ScreenShot
| Created | 2024.10.26 17:21 | Machine | s1_win7_x6401 |
| Filename | sqlite3.dll | ||
| Type | PE32+ executable (DLL) (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 24 detected (Malicious, score, Unsafe, V4yx, GenericKD, Yephiler, CLOUD, high, Wacapew, Artemis, PossibleThreat, PALLAS) | ||
| md5 | 76dae69bfde8cb40d0259f8b3736820c | ||
| sha256 | e8cd3d85840d7eedb28875ea60457f450d3b3c57f0834012f77a9a7fe713e6ad | ||
| ssdeep | 3072:YPBL22Nu6dCcGmBG3AxkEaaW6QlJlMQ6+snerWM5WH:cgBuBG3ck48lJWerWMgH | ||
| imphash | 44cdc801a895c4cbaf14c1dd721f21ad | ||
| impfuzzy | 24:V0DpeKj6V5UfoS1o0qtxKgXBJjUFmgBc+plvO2AMHgjvISOovbO9ZWAA4JCAG6:GroS1YtxKgXemgBc+pwPg3/A4JCAF | ||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 24 AntiVirus engines on VirusTotal as malicious |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsDLL | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x180013000 LoadLibraryA
0x180013008 GetProcAddress
0x180013010 FreeLibrary
0x180013018 Sleep
0x180013020 GetCurrentThread
0x180013028 VirtualFree
0x180013030 SetEvent
0x180013038 WaitForSingleObject
0x180013040 ResetEvent
0x180013048 CreateThread
0x180013050 CloseHandle
0x180013058 CreateFileA
0x180013060 GetFileSize
0x180013068 ReadFile
0x180013070 GetLastError
0x180013078 CreateEventW
0x180013080 AddVectoredExceptionHandler
0x180013088 GetModuleFileNameA
0x180013090 GetModuleHandleW
0x180013098 WriteConsoleW
0x1800130a0 HeapReAlloc
0x1800130a8 HeapSize
0x1800130b0 GetStringTypeW
0x1800130b8 FlushFileBuffers
0x1800130c0 SetStdHandle
0x1800130c8 QueryPerformanceCounter
0x1800130d0 GetCurrentProcessId
0x1800130d8 GetCurrentThreadId
0x1800130e0 GetSystemTimeAsFileTime
0x1800130e8 InitializeSListHead
0x1800130f0 RtlCaptureContext
0x1800130f8 RtlLookupFunctionEntry
0x180013100 RtlVirtualUnwind
0x180013108 IsDebuggerPresent
0x180013110 UnhandledExceptionFilter
0x180013118 SetUnhandledExceptionFilter
0x180013120 GetStartupInfoW
0x180013128 IsProcessorFeaturePresent
0x180013130 VirtualProtect
0x180013138 GetCurrentProcess
0x180013140 VirtualAlloc
0x180013148 SuspendThread
0x180013150 ResumeThread
0x180013158 VirtualProtectEx
0x180013160 GetThreadContext
0x180013168 FlushInstructionCache
0x180013170 SetThreadContext
0x180013178 VirtualQuery
0x180013180 VirtualQueryEx
0x180013188 SetLastError
0x180013190 LoadLibraryExA
0x180013198 LoadLibraryExW
0x1800131a0 RtlUnwindEx
0x1800131a8 InterlockedFlushSList
0x1800131b0 RtlPcToFileHeader
0x1800131b8 RaiseException
0x1800131c0 EnterCriticalSection
0x1800131c8 LeaveCriticalSection
0x1800131d0 DeleteCriticalSection
0x1800131d8 InitializeCriticalSectionAndSpinCount
0x1800131e0 TlsAlloc
0x1800131e8 TlsGetValue
0x1800131f0 TlsSetValue
0x1800131f8 TlsFree
0x180013200 EncodePointer
0x180013208 ExitProcess
0x180013210 TerminateProcess
0x180013218 GetModuleHandleExW
0x180013220 GetModuleFileNameW
0x180013228 GetConsoleMode
0x180013230 WriteFile
0x180013238 GetConsoleOutputCP
0x180013240 SetFilePointerEx
0x180013248 HeapFree
0x180013250 GetStdHandle
0x180013258 GetFileType
0x180013260 HeapAlloc
0x180013268 FindClose
0x180013270 FindFirstFileExW
0x180013278 FindNextFileW
0x180013280 IsValidCodePage
0x180013288 GetACP
0x180013290 GetOEMCP
0x180013298 GetCPInfo
0x1800132a0 GetCommandLineA
