ScreenShot
| Created | 2024.09.25 10:57 | Machine | s1_win7_x6401 |
| Filename | Golove.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 47 detected (AIDetectMalware, Marte, Malicious, score, Unsafe, Meterpreter, V9iu, confidence, 100%, high confidence, MsfEncode, Kryptik@AI, RDML, hdWqJjnPkCvDw69O3Bq+WA, Swrort, amdjm, R002C0DIE24, Meter, Detected, Artemis, GdSda, Gencirc, Rozena, PossibleThreat) | ||
| md5 | e9dc029457e9d23c8db988c4c0585bfa | ||
| sha256 | 18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db | ||
| ssdeep | 192:+np66k5gQDVAU3l6+eKdv3Zn4TJrJfsQ5XfDcyLwaBg1+Cfs2LzwYDK7UlVSq7j4:GO/5AwJtZ4RFskLt | ||
| imphash | a6d84f352ba25f867567969527b4e319 | ||
| impfuzzy | 24:W/zxvKS2QMSA7kYgMyWPWUJLTwUyWNwBJCbZhJLocAhBDAihTK4Tg929fBSzAy8D:WrIQMSG3jfNU+j1oiS6BMQSLMA | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 47 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a thread using CreateRemoteThread in a non-child process indicative of process injection |
| watch | Expresses interest in specific running processes |
| watch | Manipulates memory of a non-child process indicative of process injection |
| watch | Network communications indicative of possible code injection originated from the process explorer.exe |
| watch | Potential code injection by writing to the memory of another process |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| info | One or more processes crashed |
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140003000 WriteProcessMemory
0x140003008 OpenProcess
0x140003010 CreateToolhelp32Snapshot
0x140003018 Process32NextW
0x140003020 Process32FirstW
0x140003028 CloseHandle
0x140003030 VirtualAllocEx
0x140003038 CreateRemoteThread
0x140003040 RtlLookupFunctionEntry
0x140003048 RtlVirtualUnwind
0x140003050 UnhandledExceptionFilter
0x140003058 GetModuleHandleW
0x140003060 SetUnhandledExceptionFilter
0x140003068 GetCurrentProcess
0x140003070 TerminateProcess
0x140003078 IsProcessorFeaturePresent
0x140003080 QueryPerformanceCounter
0x140003088 GetCurrentProcessId
0x140003090 RtlCaptureContext
0x140003098 GetCurrentThreadId
0x1400030a0 GetSystemTimeAsFileTime
0x1400030a8 IsDebuggerPresent
0x1400030b0 InitializeSListHead
VCRUNTIME140.dll
0x1400030c0 __C_specific_handler
0x1400030c8 __current_exception_context
0x1400030d0 __std_exception_copy
0x1400030d8 __std_exception_destroy
0x1400030e0 _CxxThrowException
0x1400030e8 memset
0x1400030f0 __current_exception
0x1400030f8 memcpy
api-ms-win-crt-runtime-l1-1-0.dll
0x140003150 _register_onexit_function
0x140003158 _crt_atexit
0x140003160 _initialize_onexit_table
0x140003168 _register_thread_local_exe_atexit_callback
0x140003170 _c_exit
0x140003178 __p___argc
0x140003180 exit
0x140003188 _cexit
0x140003190 _initterm_e
0x140003198 _initterm
0x1400031a0 _get_initial_narrow_environment
0x1400031a8 _initialize_narrow_environment
0x1400031b0 _configure_narrow_argv
0x1400031b8 __p___argv
0x1400031c0 _set_app_type
0x1400031c8 _seh_filter_exe
0x1400031d0 _exit
0x1400031d8 terminate
0x1400031e0 _invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0.dll
0x140003208 _wcsicmp
api-ms-win-crt-heap-l1-1-0.dll
0x140003108 _set_new_mode
0x140003110 _callnewh
0x140003118 malloc
0x140003120 free
api-ms-win-crt-math-l1-1-0.dll
0x140003140 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x1400031f0 _set_fmode
0x1400031f8 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x140003130 _configthreadlocale
EAT(Export Address Table) is none
KERNEL32.dll
0x140003000 WriteProcessMemory
0x140003008 OpenProcess
0x140003010 CreateToolhelp32Snapshot
0x140003018 Process32NextW
0x140003020 Process32FirstW
0x140003028 CloseHandle
0x140003030 VirtualAllocEx
0x140003038 CreateRemoteThread
0x140003040 RtlLookupFunctionEntry
0x140003048 RtlVirtualUnwind
0x140003050 UnhandledExceptionFilter
0x140003058 GetModuleHandleW
0x140003060 SetUnhandledExceptionFilter
0x140003068 GetCurrentProcess
0x140003070 TerminateProcess
0x140003078 IsProcessorFeaturePresent
0x140003080 QueryPerformanceCounter
0x140003088 GetCurrentProcessId
0x140003090 RtlCaptureContext
0x140003098 GetCurrentThreadId
0x1400030a0 GetSystemTimeAsFileTime
0x1400030a8 IsDebuggerPresent
0x1400030b0 InitializeSListHead
VCRUNTIME140.dll
0x1400030c0 __C_specific_handler
0x1400030c8 __current_exception_context
0x1400030d0 __std_exception_copy
0x1400030d8 __std_exception_destroy
0x1400030e0 _CxxThrowException
0x1400030e8 memset
0x1400030f0 __current_exception
0x1400030f8 memcpy
api-ms-win-crt-runtime-l1-1-0.dll
0x140003150 _register_onexit_function
0x140003158 _crt_atexit
0x140003160 _initialize_onexit_table
0x140003168 _register_thread_local_exe_atexit_callback
0x140003170 _c_exit
0x140003178 __p___argc
0x140003180 exit
0x140003188 _cexit
0x140003190 _initterm_e
0x140003198 _initterm
0x1400031a0 _get_initial_narrow_environment
0x1400031a8 _initialize_narrow_environment
0x1400031b0 _configure_narrow_argv
0x1400031b8 __p___argv
0x1400031c0 _set_app_type
0x1400031c8 _seh_filter_exe
0x1400031d0 _exit
0x1400031d8 terminate
0x1400031e0 _invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0.dll
0x140003208 _wcsicmp
api-ms-win-crt-heap-l1-1-0.dll
0x140003108 _set_new_mode
0x140003110 _callnewh
0x140003118 malloc
0x140003120 free
api-ms-win-crt-math-l1-1-0.dll
0x140003140 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x1400031f0 _set_fmode
0x1400031f8 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x140003130 _configthreadlocale
EAT(Export Address Table) is none