ScreenShot
| Created | 2024.08.10 12:50 | Machine | s1_win7_x6401 |
| Filename | sahost.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 20 detected (AIDetectMalware, Makoob, malicious, high confidence, score, Unsafe, Vnco, GuLoader, KPON, SCTemp, PowerShell, confidence) | ||
| md5 | 9cef532829a4ca2cf13279ac134873d8 | ||
| sha256 | 61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d | ||
| ssdeep | 12288:QQT9bUbPgROCAVtagRJGYkCLVaZxnHo6o0L9eC/CgDCJc2Lg:jTZOPgROAitkCQjH1e2n2Lg | ||
| imphash | b40f29cd171eb54c01b1dd2683c9c26b | ||
| impfuzzy | 48:dZGu5Eg1iO6wYlSv5L8r+tAlt8tz4eObGLl4x0Q7XEFpV74dT+5EQX/1Eowhy6Ub:dEu5EWiRwhJTc/6aj0 | ||
Network IP location
Signature (17cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| watch | Creates a suspicious Powershell process |
| watch | The process powershell.exe wrote an executable file to disk |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Executes one or more WMI queries |
| notice | Terminates another process |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (12cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | NSIS_Installer | Null Soft Installer | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PNG_Format_Zero | PNG Format | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x407060 Sleep
0x407064 GetShortPathNameA
0x407068 GetFullPathNameA
0x40706c MoveFileA
0x407070 SetCurrentDirectoryA
0x407074 GetFileAttributesA
0x407078 GetLastError
0x40707c CreateDirectoryA
0x407080 CompareFileTime
0x407084 SearchPathA
0x407088 GetTickCount
0x40708c GetFileSize
0x407090 GetModuleFileNameA
0x407094 GetCurrentProcess
0x407098 CopyFileA
0x40709c ExitProcess
0x4070a0 SetEnvironmentVariableA
0x4070a4 GetWindowsDirectoryA
0x4070a8 SetFileAttributesA
0x4070ac lstrcmpiA
0x4070b0 SetErrorMode
0x4070b4 LoadLibraryA
0x4070b8 lstrlenA
0x4070bc lstrcpynA
0x4070c0 GetDiskFreeSpaceA
0x4070c4 GlobalUnlock
0x4070c8 GlobalLock
0x4070cc CreateThread
0x4070d0 CreateProcessA
0x4070d4 RemoveDirectoryA
0x4070d8 CreateFileA
0x4070dc GetTempFileNameA
0x4070e0 lstrcpyA
0x4070e4 lstrcatA
0x4070e8 GetSystemDirectoryA
0x4070ec GetVersion
0x4070f0 GetProcAddress
0x4070f4 WaitForSingleObject
0x4070f8 SetFileTime
0x4070fc CloseHandle
0x407100 GlobalFree
0x407104 lstrcmpA
0x407108 ExpandEnvironmentStringsA
0x40710c GetExitCodeProcess
0x407110 GlobalAlloc
0x407114 GetModuleHandleA
0x407118 LoadLibraryExA
0x40711c GetCommandLineA
0x407120 GetTempPathA
0x407124 FreeLibrary
0x407128 FindFirstFileA
0x40712c FindNextFileA
0x407130 DeleteFileA
0x407134 SetFilePointer
0x407138 ReadFile
0x40713c FindClose
0x407140 GetPrivateProfileStringA
0x407144 WritePrivateProfileStringA
0x407148 MulDiv
0x40714c WriteFile
0x407150 MultiByteToWideChar
USER32.dll
0x407174 CreateWindowExA
0x407178 EndDialog
0x40717c ScreenToClient
0x407180 GetWindowRect
0x407184 EnableMenuItem
0x407188 GetSystemMenu
0x40718c SetClassLongA
0x407190 IsWindowEnabled
0x407194 SetWindowPos
0x407198 GetSysColor
0x40719c GetWindowLongA
0x4071a0 SetCursor
