ScreenShot
| Created | 2024.09.11 10:20 | Machine | s1_win7_x6401 |
| Filename | x.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 53 detected (AIDetectMalware, Sliver, Malicious, score, Dump, Marte, Unsafe, HackTool, Implant, 64bit, uwccg, Attribute, HighConfidence, a variant of WinGo, MalwareX, MalGO, SuspGolang, CLASSIC, Tool, SBeacon, SILVER, SMYXCFWAZ, Static AI, Malicious PE, Detected, AGEN, ai score=85, 4OPL1Y, ABApplication, ONSB, R598949, WinGo, Shellcoderunner, Rzfl, confidence, 100%) | ||
| md5 | ceec513e6f815b3a047e2922a642af77 | ||
| sha256 | 07dada9c2301b4684f361eef4d94e7e5f573eae13d65e06043ff1fa1b995aa86 | ||
| ssdeep | 98304:yd3tJjlWzvw7ULa+rJYGwT5FPi7NgRorWC61vAElaLAVG:yVt5lCivdFPixgCrWC61v5lG | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 53 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| notice | Checks adapter addresses which can be used to detect virtual network interfaces |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x12d0040 WriteFile
0x12d0048 WriteConsoleW
0x12d0050 WaitForMultipleObjects
0x12d0058 WaitForSingleObject
0x12d0060 VirtualQuery
0x12d0068 VirtualFree
0x12d0070 VirtualAlloc
0x12d0078 TlsAlloc
0x12d0080 SwitchToThread
0x12d0088 SuspendThread
0x12d0090 SetWaitableTimer
0x12d0098 SetUnhandledExceptionFilter
0x12d00a0 SetProcessPriorityBoost
0x12d00a8 SetEvent
0x12d00b0 SetErrorMode
0x12d00b8 SetConsoleCtrlHandler
0x12d00c0 ResumeThread
0x12d00c8 PostQueuedCompletionStatus
0x12d00d0 LoadLibraryA
0x12d00d8 LoadLibraryW
0x12d00e0 SetThreadContext
0x12d00e8 GetThreadContext
0x12d00f0 GetSystemInfo
0x12d00f8 GetSystemDirectoryA
0x12d0100 GetStdHandle
0x12d0108 GetQueuedCompletionStatusEx
0x12d0110 GetProcessAffinityMask
0x12d0118 GetProcAddress
0x12d0120 GetEnvironmentStringsW
0x12d0128 GetConsoleMode
0x12d0130 FreeEnvironmentStringsW
0x12d0138 ExitProcess
0x12d0140 DuplicateHandle
0x12d0148 CreateWaitableTimerExW
0x12d0150 CreateThread
0x12d0158 CreateIoCompletionPort
0x12d0160 CreateFileA
0x12d0168 CreateEventA
0x12d0170 CloseHandle
0x12d0178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x12d0040 WriteFile
0x12d0048 WriteConsoleW
0x12d0050 WaitForMultipleObjects
0x12d0058 WaitForSingleObject
0x12d0060 VirtualQuery
0x12d0068 VirtualFree
0x12d0070 VirtualAlloc
0x12d0078 TlsAlloc
0x12d0080 SwitchToThread
0x12d0088 SuspendThread
0x12d0090 SetWaitableTimer
0x12d0098 SetUnhandledExceptionFilter
0x12d00a0 SetProcessPriorityBoost
0x12d00a8 SetEvent
0x12d00b0 SetErrorMode
0x12d00b8 SetConsoleCtrlHandler
0x12d00c0 ResumeThread
0x12d00c8 PostQueuedCompletionStatus
0x12d00d0 LoadLibraryA
0x12d00d8 LoadLibraryW
0x12d00e0 SetThreadContext
0x12d00e8 GetThreadContext
0x12d00f0 GetSystemInfo
0x12d00f8 GetSystemDirectoryA
0x12d0100 GetStdHandle
0x12d0108 GetQueuedCompletionStatusEx
0x12d0110 GetProcessAffinityMask
0x12d0118 GetProcAddress
0x12d0120 GetEnvironmentStringsW
0x12d0128 GetConsoleMode
0x12d0130 FreeEnvironmentStringsW
0x12d0138 ExitProcess
0x12d0140 DuplicateHandle
0x12d0148 CreateWaitableTimerExW
0x12d0150 CreateThread
0x12d0158 CreateIoCompletionPort
0x12d0160 CreateFileA
0x12d0168 CreateEventA
0x12d0170 CloseHandle
0x12d0178 AddVectoredExceptionHandler
EAT(Export Address Table) is none