ScreenShot
| Created | 2024.09.19 10:26 | Machine | s1_win7_x6403 |
| Filename | onePackage.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | |||
| md5 | 6c2db0ef90b27f880a1566de7711e6c6 | ||
| sha256 | c2588125970db20ac97818d2170eecec857f578d7bf3f24ef8f6a3f303798ac6 | ||
| ssdeep | 98304:f7aVHGolaJtFaKWi64a6kI/t5jeWjAmiEmp71:mtl0Fh7Lk | ||
| imphash | 1aae8bf580c846f39c71c05898e57e88 | ||
| impfuzzy | 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6UP:AwO+VUjXOmokx0nP | ||
Network IP location
Signature (1cnts)
| Level | Description |
|---|---|
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (9cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (upload) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0xbcdee0 WriteFile
0xbcdee4 WriteConsoleW
0xbcdee8 WerSetFlags
0xbcdeec WerGetFlags
0xbcdef0 WaitForMultipleObjects
0xbcdef4 WaitForSingleObject
0xbcdef8 VirtualQuery
0xbcdefc VirtualFree
0xbcdf00 VirtualAlloc
0xbcdf04 TlsAlloc
0xbcdf08 SwitchToThread
0xbcdf0c SuspendThread
0xbcdf10 SetWaitableTimer
0xbcdf14 SetUnhandledExceptionFilter
0xbcdf18 SetProcessPriorityBoost
0xbcdf1c SetEvent
0xbcdf20 SetErrorMode
0xbcdf24 SetConsoleCtrlHandler
0xbcdf28 ResumeThread
0xbcdf2c RaiseFailFastException
0xbcdf30 PostQueuedCompletionStatus
0xbcdf34 LoadLibraryW
0xbcdf38 LoadLibraryExW
0xbcdf3c SetThreadContext
0xbcdf40 GetThreadContext
0xbcdf44 GetSystemInfo
0xbcdf48 GetSystemDirectoryA
0xbcdf4c GetStdHandle
0xbcdf50 GetQueuedCompletionStatusEx
0xbcdf54 GetProcessAffinityMask
0xbcdf58 GetProcAddress
0xbcdf5c GetErrorMode
0xbcdf60 GetEnvironmentStringsW
0xbcdf64 GetCurrentThreadId
0xbcdf68 GetConsoleMode
0xbcdf6c FreeEnvironmentStringsW
0xbcdf70 ExitProcess
0xbcdf74 DuplicateHandle
0xbcdf78 CreateWaitableTimerExW
0xbcdf7c CreateThread
0xbcdf80 CreateIoCompletionPort
0xbcdf84 CreateEventA
0xbcdf88 CloseHandle
0xbcdf8c AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0xbcdee0 WriteFile
0xbcdee4 WriteConsoleW
0xbcdee8 WerSetFlags
0xbcdeec WerGetFlags
0xbcdef0 WaitForMultipleObjects
0xbcdef4 WaitForSingleObject
0xbcdef8 VirtualQuery
0xbcdefc VirtualFree
0xbcdf00 VirtualAlloc
0xbcdf04 TlsAlloc
0xbcdf08 SwitchToThread
0xbcdf0c SuspendThread
0xbcdf10 SetWaitableTimer
0xbcdf14 SetUnhandledExceptionFilter
0xbcdf18 SetProcessPriorityBoost
0xbcdf1c SetEvent
0xbcdf20 SetErrorMode
0xbcdf24 SetConsoleCtrlHandler
0xbcdf28 ResumeThread
0xbcdf2c RaiseFailFastException
0xbcdf30 PostQueuedCompletionStatus
0xbcdf34 LoadLibraryW
0xbcdf38 LoadLibraryExW
0xbcdf3c SetThreadContext
0xbcdf40 GetThreadContext
0xbcdf44 GetSystemInfo
0xbcdf48 GetSystemDirectoryA
0xbcdf4c GetStdHandle
0xbcdf50 GetQueuedCompletionStatusEx
0xbcdf54 GetProcessAffinityMask
0xbcdf58 GetProcAddress
0xbcdf5c GetErrorMode
0xbcdf60 GetEnvironmentStringsW
0xbcdf64 GetCurrentThreadId
0xbcdf68 GetConsoleMode
0xbcdf6c FreeEnvironmentStringsW
0xbcdf70 ExitProcess
0xbcdf74 DuplicateHandle
0xbcdf78 CreateWaitableTimerExW
0xbcdf7c CreateThread
0xbcdf80 CreateIoCompletionPort
0xbcdf84 CreateEventA
0xbcdf88 CloseHandle
0xbcdf8c AddVectoredExceptionHandler
EAT(Export Address Table) is none