ScreenShot
| Created | 2024.10.20 09:42 | Machine | s1_win7_x6403 |
| Filename | main.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 50 detected (AIDetectMalware, Alien, tslR, Malicious, score, Artemis, Unsafe, Save, confidence, 100%, high confidence, Python, TrojanPSW, Empyrean, CLASSIC, AGEN, R002C0XGN24, Static AI, Suspicious PE, Detected, Malware@#3r59rcoqn01o, Disco, Eldorado, Chgt, QQPass, QQRob, Dnhl, susgen) | ||
| md5 | 8292296fd66588cd63632b601dc85981 | ||
| sha256 | 4916fb61bcacb45e64b60299ceb4c9262a81ece270657a171dd29f80e94efafb | ||
| ssdeep | 393216:bqPnLFXlr7oQpDOETgsPWgfGaJgwMrvEk82/Jq:uPLFXNsQoEOWBMQa0 | ||
| imphash | 1e92fd54d65284238a0e3b74b2715062 | ||
| impfuzzy | 48:t/gub6EwoQ54rzSv6xviM3reL9agteS1MEc+pIuCJcgTyOtV0Kq14r:ph97eLjteS1MEc+pIustyiWHS | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 50 AntiVirus engines on VirusTotal as malicious |
| watch | Deletes a large number of files from the system indicative of ransomware |
| notice | Creates executable files on the filesystem |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (19cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Emotet_1_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Emotet_2_Zero | Win32 Trojan Emotet | binaries (download) |
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | ASPack_Zero | ASPack packed file | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | DllRegisterServer_Zero | execute regsvr32.exe | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | zip_file_format | ZIP file format | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
USER32.dll
0x14002a388 CreateWindowExW
0x14002a390 MessageBoxW
0x14002a398 MessageBoxA
0x14002a3a0 SystemParametersInfoW
0x14002a3a8 DestroyIcon
0x14002a3b0 SetWindowLongPtrW
0x14002a3b8 GetWindowLongPtrW
0x14002a3c0 GetClientRect
0x14002a3c8 InvalidateRect
0x14002a3d0 ReleaseDC
0x14002a3d8 GetDC
0x14002a3e0 DrawTextW
0x14002a3e8 GetDialogBaseUnits
0x14002a3f0 EndDialog
0x14002a3f8 DialogBoxIndirectParamW
0x14002a400 MoveWindow
0x14002a408 SendMessageW
COMCTL32.dll
0x14002a028 None
KERNEL32.dll
0x14002a058 IsValidCodePage
0x14002a060 GetStringTypeW
0x14002a068 GetFileAttributesExW
0x14002a070 HeapReAlloc
0x14002a078 FlushFileBuffers
0x14002a080 GetCurrentDirectoryW
0x14002a088 GetACP
0x14002a090 GetOEMCP
0x14002a098 GetModuleHandleW
0x14002a0a0 MulDiv
0x14002a0a8 GetLastError
0x14002a0b0 SetDllDirectoryW
0x14002a0b8 GetModuleFileNameW
0x14002a0c0 GetProcAddress
0x14002a0c8 GetCommandLineW
0x14002a0d0 GetCPInfo
0x14002a0d8 SetEnvironmentVariableW
0x14002a0e0 ExpandEnvironmentStringsW
0x14002a0e8 CreateDirectoryW
0x14002a0f0 GetTempPathW
0x14002a0f8 WaitForSingleObject
0x14002a100 Sleep
0x14002a108 GetExitCodeProcess
0x14002a110 CreateProcessW
0x14002a118 GetStartupInfoW
0x14002a120 FreeLibrary
0x14002a128 LoadLibraryExW
0x14002a130 FindClose
0x14002a138 FindFirstFileExW
0x14002a140 CloseHandle
0x14002a148 GetCurrentProcess
0x14002a150 LocalFree
