ScreenShot
| Created | 2024.09.20 10:51 | Machine | s1_win7_x6403 |
| Filename | Desktop_Explorer.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 11 detected (AIDetectMalware, Attribute, HighConfidence, a variant of WinGo, CLASSIC, score, Detected, Caynamer, LummaC2, WinGo) | ||
| md5 | acccb5d6308487da88b2f05b2f4f6234 | ||
| sha256 | f188aaf2e67a048f1cfa0ab7758ac80b0e4a1167042f55176e4ac0d273b26744 | ||
| ssdeep | 49152:L8jB0EJgiY3FGXiSLruMH0A0PncurVqhTWQa4IeWKDHIoZcjPeYgjBd0y/ES5TcQ:oF0EJOjA0FrVXgj1lFASTUDHDSNOy | ||
| imphash | 1aae8bf580c846f39c71c05898e57e88 | ||
| impfuzzy | 24:ibVjh9wO+VuT7boVaXOr6kwmDgUPMztxdEr6UP:AwO+VUjXOmokx0nP | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| watch | File has been identified by 11 AntiVirus engines on VirusTotal as malicious |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (9cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (upload) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
kernel32.dll
0xe4f260 WriteFile
0xe4f264 WriteConsoleW
0xe4f268 WerSetFlags
0xe4f26c WerGetFlags
0xe4f270 WaitForMultipleObjects
0xe4f274 WaitForSingleObject
0xe4f278 VirtualQuery
0xe4f27c VirtualFree
0xe4f280 VirtualAlloc
0xe4f284 TlsAlloc
0xe4f288 SwitchToThread
0xe4f28c SuspendThread
0xe4f290 SetWaitableTimer
0xe4f294 SetUnhandledExceptionFilter
0xe4f298 SetProcessPriorityBoost
0xe4f29c SetEvent
0xe4f2a0 SetErrorMode
0xe4f2a4 SetConsoleCtrlHandler
0xe4f2a8 ResumeThread
0xe4f2ac RaiseFailFastException
0xe4f2b0 PostQueuedCompletionStatus
0xe4f2b4 LoadLibraryW
0xe4f2b8 LoadLibraryExW
0xe4f2bc SetThreadContext
0xe4f2c0 GetThreadContext
0xe4f2c4 GetSystemInfo
0xe4f2c8 GetSystemDirectoryA
0xe4f2cc GetStdHandle
0xe4f2d0 GetQueuedCompletionStatusEx
0xe4f2d4 GetProcessAffinityMask
0xe4f2d8 GetProcAddress
0xe4f2dc GetErrorMode
0xe4f2e0 GetEnvironmentStringsW
0xe4f2e4 GetCurrentThreadId
0xe4f2e8 GetConsoleMode
0xe4f2ec FreeEnvironmentStringsW
0xe4f2f0 ExitProcess
0xe4f2f4 DuplicateHandle
0xe4f2f8 CreateWaitableTimerExW
0xe4f2fc CreateThread
0xe4f300 CreateIoCompletionPort
0xe4f304 CreateEventA
0xe4f308 CloseHandle
0xe4f30c AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0xe4f260 WriteFile
0xe4f264 WriteConsoleW
0xe4f268 WerSetFlags
0xe4f26c WerGetFlags
0xe4f270 WaitForMultipleObjects
0xe4f274 WaitForSingleObject
0xe4f278 VirtualQuery
0xe4f27c VirtualFree
0xe4f280 VirtualAlloc
0xe4f284 TlsAlloc
0xe4f288 SwitchToThread
0xe4f28c SuspendThread
0xe4f290 SetWaitableTimer
0xe4f294 SetUnhandledExceptionFilter
0xe4f298 SetProcessPriorityBoost
0xe4f29c SetEvent
0xe4f2a0 SetErrorMode
0xe4f2a4 SetConsoleCtrlHandler
0xe4f2a8 ResumeThread
0xe4f2ac RaiseFailFastException
0xe4f2b0 PostQueuedCompletionStatus
0xe4f2b4 LoadLibraryW
0xe4f2b8 LoadLibraryExW
0xe4f2bc SetThreadContext
0xe4f2c0 GetThreadContext
0xe4f2c4 GetSystemInfo
0xe4f2c8 GetSystemDirectoryA
0xe4f2cc GetStdHandle
0xe4f2d0 GetQueuedCompletionStatusEx
0xe4f2d4 GetProcessAffinityMask
0xe4f2d8 GetProcAddress
0xe4f2dc GetErrorMode
0xe4f2e0 GetEnvironmentStringsW
0xe4f2e4 GetCurrentThreadId
0xe4f2e8 GetConsoleMode
0xe4f2ec FreeEnvironmentStringsW
0xe4f2f0 ExitProcess
0xe4f2f4 DuplicateHandle
0xe4f2f8 CreateWaitableTimerExW
0xe4f2fc CreateThread
0xe4f300 CreateIoCompletionPort
0xe4f304 CreateEventA
0xe4f308 CloseHandle
0xe4f30c AddVectoredExceptionHandler
EAT(Export Address Table) is none