ScreenShot
| Created | 2024.08.30 23:31 | Machine | s1_win7_x6402 |
| Filename | 6497a7b33252a782e523bebd2809712ea3b9faec34d901e0df92d3f6fb6abf83.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 36 detected (AIDetectMalware, Lumma, GenericKD, Genus, a variant of WinGo, Artemis, CLASSIC, sgdeq, LUMMASTEALER, YXEH3Z, malicious, moderate, score, Server, Proxy, Detected, ai score=84, Wacatac, ABRisk, BCZZ, LummaC2, ZexaF, @F0@auyijZii, Antis) | ||
| md5 | 3b83989d2f86d143dbdbb20cf0608a1f | ||
| sha256 | 6497a7b33252a782e523bebd2809712ea3b9faec34d901e0df92d3f6fb6abf83 | ||
| ssdeep | 49152:gj1VMrpntvIdVLxxa9Kn2ZCNcFIoVIVF6P8M/o1rWNjB29VEc9Zi9Cgm+Ijhp6Q4:a1VMFiVLUK1Ao1W729fHiFo4GYTg | ||
| imphash | 1aae8bf580c846f39c71c05898e57e88 | ||
| impfuzzy | 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6UP:AwO+VUjXOmokx0nP | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 36 AntiVirus engines on VirusTotal as malicious |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (9cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (upload) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0xeafe20 WriteFile
0xeafe24 WriteConsoleW
0xeafe28 WerSetFlags
0xeafe2c WerGetFlags
0xeafe30 WaitForMultipleObjects
0xeafe34 WaitForSingleObject
0xeafe38 VirtualQuery
0xeafe3c VirtualFree
0xeafe40 VirtualAlloc
0xeafe44 TlsAlloc
0xeafe48 SwitchToThread
0xeafe4c SuspendThread
0xeafe50 SetWaitableTimer
0xeafe54 SetUnhandledExceptionFilter
0xeafe58 SetProcessPriorityBoost
0xeafe5c SetEvent
0xeafe60 SetErrorMode
0xeafe64 SetConsoleCtrlHandler
0xeafe68 ResumeThread
0xeafe6c RaiseFailFastException
0xeafe70 PostQueuedCompletionStatus
0xeafe74 LoadLibraryW
0xeafe78 LoadLibraryExW
0xeafe7c SetThreadContext
0xeafe80 GetThreadContext
0xeafe84 GetSystemInfo
0xeafe88 GetSystemDirectoryA
0xeafe8c GetStdHandle
0xeafe90 GetQueuedCompletionStatusEx
0xeafe94 GetProcessAffinityMask
0xeafe98 GetProcAddress
0xeafe9c GetErrorMode
0xeafea0 GetEnvironmentStringsW
0xeafea4 GetCurrentThreadId
0xeafea8 GetConsoleMode
0xeafeac FreeEnvironmentStringsW
0xeafeb0 ExitProcess
0xeafeb4 DuplicateHandle
0xeafeb8 CreateWaitableTimerExW
0xeafebc CreateThread
0xeafec0 CreateIoCompletionPort
0xeafec4 CreateEventA
0xeafec8 CloseHandle
0xeafecc AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0xeafe20 WriteFile
0xeafe24 WriteConsoleW
0xeafe28 WerSetFlags
0xeafe2c WerGetFlags
0xeafe30 WaitForMultipleObjects
0xeafe34 WaitForSingleObject
0xeafe38 VirtualQuery
0xeafe3c VirtualFree
0xeafe40 VirtualAlloc
0xeafe44 TlsAlloc
0xeafe48 SwitchToThread
0xeafe4c SuspendThread
0xeafe50 SetWaitableTimer
0xeafe54 SetUnhandledExceptionFilter
0xeafe58 SetProcessPriorityBoost
0xeafe5c SetEvent
0xeafe60 SetErrorMode
0xeafe64 SetConsoleCtrlHandler
0xeafe68 ResumeThread
0xeafe6c RaiseFailFastException
0xeafe70 PostQueuedCompletionStatus
0xeafe74 LoadLibraryW
0xeafe78 LoadLibraryExW
0xeafe7c SetThreadContext
0xeafe80 GetThreadContext
0xeafe84 GetSystemInfo
0xeafe88 GetSystemDirectoryA
0xeafe8c GetStdHandle
0xeafe90 GetQueuedCompletionStatusEx
0xeafe94 GetProcessAffinityMask
0xeafe98 GetProcAddress
0xeafe9c GetErrorMode
0xeafea0 GetEnvironmentStringsW
0xeafea4 GetCurrentThreadId
0xeafea8 GetConsoleMode
0xeafeac FreeEnvironmentStringsW
0xeafeb0 ExitProcess
0xeafeb4 DuplicateHandle
0xeafeb8 CreateWaitableTimerExW
0xeafebc CreateThread
0xeafec0 CreateIoCompletionPort
0xeafec4 CreateEventA
0xeafec8 CloseHandle
0xeafecc AddVectoredExceptionHandler
EAT(Export Address Table) is none