ScreenShot
| Created | 2024.09.03 09:30 | Machine | s1_win7_x6403 |
| Filename | R3nzSkin_Injector.exe | ||
| Type | PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 51 detected (AIDetectMalware, DllInject, malicious, high confidence, PWSZbot, Jalapeno, Unsafe, Heracles, Vmh4, Attribute, HighConfidence, AGen, MZ potentially unsafe, GenericRXAA, TrojanX, MSILHeracles, CLOUD, DllInjectAGen, R002C0DDE24, Generic Reputation PUA, Static AI, Malicious PE, Detected, ai score=80, Sabsik, DllInjector, 609w+oO9o, susgen, confidence) | ||
| md5 | 8af17734385f55dc58f1ca38bce22312 | ||
| sha256 | ea034d7b08a538f827293c3b0742d4c178708afdfd0f45d47cad99967b311a97 | ||
| ssdeep | 6144:fj7Q2Fnv3OcLHF1ZVTc0/YxuQOPLnrU1ZE2pkLPVQW13fe0I2028fOTMK+epwMg3:fj7dOqZVTc0/YxvOPLnrU1ZE2pkLPVQe | ||
| imphash | 2c3ed07dfb34c79124a4487410d8e0bd | ||
| impfuzzy | 96:koo21hqiMDeLM2mvMskULmo1/lgljjcebrvkxUX5BxH03CNO48bk9x8vJOwD2:ddra/glUe3j0S8b4p | ||
Network IP location
Signature (11cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 51 AntiVirus engines on VirusTotal as malicious |
| watch | Attempts to create or modify system certificates |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| notice | Foreign language identified in PE resource |
| notice | Performs some HTTP requests |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Collects information to fingerprint the system (MachineGuid |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| info | Is_DotNET_EXE | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
MSVCP140.dll
0x14001a058 ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
0x14001a060 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
0x14001a068 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
0x14001a070 ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a078 ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a080 ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a088 ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a090 ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
0x14001a098 ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
0x14001a0a0 _Strcoll
0x14001a0a8 _Strxfrm
0x14001a0b0 ?_Throw_C_error@std@@YAXH@Z
0x14001a0b8 ?_Throw_Cpp_error@std@@YAXH@Z
0x14001a0c0 _Thrd_detach
0x14001a0c8 _Cnd_do_broadcast_at_thread_exit
0x14001a0d0 ?id@?$collate@D@std@@2V0locale@2@A
0x14001a0d8 ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
0x14001a0e0 ?id@?$ctype@D@std@@2V0locale@2@A
0x14001a0e8 ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
0x14001a0f0 ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
0x14001a0f8 ?_Incref@facet@locale@std@@UEAAXXZ
0x14001a100 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
0x14001a108 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
0x14001a110 ?_Xlength_error@std@@YAXPEBD@Z
0x14001a118 ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
0x14001a120 ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
0x14001a128 ?_Xbad_alloc@std@@YAXXZ
0x14001a130 ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a138 ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
0x14001a140 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
0x14001a148 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
0x14001a150 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
0x14001a158 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a160 ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
0x14001a168 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
0x14001a170 _Xtime_get_ticks
0x14001a178 _Query_perf_frequency
0x14001a180 _Query_perf_counter
0x14001a188 ?always_noconv@codecvt_base@std@@QEBA_NXZ
0x14001a190 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
0x14001a198 ??0facet@locale@std@@IEAA@_K@Z
0x14001a1a0 ??1facet@locale@std@@MEAA@XZ
0x14001a1a8 ?is@?$ctype@D@std@@QEBA_NFD@Z
0x14001a1b0 ?tolower@?$ctype@D@std@@QEBADD@Z