0x14002a158 FormatMessageW
0x14002a160 MultiByteToWideChar
0x14002a168 WideCharToMultiByte
0x14002a170 GetEnvironmentStringsW
0x14002a178 FreeEnvironmentStringsW
0x14002a180 GetProcessHeap
0x14002a188 GetTimeZoneInformation
0x14002a190 HeapSize
0x14002a198 WriteConsoleW
0x14002a1a0 SetEndOfFile
0x14002a1a8 GetEnvironmentVariableW
0x14002a1b0 RtlCaptureContext
0x14002a1b8 RtlLookupFunctionEntry
0x14002a1c0 RtlVirtualUnwind
0x14002a1c8 UnhandledExceptionFilter
0x14002a1d0 SetUnhandledExceptionFilter
0x14002a1d8 TerminateProcess
0x14002a1e0 IsProcessorFeaturePresent
0x14002a1e8 QueryPerformanceCounter
0x14002a1f0 GetCurrentProcessId
0x14002a1f8 GetCurrentThreadId
0x14002a200 GetSystemTimeAsFileTime
0x14002a208 InitializeSListHead
0x14002a210 IsDebuggerPresent
0x14002a218 RtlUnwindEx
0x14002a220 SetLastError
0x14002a228 EnterCriticalSection
0x14002a230 LeaveCriticalSection
0x14002a238 DeleteCriticalSection
0x14002a240 InitializeCriticalSectionAndSpinCount
0x14002a248 TlsAlloc
0x14002a250 TlsGetValue
0x14002a258 TlsSetValue
0x14002a260 TlsFree
0x14002a268 EncodePointer
0x14002a270 RaiseException
0x14002a278 RtlPcToFileHeader
0x14002a280 GetCommandLineA
0x14002a288 CreateFileW
0x14002a290 GetDriveTypeW
0x14002a298 GetFileInformationByHandle
0x14002a2a0 GetFileType
0x14002a2a8 PeekNamedPipe
0x14002a2b0 SystemTimeToTzSpecificLocalTime
0x14002a2b8 FileTimeToSystemTime
0x14002a2c0 GetFullPathNameW
0x14002a2c8 RemoveDirectoryW
0x14002a2d0 FindNextFileW
0x14002a2d8 SetStdHandle
0x14002a2e0 SetConsoleCtrlHandler
0x14002a2e8 DeleteFileW
0x14002a2f0 ReadFile
0x14002a2f8 GetStdHandle
0x14002a300 WriteFile
0x14002a308 ExitProcess
0x14002a310 GetModuleHandleExW
0x14002a318 HeapFree
0x14002a320 GetConsoleMode
0x14002a328 ReadConsoleW
0x14002a330 SetFilePointerEx
0x14002a338 GetConsoleOutputCP
0x14002a340 GetFileSizeEx
0x14002a348 HeapAlloc
0x14002a350 FlsAlloc
0x14002a358 FlsGetValue
0x14002a360 FlsSetValue
0x14002a368 FlsFree
0x14002a370 CompareStringW
0x14002a378 LCMapStringW
ADVAPI32.dll
0x14002a000 OpenProcessToken
0x14002a008 GetTokenInformation
0x14002a010 ConvertStringSecurityDescriptorToSecurityDescriptorW
0x14002a018 ConvertSidToStringSidW
GDI32.dll
0x14002a038 SelectObject
0x14002a040 DeleteObject
0x14002a048 CreateFontIndirectW
EAT(Export Address Table) is none
USER32.dll
0x14002a388 CreateWindowExW
0x14002a390 MessageBoxW
0x14002a398 MessageBoxA
0x14002a3a0 SystemParametersInfoW
0x14002a3a8 DestroyIcon
0x14002a3b0 SetWindowLongPtrW
0x14002a3b8 GetWindowLongPtrW
0x14002a3c0 GetClientRect
0x14002a3c8 InvalidateRect
0x14002a3d0 ReleaseDC
0x14002a3d8 GetDC
0x14002a3e0 DrawTextW
0x14002a3e8 GetDialogBaseUnits
0x14002a3f0 EndDialog
0x14002a3f8 DialogBoxIndirectParamW
0x14002a400 MoveWindow
0x14002a408 SendMessageW
COMCTL32.dll
0x14002a028 None
KERNEL32.dll
0x14002a058 IsValidCodePage
0x14002a060 GetStringTypeW
0x14002a068 GetFileAttributesExW
0x14002a070 HeapReAlloc
0x14002a078 FlushFileBuffers
0x14002a080 GetCurrentDirectoryW
0x14002a088 GetACP