0x4071a4 LoadCursorA
0x4071a8 CheckDlgButton
0x4071ac GetMessagePos
0x4071b0 LoadBitmapA
0x4071b4 CallWindowProcA
0x4071b8 IsWindowVisible
0x4071bc CloseClipboard
0x4071c0 GetDC
0x4071c4 SystemParametersInfoA
0x4071c8 RegisterClassA
0x4071cc TrackPopupMenu
0x4071d0 AppendMenuA
0x4071d4 CreatePopupMenu
0x4071d8 GetSystemMetrics
0x4071dc SetDlgItemTextA
0x4071e0 GetDlgItemTextA
0x4071e4 MessageBoxIndirectA
0x4071e8 CharPrevA
0x4071ec DispatchMessageA
0x4071f0 PeekMessageA
0x4071f4 ReleaseDC
0x4071f8 EnableWindow
0x4071fc InvalidateRect
0x407200 SendMessageA
0x407204 DefWindowProcA
0x407208 BeginPaint
0x40720c GetClientRect
0x407210 FillRect
0x407214 DrawTextA
0x407218 GetClassInfoA
0x40721c DialogBoxParamA
0x407220 CharNextA
0x407224 ExitWindowsEx
0x407228 DestroyWindow
0x40722c CreateDialogParamA
0x407230 SetTimer
0x407234 GetDlgItem
0x407238 wsprintfA
0x40723c SetForegroundWindow
0x407240 ShowWindow
0x407244 IsWindow
0x407248 LoadImageA
0x40724c SetWindowLongA
0x407250 SetClipboardData
0x407254 EmptyClipboard
0x407258 OpenClipboard
0x40725c EndPaint
0x407260 PostQuitMessage
0x407264 FindWindowExA
0x407268 SendMessageTimeoutA
0x40726c SetWindowTextA
GDI32.dll
0x40703c SelectObject
0x407040 SetBkMode
0x407044 CreateFontIndirectA
0x407048 SetTextColor
0x40704c DeleteObject
0x407050 GetDeviceCaps
0x407054 CreateBrushIndirect
0x407058 SetBkColor
SHELL32.dll
0x407158 SHGetSpecialFolderLocation
0x40715c SHGetPathFromIDListA
0x407160 SHBrowseForFolderA
0x407164 SHGetFileInfoA
0x407168 ShellExecuteA
0x40716c SHFileOperationA
ADVAPI32.dll
0x407000 RegCloseKey
0x407004 RegOpenKeyExA
0x407008 RegDeleteKeyA
0x40700c RegDeleteValueA
0x407010 RegEnumValueA
0x407014 RegCreateKeyExA
0x407018 RegSetValueExA
0x40701c RegQueryValueExA
0x407020 RegEnumKeyA
COMCTL32.dll
0x407028 ImageList_Create
0x40702c ImageList_AddMasked
0x407030 ImageList_Destroy
0x407034 None
ole32.dll
0x407284 CoCreateInstance
0x407288 CoTaskMemFree
0x40728c OleInitialize
0x407290 OleUninitialize
VERSION.dll
0x407274 GetFileVersionInfoSizeA
0x407278 GetFileVersionInfoA
0x40727c VerQueryValueA
EAT(Export Address Table) is none
KERNEL32.dll
0x407060 Sleep
0x407064 GetShortPathNameA
0x407068 GetFullPathNameA
0x40706c MoveFileA
0x407070 SetCurrentDirectoryA
0x407074 GetFileAttributesA
0x407078 GetLastError
0x40707c CreateDirectoryA
0x407080 CompareFileTime
0x407084 SearchPathA
0x407088 GetTickCount
0x40708c GetFileSize
0x407090 GetModuleFileNameA
0x407094 GetCurrentProcess
0x407098 CopyFileA
0x40709c ExitProcess
0x4070a0 SetEnvironmentVariableA
0x4070a4 GetWindowsDirectoryA
0x4070a8 SetFileAttributesA
0x4070ac lstrcmpiA
0x4070b0 SetErrorMode
0x4070b4 LoadLibraryA
0x4070b8 lstrlenA
0x4070bc lstrcpynA
0x4070c0 GetDiskFreeSpaceA
0x4070c4 GlobalUnlock
0x4070c8 GlobalLock
0x4070cc CreateThread
0x4070d0 CreateProcessA
0x4070d4 RemoveDirectoryA
0x4070d8 CreateFileA
0x4070dc GetTempFileNameA
0x4070e0 lstrcpyA
0x4070e4 lstrcatA
0x4070e8 GetSystemDirectoryA
0x4070ec GetVersion
