHandleExW
0x42506c IsProcessorFeaturePresent
0x425070 EnterCriticalSection
0x425074 LeaveCriticalSection
0x425078 InitializeCriticalSectionEx
0x42507c DeleteCriticalSection
0x425080 QueryPerformanceCounter
0x425084 EncodePointer
0x425088 DecodePointer
0x42508c MultiByteToWideChar
0x425090 LCMapStringEx
0x425094 GetSystemTimeAsFileTime
0x425098 GetStringTypeW
0x42509c GetCPInfo
0x4250a0 IsDebuggerPresent
0x4250a4 UnhandledExceptionFilter
0x4250a8 SetUnhandledExceptionFilter
0x4250ac GetStartupInfoW
0x4250b0 GetCurrentProcess
0x4250b4 TerminateProcess
0x4250b8 GetCurrentProcessId
0x4250bc InitializeSListHead
0x4250c0 GetProcessHeap
0x4250c4 RtlUnwind
0x4250c8 SetLastError
0x4250cc InitializeCriticalSectionAndSpinCount
0x4250d0 TlsAlloc
0x4250d4 TlsGetValue
0x4250d8 TlsSetValue
0x4250dc TlsFree
0x4250e0 FreeLibrary
0x4250e4 LoadLibraryExW
0x4250e8 ExitProcess
0x4250ec GetModuleFileNameW
0x4250f0 GetStdHandle
0x4250f4 WriteFile
0x4250f8 GetCommandLineA
0x4250fc GetCommandLineW
0x425100 HeapAlloc
0x425104 HeapFree
0x425108 CompareStringW
0x42510c LCMapStringW
0x425110 GetLocaleInfoW
0x425114 IsValidLocale
0x425118 GetUserDefaultLCID
0x42511c EnumSystemLocalesW
0x425120 GetFileType
0x425124 GetFileSizeEx
0x425128 SetFilePointerEx
0x42512c FlushFileBuffers
0x425130 GetConsoleOutputCP
0x425134 GetConsoleMode
0x425138 ReadFile
0x42513c ReadConsoleW
0x425140 HeapReAlloc
0x425144 FindClose
0x425148 FindFirstFileExW
0x42514c FindNextFileW
0x425150 IsValidCodePage
0x425154 GetACP
0x425158 GetOEMCP
0x42515c GetEnvironmentStringsW
0x425160 FreeEnvironmentStringsW
0x425164 SetEnvironmentVariableW
0x425168 WriteConsoleW
EAT(Export Address Table) is none
USER32.dll
0x425170 OffsetRect
ADVAPI32.dll
0x425000 DeleteAce
KERNEL32.dll
0x425008 SetStdHandle
0x42500c HeapSize
0x425010 CreateFileW
0x425014 WaitForSingleObject
0x425018 CreateThread
0x42501c VirtualAlloc
0x425020 GetModuleHandleW
0x425024 GetProcAddress
0x425028 RaiseException
0x42502c InitOnceBeginInitialize
0x425030 InitOnceComplete
0x425034 CloseHandle
0x425038 GetCurrentThreadId
0x42503c ReleaseSRWLockExclusive
0x425040 AcquireSRWLockExclusive
0x425044 TryAcquireSRWLockExclusive
0x425048 WakeAllConditionVariable
0x42504c SleepConditionVariableSRW
0x425050 WideCharToMultiByte
0x425054 GetLastError
0x425058 FreeLibraryWhenCallbackReturns
0x42505c CreateThreadpoolWork
0x425060 SubmitThreadpoolWork
0x425064 CloseThreadpoolWork
0x425068 GetModuleHandleExW
0x42506c IsProcessorFeaturePresent
0x425070 EnterCriticalSection
0x425074 LeaveCriticalSection
0x425078 InitializeCriticalSectionEx
0x42507c DeleteCriticalSection
0x425080 QueryPerformanceCounter
0x425084 EncodePointer
0x425088 DecodePointer
0x42508c MultiByteToWideChar
0x425090 LCMapStringEx
0x425094 GetSystemTimeAsFileTime
0x425098 GetStringTypeW
0x42509c GetCPInfo
0x4250a0 IsDebuggerPresent
0x4250a4 UnhandledExceptionFilter
0x4250a8 SetUnhandledExceptionFilter
0x4250ac GetStartupInfoW
0x4250b0 GetCurrentProcess
0x4250b4 TerminateProcess
0x4250b8 GetCurrentProcessId
0x4250bc InitializeSListHead
0x4250c0 GetProcessHeap
0x4250c4 RtlUnwind
0x4250c8 SetLastError
0x4250cc InitializeCriticalSectionAndSpinCount
0x4250d0 TlsAlloc
0x4250d4 TlsGetValue
0x4250d8 TlsSetValue
0x4250dc TlsFree
0x4250e0 FreeLibrary
0x4250e4 LoadLibraryExW
0x4250e8 ExitProcess
0x4250ec GetModuleFileNameW
0x4250f0 GetStdHandle
0x4250f4 WriteFile
0x4250f8 GetCommandLineA
0x4250fc GetCommandLineW
0x425100 HeapAlloc
0x425104 HeapFree
0x425108 CompareStringW
0x42510c LCMapStringW
0x425110 GetLocaleInfoW
0x425114 IsValidLocale
0x425118 GetUserDefaultLCID
0x42511c EnumSystemLocalesW
0x425120 GetFileType
0x425124 GetFileSizeEx
0x425128 SetFilePointerEx
0x42512c FlushFileBuffers
0x425130 GetConsoleOutputCP
0x425134 GetConsoleMode
0x425138 ReadFile
0x42513c ReadConsoleW
0x425140 HeapReAlloc
0x425144 FindClose
0x425148 FindFirstFileExW
0x42514c FindNextFileW
0x425150 IsValidCodePage
0x425154 GetACP
0x425158 GetOEMCP
0x42515c GetEnvironmentStringsW
0x425160 FreeEnvironmentStringsW
0x425164 SetEnvironmentVariableW
0x425168 WriteConsoleW
EAT(Export Address Table) is none