ScreenShot
| Created | 2024.09.17 13:53 | Machine | s1_win7_x6401 |
| Filename | nc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 23 detected (AIDetectMalware, Unsafe, Dnldr30, Attribute, HighConfidence, Malicious, score, Detected, Wacatac, R281345, Artemis, Chgt, susgen) | ||
| md5 | 1b7ee505711d9f7f8cd58b36c8bfc84d | ||
| sha256 | 26b4ab7deb136a911001098973f32866765c9616162a748e3fbe8aa820b542ec | ||
| ssdeep | 1536:zCgt3dFSHBoO3ag6s55gprhi6WEwaZMLbBWf62BBZe/gYT:zjJPSh3qs+FiRLbEy/fT | ||
| imphash | 9d129af3a77b645161a552556901cd9b | ||
| impfuzzy | 3:swBJAEPwS9KTXzhAXwEQaxRAAbsEBJJ67EGV21MO/I/mAmeCJ7oWbW6Lt6DAGXw1:dBJAEHGDzyRlbRmVOZ/IOdPLbYiX | ||
Network IP location
Signature (9cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 23 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is compressed using UPX |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | The executable uses a known packer |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.DLL
0x423980 LoadLibraryA
0x423984 GetProcAddress
0x423988 VirtualProtect
0x42398c VirtualAlloc
0x423990 VirtualFree
0x423994 ExitProcess
MSVCRT.dll
0x42399c exit
OLEAUT32.dll
0x4239a4 SysStringLen
SHELL32.dll
0x4239ac ShellExecuteExW
USER32.dll
0x4239b4 SetTimer
EAT(Export Address Table) is none
KERNEL32.DLL
0x423980 LoadLibraryA
0x423984 GetProcAddress
0x423988 VirtualProtect
0x42398c VirtualAlloc
0x423990 VirtualFree
0x423994 ExitProcess
MSVCRT.dll
0x42399c exit
OLEAUT32.dll
0x4239a4 SysStringLen
SHELL32.dll
0x4239ac ShellExecuteExW
USER32.dll
0x4239b4 SetTimer
EAT(Export Address Table) is none