0x4070f0 GetProcAddress
0x4070f4 WaitForSingleObject
0x4070f8 SetFileTime
0x4070fc CloseHandle
0x407100 GlobalFree
0x407104 lstrcmpA
0x407108 ExpandEnvironmentStringsA
0x40710c GetExitCodeProcess
0x407110 GlobalAlloc
0x407114 GetModuleHandleA
0x407118 LoadLibraryExA
0x40711c GetCommandLineA
0x407120 GetTempPathA
0x407124 FreeLibrary
0x407128 FindFirstFileA
0x40712c FindNextFileA
0x407130 DeleteFileA
0x407134 SetFilePointer
0x407138 ReadFile
0x40713c FindClose
0x407140 GetPrivateProfileStringA
0x407144 WritePrivateProfileStringA
0x407148 MulDiv
0x40714c WriteFile
0x407150 MultiByteToWideChar
USER32.dll
0x407174 CreateWindowExA
0x407178 EndDialog
0x40717c ScreenToClient
0x407180 GetWindowRect
0x407184 EnableMenuItem
0x407188 GetSystemMenu
0x40718c SetClassLongA
0x407190 IsWindowEnabled
0x407194 SetWindowPos
0x407198 GetSysColor
0x40719c GetWindowLongA
0x4071a0 SetCursor
0x4071a4 LoadCursorA
0x4071a8 CheckDlgButton
0x4071ac GetMessagePos
0x4071b0 LoadBitmapA
0x4071b4 CallWindowProcA
0x4071b8 IsWindowVisible
0x4071bc CloseClipboard
0x4071c0 GetDC
0x4071c4 SystemParametersInfoA
0x4071c8 RegisterClassA
0x4071cc TrackPopupMenu
0x4071d0 AppendMenuA
0x4071d4 CreatePopupMenu
0x4071d8 GetSystemMetrics
0x4071dc SetDlgItemTextA
0x4071e0 GetDlgItemTextA
0x4071e4 MessageBoxIndirectA
0x4071e8 CharPrevA
0x4071ec DispatchMessageA
0x4071f0 PeekMessageA
0x4071f4 ReleaseDC
0x4071f8 EnableWindow
0x4071fc InvalidateRect
0x407200 SendMessageA
0x407204 DefWindowProcA
0x407208 BeginPaint
0x40720c GetClientRect
0x407210 FillRect
0x407214 DrawTextA
0x407218 GetClassInfoA
0x40721c DialogBoxParamA
0x407220 CharNextA
0x407224 ExitWindowsEx
0x407228 DestroyWindow
0x40722c CreateDialogParamA
0x407230 SetTimer
0x407234 GetDlgItem
0x407238 wsprintfA
0x40723c SetForegroundWindow
0x407240 ShowWindow
0x407244 IsWindow
0x407248 LoadImageA
0x40724c SetWindowLongA
0x407250 SetClipboardData
0x407254 EmptyClipboard
0x407258 OpenClipboard
0x40725c EndPaint
0x407260 PostQuitMessage
0x407264 FindWindowExA
0x407268 SendMessageTimeoutA
0x40726c SetWindowTextA
GDI32.dll
0x40703c SelectObject
0x407040 SetBkMode
0x407044 CreateFontIndirectA
0x407048 SetTextColor
0x40704c DeleteObject
0x407050 GetDeviceCaps
0x407054 CreateBrushIndirect
0x407058 SetBkColor
SHELL32.dll
0x407158 SHGetSpecialFolderLocation
0x40715c SHGetPathFromIDListA
0x407160 SHBrowseForFolderA
0x407164 SHGetFileInfoA
0x407168 ShellExecuteA
0x40716c SHFileOperationA
ADVAPI32.dll
0x407000 RegCloseKey
0x407004 RegOpenKeyExA
0x407008 RegDeleteKeyA
0x40700c RegDeleteValueA
0x407010 RegEnumValueA
0x407014 RegCreateKeyExA
0x407018 RegSetValueExA
0x40701c RegQueryValueExA
0x407020 RegEnumKeyA
COMCTL32.dll
0x407028 ImageList_Create
0x40702c ImageList_AddMasked
0x407030 ImageList_Destroy
0x407034 None
ole32.dll
0x407284 CoCreateInstance
0x407288 CoTaskMemFree
0x40728c OleInitialize
0x407290 OleUninitialize
VERSION.dll
0x407274 GetFileVersionInfoSizeA
0x407278 GetFileVersionInfoA
0x40727c VerQueryValueA
EAT(Export Address Table) is none