0x1800132a8 GetCommandLineW
0x1800132b0 MultiByteToWideChar
0x1800132b8 WideCharToMultiByte
0x1800132c0 GetEnvironmentStringsW
0x1800132c8 FreeEnvironmentStringsW
0x1800132d0 FlsAlloc
0x1800132d8 FlsGetValue
0x1800132e0 FlsSetValue
0x1800132e8 FlsFree
0x1800132f0 LCMapStringW
0x1800132f8 GetProcessHeap
0x180013300 CreateFileW
USER32.dll
0x180013328 PeekMessageW
0x180013330 DispatchMessageW
0x180013338 TranslateMessage
SHLWAPI.dll
0x180013310 PathRemoveFileSpecA
0x180013318 PathAppendA
EAT(Export Address Table) Library
0x1800027c0 HTMLayoutCallBehaviorMethod
0x1800027c0 HTMLayoutCreateElement
0x1800027c0 HTMLayoutDataReady
0x1800027c0 HTMLayoutGetAttributeByName
0x1800027c0 HTMLayoutGetChildrenCount
0x1800027c0 HTMLayoutGetElementHwnd
0x1800027c0 HTMLayoutGetElementIndex
0x1800027c0 HTMLayoutGetElementInnerTextCB
0x1800027c0 HTMLayoutGetElementLocation
0x1800027c0 HTMLayoutGetElementState
0x1800027c0 HTMLayoutGetNthChild
0x1800027c0 HTMLayoutGetParentElement
0x1800027c0 HTMLayoutGetRootElement
0x1800027c0 HTMLayoutGetStyleAttribute
0x1800027c0 HTMLayoutInsertElement
0x1800027c0 HTMLayoutLoadFile
0x1800027c0 HTMLayoutLoadHtmlEx
0x1800027c0 HTMLayoutPostEvent
0x1800027c0 HTMLayoutProcND
0x1800027c0 HTMLayoutScrollToView
0x1800027c0 HTMLayoutSelectElements
0x1800027c0 HTMLayoutSelectElementsW
0x1800027c0 HTMLayoutSendEvent
0x1800027c0 HTMLayoutSetAttributeByName
0x1800027c0 HTMLayoutSetCallback
0x1800027c0 HTMLayoutSetElementHtml
0x1800027c0 HTMLayoutSetElementInnerText16
0x1800027c0 HTMLayoutSetElementState
0x1800027c0 HTMLayoutSetOption
0x1800027c0 HTMLayoutSetStyleAttribute
0x1800027c0 HTMLayoutSetupDebugOutput
0x1800027c0 HTMLayoutUpdateElement
0x1800027c0 HTMLayoutUpdateElementEx
0x1800027c0 HTMLayoutUpdateWindow
0x1800027c0 HTMLayoutVisitElements
0x1800027c0 HTMLayoutWindowAttachEventHandler
0x1800027c0 HTMLayoutWindowDetachEventHandler
0x1800027c0 HTMLayout_UnuseElement
0x1800027c0 HTMLayout_UseElement
0x1800027c0 sqlite3_close
0x1800027c0 sqlite3_column_text
0x1800027c0 sqlite3_open16
0x1800027c0 sqlite3_prepare_v2
0x1800027c0 sqlite3_step
KERNEL32.dll
0x180013000 LoadLibraryA
0x180013008 GetProcAddress
0x180013010 FreeLibrary
0x180013018 Sleep
0x180013020 GetCurrentThread
0x180013028 VirtualFree
0x180013030 SetEvent
0x180013038 WaitForSingleObject
0x180013040 ResetEvent
0x180013048 CreateThread
0x180013050 CloseHandle
0x180013058 CreateFileA
0x180013060 GetFileSize
0x180013068 ReadFile
0x180013070 GetLastError
0x180013078 CreateEventW
0x180013080 AddVectoredExceptionHandler
0x180013088 GetModuleFileNameA
0x180013090 GetModuleHandleW
0x180013098 WriteConsoleW
0x1800130a0 HeapReAlloc
0x1800130a8 HeapSize
0x1800130b0 GetStringTypeW
0x1800130b8 FlushFileBuffers
0x1800130c0 SetStdHandle
0x1800130c8 QueryPerformanceCounter
0x1800130d0 GetCurrentProcessId
0x1800130d8 GetCurrentThreadId
0x1800130e0 GetSystemTimeAsFileTime
0x1800130e8 InitializeSListHead
0x1800130f0 RtlCaptureContext
0x1800130f8 RtlLookupFunctionEntry
0x180013100 RtlVirtualUnwind
0x180013108 IsDebuggerPresent
0x180013110 UnhandledExceptionFilter
0x180013118 SetUnhandledExceptionFilter
0x180013120 GetStartupInfoW
0x180013128 IsProcessorFeaturePresent
0x180013130 VirtualProtect
0x180013138 GetCurrentProcess
0x180013140 VirtualAlloc
0x180013148 SuspendThread
