ScreenShot
| Created | 2024.09.25 10:46 | Machine | s1_win7_x6401 |
| Filename | ShellWaitForProcess.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | e80d930390090acbf7353e9df7d1ac84 | ||
| sha256 | 0b271005f1686d1e28579727bfa40cf685bc499bb52118dbdec6de165e68a985 | ||
| ssdeep | 192:4e6EVFiWAfzmgFyqjUlLveahGIsqZOcx8FFassgAV2863Q5tfncJ:4kFQ7mgFyqj0dhGtI3x813l | ||
| imphash | 068999002618fdee51e1fb3f0a517d0d | ||
| impfuzzy | 48:cXotMS1/IQ/TREyLnDsUWYI3NT5+Vn4nEBMLSQMM:cXotMS13NEyLDsUWYI3NTEVn4Oc | ||
Network IP location
Signature (1cnts)
| Level | Description |
|---|---|
| info | This executable has a PDB path |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140003000 Process32First
0x140003008 VirtualAlloc
0x140003010 CreateToolhelp32Snapshot
0x140003018 Sleep
0x140003020 GetLastError
0x140003028 SetEvent
0x140003030 CreateThreadpoolWait
0x140003038 Process32Next
0x140003040 CloseHandle
0x140003048 SetThreadpoolWait
0x140003050 GetConsoleWindow
0x140003058 CreateEventA
0x140003060 RtlLookupFunctionEntry
0x140003068 RtlVirtualUnwind
0x140003070 UnhandledExceptionFilter
0x140003078 SetUnhandledExceptionFilter
0x140003080 GetCurrentProcess
0x140003088 TerminateProcess
0x140003090 IsProcessorFeaturePresent
0x140003098 QueryPerformanceCounter
0x1400030a0 GetCurrentProcessId
0x1400030a8 GetCurrentThreadId
0x1400030b0 GetSystemTimeAsFileTime
0x1400030b8 InitializeSListHead
0x1400030c0 IsDebuggerPresent
0x1400030c8 GetModuleHandleW
0x1400030d0 RtlCaptureContext
USER32.dll
0x140003148 ShowWindow
MSVCP140.dll
0x1400030e0 ?good@ios_base@std@@QEBA_NXZ
0x1400030e8 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
0x1400030f0 ?uncaught_exception@std@@YA_NXZ
0x1400030f8 ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x140003100 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
0x140003108 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
0x140003110 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
0x140003118 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
0x140003120 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
0x140003128 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
0x140003130 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
0x140003138 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
VCRUNTIME140_1.dll
0x140003190 __CxxFrameHandler4
VCRUNTIME140.dll
0x140003158 memset
0x140003160 __std_terminate
0x140003168 __current_exception
0x140003170 __C_specific_handler
0x140003178 __current_exception_context
0x140003180 memcpy
api-ms-win-crt-string-l1-1-0.dll
0x140003280 _stricmp
api-ms-win-crt-runtime-l1-1-0.dll
0x1400031d0 _crt_atexit
0x1400031d8 terminate
0x1400031e0 _c_exit
0x1400031e8 _register_thread_local_exe_atexit_callback
0x1400031f0 _register_onexit_function
0x1400031f8 _seh_filter_exe
0x140003200 _initialize_onexit_table
0x140003208 __p___argv
0x140003210 __p___argc
0x140003218 _set_app_type
0x140003220 _exit
0x140003228 exit
0x140003230 _initterm_e
0x140003238 _initterm
0x140003240 _get_initial_narrow_environment
0x140003248 _initialize_narrow_environment
0x140003250 _configure_narrow_argv
0x140003258 _cexit
api-ms-win-crt-math-l1-1-0.dll
0x1400031c0 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003268 __p__commode
0x140003270 _set_fmode
api-ms-win-crt-locale-l1-1-0.dll
0x1400031b0 _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll
0x1400031a0 _set_new_mode
EAT(Export Address Table) is none
KERNEL32.dll
0x140003000 Process32First
0x140003008 VirtualAlloc
0x140003010 CreateToolhelp32Snapshot
0x140003018 Sleep
0x140003020 GetLastError
0x140003028 SetEvent
0x140003030 CreateThreadpoolWait
0x140003038 Process32Next
0x140003040 CloseHandle
0x140003048 SetThreadpoolWait
0x140003050 GetConsoleWindow
0x140003058 CreateEventA
0x140003060 RtlLookupFunctionEntry
0x140003068 RtlVirtualUnwind
0x140003070 UnhandledExceptionFilter
0x140003078 SetUnhandledExceptionFilter
0x140003080 GetCurrentProcess
0x140003088 TerminateProcess
0x140003090 IsProcessorFeaturePresent
0x140003098 QueryPerformanceCounter
0x1400030a0 GetCurrentProcessId
0x1400030a8 GetCurrentThreadId
0x1400030b0 GetSystemTimeAsFileTime
0x1400030b8 InitializeSListHead
0x1400030c0 IsDebuggerPresent
0x1400030c8 GetModuleHandleW
0x1400030d0 RtlCaptureContext
USER32.dll
0x140003148 ShowWindow
MSVCP140.dll
0x1400030e0 ?good@ios_base@std@@QEBA_NXZ
0x1400030e8 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
0x1400030f0 ?uncaught_exception@std@@YA_NXZ
0x1400030f8 ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x140003100 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
0x140003108 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
0x140003110 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
0x140003118 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
0x140003120 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
0x140003128 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
0x140003130 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
0x140003138 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
VCRUNTIME140_1.dll
0x140003190 __CxxFrameHandler4
VCRUNTIME140.dll
0x140003158 memset
0x140003160 __std_terminate
0x140003168 __current_exception
0x140003170 __C_specific_handler
0x140003178 __current_exception_context
0x140003180 memcpy
api-ms-win-crt-string-l1-1-0.dll
0x140003280 _stricmp
api-ms-win-crt-runtime-l1-1-0.dll
0x1400031d0 _crt_atexit
0x1400031d8 terminate
0x1400031e0 _c_exit
0x1400031e8 _register_thread_local_exe_atexit_callback
0x1400031f0 _register_onexit_function
0x1400031f8 _seh_filter_exe
0x140003200 _initialize_onexit_table
0x140003208 __p___argv
0x140003210 __p___argc
0x140003218 _set_app_type
0x140003220 _exit
0x140003228 exit
0x140003230 _initterm_e
0x140003238 _initterm
0x140003240 _get_initial_narrow_environment
0x140003248 _initialize_narrow_environment
0x140003250 _configure_narrow_argv
0x140003258 _cexit
api-ms-win-crt-math-l1-1-0.dll
0x1400031c0 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003268 __p__commode
0x140003270 _set_fmode
api-ms-win-crt-locale-l1-1-0.dll
0x1400031b0 _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll
0x1400031a0 _set_new_mode
EAT(Export Address Table) is none