0x14002a090 GetOEMCP
0x14002a098 GetModuleHandleW
0x14002a0a0 MulDiv
0x14002a0a8 GetLastError
0x14002a0b0 SetDllDirectoryW
0x14002a0b8 GetModuleFileNameW
0x14002a0c0 GetProcAddress
0x14002a0c8 GetCommandLineW
0x14002a0d0 GetCPInfo
0x14002a0d8 SetEnvironmentVariableW
0x14002a0e0 ExpandEnvironmentStringsW
0x14002a0e8 CreateDirectoryW
0x14002a0f0 GetTempPathW
0x14002a0f8 WaitForSingleObject
0x14002a100 Sleep
0x14002a108 GetExitCodeProcess
0x14002a110 CreateProcessW
0x14002a118 GetStartupInfoW
0x14002a120 FreeLibrary
0x14002a128 LoadLibraryExW
0x14002a130 FindClose
0x14002a138 FindFirstFileExW
0x14002a140 CloseHandle
0x14002a148 GetCurrentProcess
0x14002a150 LocalFree
0x14002a158 FormatMessageW
0x14002a160 MultiByteToWideChar
0x14002a168 WideCharToMultiByte
0x14002a170 GetEnvironmentStringsW
0x14002a178 FreeEnvironmentStringsW
0x14002a180 GetProcessHeap
0x14002a188 GetTimeZoneInformation
0x14002a190 HeapSize
0x14002a198 WriteConsoleW
0x14002a1a0 SetEndOfFile
0x14002a1a8 GetEnvironmentVariableW
0x14002a1b0 RtlCaptureContext
0x14002a1b8 RtlLookupFunctionEntry
0x14002a1c0 RtlVirtualUnwind
0x14002a1c8 UnhandledExceptionFilter
0x14002a1d0 SetUnhandledExceptionFilter
0x14002a1d8 TerminateProcess
0x14002a1e0 IsProcessorFeaturePresent
0x14002a1e8 QueryPerformanceCounter
0x14002a1f0 GetCurrentProcessId
0x14002a1f8 GetCurrentThreadId
0x14002a200 GetSystemTimeAsFileTime
0x14002a208 InitializeSListHead
0x14002a210 IsDebuggerPresent
0x14002a218 RtlUnwindEx
0x14002a220 SetLastError
0x14002a228 EnterCriticalSection
0x14002a230 LeaveCriticalSection
0x14002a238 DeleteCriticalSection
0x14002a240 InitializeCriticalSectionAndSpinCount
0x14002a248 TlsAlloc
0x14002a250 TlsGetValue
0x14002a258 TlsSetValue
0x14002a260 TlsFree
0x14002a268 EncodePointer
0x14002a270 RaiseException
0x14002a278 RtlPcToFileHeader
0x14002a280 GetCommandLineA
0x14002a288 CreateFileW
0x14002a290 GetDriveTypeW
0x14002a298 GetFileInformationByHandle
0x14002a2a0 GetFileType
0x14002a2a8 PeekNamedPipe
0x14002a2b0 SystemTimeToTzSpecificLocalTime
0x14002a2b8 FileTimeToSystemTime
0x14002a2c0 GetFullPathNameW
0x14002a2c8 RemoveDirectoryW
0x14002a2d0 FindNextFileW
0x14002a2d8 SetStdHandle
0x14002a2e0 SetConsoleCtrlHandler
0x14002a2e8 DeleteFileW
0x14002a2f0 ReadFile
0x14002a2f8 GetStdHandle
0x14002a300 WriteFile
0x14002a308 ExitProcess
0x14002a310 GetModuleHandleExW
0x14002a318 HeapFree
0x14002a320 GetConsoleMode
0x14002a328 ReadConsoleW
0x14002a330 SetFilePointerEx
0x14002a338 GetConsoleOutputCP
0x14002a340 GetFileSizeEx
0x14002a348 HeapAlloc
0x14002a350 FlsAlloc
0x14002a358 FlsGetValue
0x14002a360 FlsSetValue
0x14002a368 FlsFree
0x14002a370 CompareStringW
0x14002a378 LCMapStringW
ADVAPI32.dll
0x14002a000 OpenProcessToken
0x14002a008 GetTokenInformation
0x14002a010 ConvertStringSecurityDescriptorToSecurityDescriptorW
0x14002a018 ConvertSidToStringSidW
GDI32.dll
0x14002a038 SelectObject
0x14002a040 DeleteObject
0x14002a048 CreateFontIndirectW
EAT(Export Address Table) is none