0x180013150 ResumeThread
0x180013158 VirtualProtectEx
0x180013160 GetThreadContext
0x180013168 FlushInstructionCache
0x180013170 SetThreadContext
0x180013178 VirtualQuery
0x180013180 VirtualQueryEx
0x180013188 SetLastError
0x180013190 LoadLibraryExA
0x180013198 LoadLibraryExW
0x1800131a0 RtlUnwindEx
0x1800131a8 InterlockedFlushSList
0x1800131b0 RtlPcToFileHeader
0x1800131b8 RaiseException
0x1800131c0 EnterCriticalSection
0x1800131c8 LeaveCriticalSection
0x1800131d0 DeleteCriticalSection
0x1800131d8 InitializeCriticalSectionAndSpinCount
0x1800131e0 TlsAlloc
0x1800131e8 TlsGetValue
0x1800131f0 TlsSetValue
0x1800131f8 TlsFree
0x180013200 EncodePointer
0x180013208 ExitProcess
0x180013210 TerminateProcess
0x180013218 GetModuleHandleExW
0x180013220 GetModuleFileNameW
0x180013228 GetConsoleMode
0x180013230 WriteFile
0x180013238 GetConsoleOutputCP
0x180013240 SetFilePointerEx
0x180013248 HeapFree
0x180013250 GetStdHandle
0x180013258 GetFileType
0x180013260 HeapAlloc
0x180013268 FindClose
0x180013270 FindFirstFileExW
0x180013278 FindNextFileW
0x180013280 IsValidCodePage
0x180013288 GetACP
0x180013290 GetOEMCP
0x180013298 GetCPInfo
0x1800132a0 GetCommandLineA
0x1800132a8 GetCommandLineW
0x1800132b0 MultiByteToWideChar
0x1800132b8 WideCharToMultiByte
0x1800132c0 GetEnvironmentStringsW
0x1800132c8 FreeEnvironmentStringsW
0x1800132d0 FlsAlloc
0x1800132d8 FlsGetValue
0x1800132e0 FlsSetValue
0x1800132e8 FlsFree
0x1800132f0 LCMapStringW
0x1800132f8 GetProcessHeap
0x180013300 CreateFileW
USER32.dll
0x180013328 PeekMessageW
0x180013330 DispatchMessageW
0x180013338 TranslateMessage
SHLWAPI.dll
0x180013310 PathRemoveFileSpecA
0x180013318 PathAppendA
EAT(Export Address Table) Library
0x1800027c0 HTMLayoutCallBehaviorMethod
0x1800027c0 HTMLayoutCreateElement
0x1800027c0 HTMLayoutDataReady
0x1800027c0 HTMLayoutGetAttributeByName
0x1800027c0 HTMLayoutGetChildrenCount
0x1800027c0 HTMLayoutGetElementHwnd
0x1800027c0 HTMLayoutGetElementIndex
0x1800027c0 HTMLayoutGetElementInnerTextCB
0x1800027c0 HTMLayoutGetElementLocation
0x1800027c0 HTMLayoutGetElementState
0x1800027c0 HTMLayoutGetNthChild
0x1800027c0 HTMLayoutGetParentElement
0x1800027c0 HTMLayoutGetRootElement
0x1800027c0 HTMLayoutGetStyleAttribute
0x1800027c0 HTMLayoutInsertElement
0x1800027c0 HTMLayoutLoadFile
0x1800027c0 HTMLayoutLoadHtmlEx
0x1800027c0 HTMLayoutPostEvent
0x1800027c0 HTMLayoutProcND
0x1800027c0 HTMLayoutScrollToView
0x1800027c0 HTMLayoutSelectElements
0x1800027c0 HTMLayoutSelectElementsW
0x1800027c0 HTMLayoutSendEvent
0x1800027c0 HTMLayoutSetAttributeByName
0x1800027c0 HTMLayoutSetCallback
0x1800027c0 HTMLayoutSetElementHtml
0x1800027c0 HTMLayoutSetElementInnerText16
0x1800027c0 HTMLayoutSetElementState
0x1800027c0 HTMLayoutSetOption
0x1800027c0 HTMLayoutSetStyleAttribute
0x1800027c0 HTMLayoutSetupDebugOutput
0x1800027c0 HTMLayoutUpdateElement
0x1800027c0 HTMLayoutUpdateElementEx
0x1800027c0 HTMLayoutUpdateWindow
0x1800027c0 HTMLayoutVisitElements
0x1800027c0 HTMLayoutWindowAttachEventHandler
0x1800027c0 HTMLayoutWindowDetachEventHandler
0x1800027c0 HTMLayout_UnuseElement
0x1800027c0 HTMLayout_UseElement
0x1800027c0 sqlite3_close
0x1800027c0 sqlite3_column_text
0x1800027c0 sqlite3_open16
0x1800027c0 sqlite3_prepare_v2
0x1800027c0 sqlite3_step