ScreenShot
| Created | 2024.10.24 10:00 | Machine | s1_win7_x6403 |
| Filename | k4q.exe | ||
| Type | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 39 detected (AIDetectMalware, Dump, Malicious, score, Tango, Marte, Unsafe, Hacktool, Sliver, Vr0c, confidence, 100%, Attribute, HighConfidence, a variant of WinGo, MalwareX, MalGO, CLASSIC, AGEN, Static AI, Malicious PE, Detected, SuspGolang, R588019, WinGo, Shellcoderunner, Xwhl, susgen) | ||
| md5 | 30871d0e0185fcffd2d9452ffdd456f6 | ||
| sha256 | 579b87f1aee0d4dcddb5d3cc69ab2eb61af07a9f41da8a1a5c12453c219f85ba | ||
| ssdeep | 98304:oV5mfT7ZBbST4IzqTur8eXWuQrad5yd/ZBC6Ep/EqMLEIJMY:oV5mxBb3TreXWO5yd/ZBCTpcRb | ||
| imphash | f0ea7b7844bbc5bfa9bb32efdcea957c | ||
| impfuzzy | 24:UbVjh9wO+VuT2oLtXOr6kwmDruMztxdEr6tP:GwO+VAXOmGx0oP | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 39 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| watch | Detects the presence of Wine emulator |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
kernel32.dll
0x15fa040 WriteFile
0x15fa048 WriteConsoleW
0x15fa050 WaitForMultipleObjects
0x15fa058 WaitForSingleObject
0x15fa060 VirtualQuery
0x15fa068 VirtualFree
0x15fa070 VirtualAlloc
0x15fa078 TlsAlloc
0x15fa080 SwitchToThread
0x15fa088 SuspendThread
0x15fa090 SetWaitableTimer
0x15fa098 SetUnhandledExceptionFilter
0x15fa0a0 SetProcessPriorityBoost
0x15fa0a8 SetEvent
0x15fa0b0 SetErrorMode
0x15fa0b8 SetConsoleCtrlHandler
0x15fa0c0 ResumeThread
0x15fa0c8 PostQueuedCompletionStatus
0x15fa0d0 LoadLibraryA
0x15fa0d8 LoadLibraryW
0x15fa0e0 SetThreadContext
0x15fa0e8 GetThreadContext
0x15fa0f0 GetSystemInfo
0x15fa0f8 GetSystemDirectoryA
0x15fa100 GetStdHandle
0x15fa108 GetQueuedCompletionStatusEx
0x15fa110 GetProcessAffinityMask
0x15fa118 GetProcAddress
0x15fa120 GetEnvironmentStringsW
0x15fa128 GetConsoleMode
0x15fa130 FreeEnvironmentStringsW
0x15fa138 ExitProcess
0x15fa140 DuplicateHandle
0x15fa148 CreateWaitableTimerExW
0x15fa150 CreateThread
0x15fa158 CreateIoCompletionPort
0x15fa160 CreateFileA
0x15fa168 CreateEventA
0x15fa170 CloseHandle
0x15fa178 AddVectoredExceptionHandler
EAT(Export Address Table) is none
kernel32.dll
0x15fa040 WriteFile
0x15fa048 WriteConsoleW
0x15fa050 WaitForMultipleObjects
0x15fa058 WaitForSingleObject
0x15fa060 VirtualQuery
0x15fa068 VirtualFree
0x15fa070 VirtualAlloc
0x15fa078 TlsAlloc
0x15fa080 SwitchToThread
0x15fa088 SuspendThread
0x15fa090 SetWaitableTimer
0x15fa098 SetUnhandledExceptionFilter
0x15fa0a0 SetProcessPriorityBoost
0x15fa0a8 SetEvent
0x15fa0b0 SetErrorMode
0x15fa0b8 SetConsoleCtrlHandler
0x15fa0c0 ResumeThread
0x15fa0c8 PostQueuedCompletionStatus
0x15fa0d0 LoadLibraryA
0x15fa0d8 LoadLibraryW
0x15fa0e0 SetThreadContext
0x15fa0e8 GetThreadContext
0x15fa0f0 GetSystemInfo
0x15fa0f8 GetSystemDirectoryA
0x15fa100 GetStdHandle
0x15fa108 GetQueuedCompletionStatusEx
0x15fa110 GetProcessAffinityMask
0x15fa118 GetProcAddress
0x15fa120 GetEnvironmentStringsW
0x15fa128 GetConsoleMode
0x15fa130 FreeEnvironmentStringsW
0x15fa138 ExitProcess
0x15fa140 DuplicateHandle
0x15fa148 CreateWaitableTimerExW
0x15fa150 CreateThread
0x15fa158 CreateIoCompletionPort
0x15fa160 CreateFileA
0x15fa168 CreateEventA
0x15fa170 CloseHandle
0x15fa178 AddVectoredExceptionHandler
EAT(Export Address Table) is none