ScreenShot
| Created | 2024.09.13 09:43 | Machine | s1_win7_x6403 |
| Filename | svhost2.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 20 detected (AIDetectMalware, Malicious, score, Reverseshell, Vunf, a variant of WinGo, pdhde, Detected, Wacatac, Artemis, WinGo, susgen) | ||
| md5 | 5e670353e13a6c5de6c3acec90eef25e | ||
| sha256 | e717677c2827928972ab2674573e9fa3b1b5e31b6cfa42e52be5bb31a41b16fd | ||
| ssdeep | 98304:iL18b10q9QgCbSDHLWyCB1YumLYXptirUK1wOCRMuQ1CcFxSLEv5UzN9w8fuGmw1:S1e1/9QgCbSDHLWyCB1YumLYXptirUKg | ||
| imphash | 4f2f006e2ecf7172ad368f8289dc96c1 | ||
| impfuzzy | 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6tP:AwO+VUjXOmokx0oP | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 20 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0x7ea240 WriteFile
0x7ea248 WriteConsoleW
0x7ea250 WerSetFlags
0x7ea258 WerGetFlags
0x7ea260 WaitForMultipleObjects
0x7ea268 WaitForSingleObject
0x7ea270 VirtualQuery
0x7ea278 VirtualFree
0x7ea280 VirtualAlloc
0x7ea288 TlsAlloc
0x7ea290 SwitchToThread
0x7ea298 SuspendThread
0x7ea2a0 SetWaitableTimer
0x7ea2a8 SetUnhandledExceptionFilter
0x7ea2b0 SetProcessPriorityBoost
0x7ea2b8 SetEvent
0x7ea2c0 SetErrorMode
0x7ea2c8 SetConsoleCtrlHandler
0x7ea2d0 ResumeThread
0x7ea2d8 RaiseFailFastException
0x7ea2e0 PostQueuedCompletionStatus
0x7ea2e8 LoadLibraryW
0x7ea2f0 LoadLibraryExW
0x7ea2f8 SetThreadContext
0x7ea300 GetThreadContext
0x7ea308 GetSystemInfo
0x7ea310 GetSystemDirectoryA
0x7ea318 GetStdHandle
0x7ea320 GetQueuedCompletionStatusEx
0x7ea328 GetProcessAffinityMask
0x7ea330 GetProcAddress
0x7ea338 GetErrorMode
0x7ea340 GetEnvironmentStringsW
0x7ea348 GetCurrentThreadId
0x7ea350 GetConsoleMode
0x7ea358 FreeEnvironmentStringsW
0x7ea360 ExitProcess
0x7ea368 DuplicateHandle
0x7ea370 CreateWaitableTimerExW
0x7ea378 CreateThread
0x7ea380 CreateIoCompletionPort
0x7ea388 CreateFileA
0x7ea390 CreateEventA
0x7ea398 CloseHandle
0x7ea3a0 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x7ea240 WriteFile
0x7ea248 WriteConsoleW
0x7ea250 WerSetFlags
0x7ea258 WerGetFlags
0x7ea260 WaitForMultipleObjects
0x7ea268 WaitForSingleObject
0x7ea270 VirtualQuery
0x7ea278 VirtualFree
0x7ea280 VirtualAlloc
0x7ea288 TlsAlloc
0x7ea290 SwitchToThread
0x7ea298 SuspendThread
0x7ea2a0 SetWaitableTimer
0x7ea2a8 SetUnhandledExceptionFilter
0x7ea2b0 SetProcessPriorityBoost
0x7ea2b8 SetEvent
0x7ea2c0 SetErrorMode
0x7ea2c8 SetConsoleCtrlHandler
0x7ea2d0 ResumeThread
0x7ea2d8 RaiseFailFastException
0x7ea2e0 PostQueuedCompletionStatus
0x7ea2e8 LoadLibraryW
0x7ea2f0 LoadLibraryExW
0x7ea2f8 SetThreadContext
0x7ea300 GetThreadContext
0x7ea308 GetSystemInfo
0x7ea310 GetSystemDirectoryA
0x7ea318 GetStdHandle
0x7ea320 GetQueuedCompletionStatusEx
0x7ea328 GetProcessAffinityMask
0x7ea330 GetProcAddress
0x7ea338 GetErrorMode
0x7ea340 GetEnvironmentStringsW
0x7ea348 GetCurrentThreadId
0x7ea350 GetConsoleMode
0x7ea358 FreeEnvironmentStringsW
0x7ea360 ExitProcess
0x7ea368 DuplicateHandle
0x7ea370 CreateWaitableTimerExW
0x7ea378 CreateThread
0x7ea380 CreateIoCompletionPort
0x7ea388 CreateFileA
0x7ea390 CreateEventA
0x7ea398 CloseHandle
0x7ea3a0 AddVectoredExceptionHandler
EAT(Export Address Table) is none