0x14001a1b8 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a1c0 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a1c8 ??0_Lockit@std@@QEAA@H@Z
0x14001a1d0 ??Bid@locale@std@@QEAA_KXZ
0x14001a1d8 ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
0x14001a1e0 ??1_Lockit@std@@QEAA@XZ
0x14001a1e8 ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
0x14001a1f0 ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
0x14001a1f8 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
0x14001a200 _Thrd_sleep
0x14001a208 ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
0x14001a210 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
0x14001a218 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
0x14001a220 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
0x14001a228 ??0_Locinfo@std@@QEAA@PEBD@Z
0x14001a230 ??1_Locinfo@std@@QEAA@XZ
0x14001a238 ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
0x14001a240 ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a248 ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a250 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a258 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
api-ms-win-crt-heap-l1-1-0.dll
0x14001a2f8 realloc
0x14001a300 malloc
0x14001a308 free
0x14001a310 _callnewh
api-ms-win-crt-runtime-l1-1-0.dll
0x14001a320 _cexit
0x14001a328 terminate
0x14001a330 _beginthreadex
0x14001a338 abort
0x14001a340 _invalid_parameter_noinfo_noreturn
VCRUNTIME140.dll
0x14001a268 __current_exception_context
0x14001a270 __current_exception
0x14001a278 _CxxThrowException
0x14001a280 __std_exception_destroy
0x14001a288 __std_exception_copy
0x14001a290 memcpy
0x14001a298 __FrameUnwindFilter
0x14001a2a0 __CxxUnregisterExceptionObject
0x14001a2a8 __CxxDetectRethrow
0x14001a2b0 __CxxRegisterExceptionObject
0x14001a2b8 __CxxExceptionFilter
0x14001a2c0 __CxxQueryExceptionSize
0x14001a2c8 strchr
0x14001a2d0 memmove
KERNEL32.dll
0x14001a020 Sleep
0x14001a028 GetSystemTimeAsFileTime
0x14001a030 GetCurrentThreadId
0x14001a038 GetCurrentProcessId
0x14001a040 QueryPerformanceCounter
0x14001a048 WideCharToMultiByte
ADVAPI32.dll
0x14001a000 LookupPrivilegeValueW
0x14001a008 OpenProcessToken
0x14001a010 AdjustTokenPrivileges
api-ms-win-crt-stdio-l1-1-0.dll
0x14001a350 fgetc
0x14001a358 _get_stream_buffer_pointers
0x14001a360 fwrite
0x14001a368 fclose
0x14001a370 fflush
0x14001a378 setvbuf
0x14001a380 fsetpos
0x14001a388 fgetpos
0x14001a390 fread
0x14001a398 _fseeki64
0x14001a3a0 ungetc
0x14001a3a8 fputc
api-ms-win-crt-filesystem-l1-1-0.dll
0x14001a2e0 _lock_file
0x14001a2e8 _unlock_file
api-ms-win-crt-time-l1-1-0.dll
0x14001a3b8 _time64
api-ms-win-crt-utility-l1-1-0.dll
0x14001a3c8 srand
mscoree.dll
0x14001a3d8 _CorExeMain
EAT(Export Address Table) is none
MSVCP140.dll
0x14001a058 ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
0x14001a060 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
0x14001a068 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
0x14001a070 ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a078 ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a080 ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a088 ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a090 ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
0x14001a098 ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
0x14001a0a0 _Strcoll
0x14001a0a8 _Strxfrm
0x14001a0b0 ?_Throw_C_error@std@@YAXH@Z
0x14001a0b8 ?_Throw_Cpp_error@std@@YAXH@Z
0x14001a0c0 _Thrd_detach
0x14001a0c8 _Cnd_do_broadcast_at_thread_exit
0x14001a0d0 ?id@?$collate@D@std@@2V0locale@2@A
0x14001a0d8 ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
0x14001a0e0 ?id@?$ctype@D@std@@2V0locale@2@A
0x14001a0e8 ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
0x14001a0f0 ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
0x14001a0f8 ?_Incref@facet@locale@std@@UEAAXXZ
0x14001a100 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
0x14001a108 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
