ScreenShot
| Created | 2024.10.21 17:07 | Machine | s1_win7_x6401 |
| Filename | 11wY50tpm.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 35 detected (AIDetectMalware, Malicious, score, Unsafe, Save, confidence, 100%, Attribute, HighConfidence, high confidence, VMProtect, L suspicious, MalwareX, AGEN, Real Protect, moderate, VMProtBad, Static AI, Malicious PE, Detected, GrayWare, Wacapew, Eldorado, Artemis, susgen, CoinMiner, C9nj) | ||
| md5 | 3b38690db145fd74d4d52bab2ac78074 | ||
| sha256 | 6ba760d9873a0a77cf08fedee79a22656ed88edef185bbfac3418c2992d2dab1 | ||
| ssdeep | 98304:aUsCzX5IW9GHi1UNQ3tNBHiIC1w49rY+4z4qZcfNl2o1l1HiO9Yz6Jy3XR:Rsp2GH+UNQTBQ1Hs4q0YozBimYmsh | ||
| imphash | 18564b1cf3df285f6aada8e4727159f9 | ||
| impfuzzy | 24:a9Qn6E+wSS6oOOJxASgwu5FUBKaQtXJHc9NDI5Q8:8Qn6E7Smb2wzBKnXpcM5Q8 | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 35 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | The executable is likely packed with VMProtect |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | VMProtect_Zero | VMProtect packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140703000 GetFileType
USER32.dll
0x140703010 SetWindowLongA
ADVAPI32.dll
0x140703020 CryptEncrypt
SHELL32.dll
0x140703030 ShellExecuteA
MSVCP140.dll
0x140703040 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
urlmon.dll
0x140703050 URLDownloadToFileA
Normaliz.dll
0x140703060 IdnToAscii
WLDAP32.dll
0x140703070 None
CRYPT32.dll
0x140703080 CertFreeCertificateChain
WS2_32.dll
0x140703090 ntohl
USERENV.dll
0x1407030a0 UnloadUserProfile
VCRUNTIME140.dll
0x1407030b0 __std_exception_destroy
VCRUNTIME140_1.dll
0x1407030c0 __CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll
0x1407030d0 _initterm_e
api-ms-win-crt-heap-l1-1-0.dll
0x1407030e0 calloc
api-ms-win-crt-utility-l1-1-0.dll
0x1407030f0 rand
api-ms-win-crt-stdio-l1-1-0.dll
0x140703100 feof
api-ms-win-crt-convert-l1-1-0.dll
0x140703110 strtoul
api-ms-win-crt-locale-l1-1-0.dll
0x140703120 _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll
0x140703130 _time64
api-ms-win-crt-string-l1-1-0.dll
0x140703140 strncmp
api-ms-win-crt-filesystem-l1-1-0.dll
0x140703150 _unlink
api-ms-win-crt-math-l1-1-0.dll
0x140703160 __setusermatherr
WTSAPI32.dll
0x140703170 WTSSendMessageW
KERNEL32.dll
0x140703180 GetSystemTimeAsFileTime
USER32.dll
0x140703190 GetUserObjectInformationW
KERNEL32.dll
0x1407031a0 LocalAlloc
0x1407031a8 LocalFree
0x1407031b0 GetModuleFileNameW
0x1407031b8 GetProcessAffinityMask
0x1407031c0 SetProcessAffinityMask
0x1407031c8 SetThreadAffinityMask
0x1407031d0 Sleep
0x1407031d8 ExitProcess
0x1407031e0 FreeLibrary
0x1407031e8 LoadLibraryA
0x1407031f0 GetModuleHandleA
0x1407031f8 GetProcAddress
USER32.dll
0x140703208 GetProcessWindowStation
0x140703210 GetUserObjectInformationW
EAT(Export Address Table) Library
KERNEL32.dll
0x140703000 GetFileType
USER32.dll
0x140703010 SetWindowLongA
ADVAPI32.dll
0x140703020 CryptEncrypt
SHELL32.dll
0x140703030 ShellExecuteA
MSVCP140.dll
0x140703040 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
urlmon.dll
0x140703050 URLDownloadToFileA
Normaliz.dll
0x140703060 IdnToAscii
WLDAP32.dll
0x140703070 None
CRYPT32.dll
0x140703080 CertFreeCertificateChain
WS2_32.dll
0x140703090 ntohl
USERENV.dll
0x1407030a0 UnloadUserProfile
VCRUNTIME140.dll
0x1407030b0 __std_exception_destroy
VCRUNTIME140_1.dll
0x1407030c0 __CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll
0x1407030d0 _initterm_e
api-ms-win-crt-heap-l1-1-0.dll
0x1407030e0 calloc
api-ms-win-crt-utility-l1-1-0.dll
0x1407030f0 rand
api-ms-win-crt-stdio-l1-1-0.dll
0x140703100 feof
api-ms-win-crt-convert-l1-1-0.dll
0x140703110 strtoul
api-ms-win-crt-locale-l1-1-0.dll
0x140703120 _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll
0x140703130 _time64
api-ms-win-crt-string-l1-1-0.dll
0x140703140 strncmp
api-ms-win-crt-filesystem-l1-1-0.dll
0x140703150 _unlink
api-ms-win-crt-math-l1-1-0.dll
0x140703160 __setusermatherr
WTSAPI32.dll
0x140703170 WTSSendMessageW
KERNEL32.dll
0x140703180 GetSystemTimeAsFileTime
USER32.dll
0x140703190 GetUserObjectInformationW
KERNEL32.dll
0x1407031a0 LocalAlloc
0x1407031a8 LocalFree
0x1407031b0 GetModuleFileNameW
0x1407031b8 GetProcessAffinityMask
0x1407031c0 SetProcessAffinityMask
0x1407031c8 SetThreadAffinityMask
0x1407031d0 Sleep
0x1407031d8 ExitProcess
0x1407031e0 FreeLibrary
0x1407031e8 LoadLibraryA
0x1407031f0 GetModuleHandleA
0x1407031f8 GetProcAddress
USER32.dll
0x140703208 GetProcessWindowStation
0x140703210 GetUserObjectInformationW
EAT(Export Address Table) Library