0x14001a110 ?_Xlength_error@std@@YAXPEBD@Z
0x14001a118 ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
0x14001a120 ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
0x14001a128 ?_Xbad_alloc@std@@YAXXZ
0x14001a130 ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a138 ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
0x14001a140 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
0x14001a148 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
0x14001a150 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
0x14001a158 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a160 ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
0x14001a168 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
0x14001a170 _Xtime_get_ticks
0x14001a178 _Query_perf_frequency
0x14001a180 _Query_perf_counter
0x14001a188 ?always_noconv@codecvt_base@std@@QEBA_NXZ
0x14001a190 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
0x14001a198 ??0facet@locale@std@@IEAA@_K@Z
0x14001a1a0 ??1facet@locale@std@@MEAA@XZ
0x14001a1a8 ?is@?$ctype@D@std@@QEBA_NFD@Z
0x14001a1b0 ?tolower@?$ctype@D@std@@QEBADD@Z
0x14001a1b8 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a1c0 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
0x14001a1c8 ??0_Lockit@std@@QEAA@H@Z
0x14001a1d0 ??Bid@locale@std@@QEAA_KXZ
0x14001a1d8 ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
0x14001a1e0 ??1_Lockit@std@@QEAA@XZ
0x14001a1e8 ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
0x14001a1f0 ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
0x14001a1f8 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
0x14001a200 _Thrd_sleep
0x14001a208 ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
0x14001a210 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
0x14001a218 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
0x14001a220 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
0x14001a228 ??0_Locinfo@std@@QEAA@PEBD@Z
0x14001a230 ??1_Locinfo@std@@QEAA@XZ
0x14001a238 ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
0x14001a240 ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a248 ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
0x14001a250 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
0x14001a258 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
api-ms-win-crt-heap-l1-1-0.dll
0x14001a2f8 realloc
0x14001a300 malloc
0x14001a308 free
0x14001a310 _callnewh
api-ms-win-crt-runtime-l1-1-0.dll
0x14001a320 _cexit
0x14001a328 terminate
0x14001a330 _beginthreadex
0x14001a338 abort
0x14001a340 _invalid_parameter_noinfo_noreturn
VCRUNTIME140.dll
0x14001a268 __current_exception_context
0x14001a270 __current_exception
0x14001a278 _CxxThrowException
0x14001a280 __std_exception_destroy
0x14001a288 __std_exception_copy
0x14001a290 memcpy
0x14001a298 __FrameUnwindFilter
0x14001a2a0 __CxxUnregisterExceptionObject
0x14001a2a8 __CxxDetectRethrow
0x14001a2b0 __CxxRegisterExceptionObject
0x14001a2b8 __CxxExceptionFilter
0x14001a2c0 __CxxQueryExceptionSize
0x14001a2c8 strchr
0x14001a2d0 memmove
KERNEL32.dll
0x14001a020 Sleep
0x14001a028 GetSystemTimeAsFileTime
0x14001a030 GetCurrentThreadId
0x14001a038 GetCurrentProcessId
0x14001a040 QueryPerformanceCounter
0x14001a048 WideCharToMultiByte
ADVAPI32.dll
0x14001a000 LookupPrivilegeValueW
0x14001a008 OpenProcessToken
0x14001a010 AdjustTokenPrivileges
api-ms-win-crt-stdio-l1-1-0.dll
0x14001a350 fgetc
0x14001a358 _get_stream_buffer_pointers
0x14001a360 fwrite
0x14001a368 fclose
0x14001a370 fflush
0x14001a378 setvbuf
0x14001a380 fsetpos
0x14001a388 fgetpos
0x14001a390 fread
0x14001a398 _fseeki64
0x14001a3a0 ungetc
0x14001a3a8 fputc
api-ms-win-crt-filesystem-l1-1-0.dll
0x14001a2e0 _lock_file
0x14001a2e8 _unlock_file
api-ms-win-crt-time-l1-1-0.dll
0x14001a3b8 _time64
api-ms-win-crt-utility-l1-1-0.dll
0x14001a3c8 srand
mscoree.dll
0x14001a3d8 _CorExeMain
EAT(Export Address Table) is none