ScreenShot
| Created | 2024.10.31 18:06 | Machine | s1_win7_x6403 |
| Filename | Loader_seyhhd.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 37 detected (AIDetectMalware, Malicious, score, Unsafe, confidence, 100%, Attribute, HighConfidence, high confidence, VMProtect, X suspicious, FileRepMalware, Misc, Kryptik@AI, RDML, 5Hzb6, cRZOzEO1lS5Kgb+g, AMADEY, YXEJ5Z, Real Protect, Generic Reputation PUA, Static AI, Malicious PE, Detected, GrayWare, Wacapew, Wacatac, CO1GXX, Artemis, Outbreak, susgen, PossibleThreat, PALLAS) | ||
| md5 | d51eb63974474a6e7547c8f3ee8f5c93 | ||
| sha256 | cbb2935e499f3c88e862bdd46f5710774b232aa9ba85cc30006236a6f4503db2 | ||
| ssdeep | 49152:gOWEd7uyb66vtNOeRohANG6POCJ3xBaInIl3dOGKpW8tchWqVAMbv+:LWEJhbBRovCJ3xB1nhWdhWqVxq | ||
| imphash | 47231b93d5639b1098929652588829ab | ||
| impfuzzy | 12:fGpuNVuf4+e7SV2Q4W2VW5KcPaaK2BbmI2uD1FFTOZGqAJcDW:4Iz+ySV5yWvPaz2Bb+u5FpadNDW | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 37 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Network_Downloader | File Downloader | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140210000 LocalFree
ADVAPI32.dll
0x140210010 RegSetKeySecurity
SHELL32.dll
0x140210020 ShellExecuteExW
MSVCP140.dll
0x140210030 ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
urlmon.dll
0x140210040 URLDownloadToFileW
d3d9.dll
0x140210050 Direct3DCreate9
VCRUNTIME140_1.dll
0x140210060 __CxxFrameHandler4
VCRUNTIME140.dll
0x140210070 __current_exception_context
api-ms-win-crt-stdio-l1-1-0.dll
0x140210080 ungetc
api-ms-win-crt-filesystem-l1-1-0.dll
0x140210090 _lock_file
api-ms-win-crt-runtime-l1-1-0.dll
0x1402100a0 _exit
api-ms-win-crt-heap-l1-1-0.dll
0x1402100b0 _callnewh
api-ms-win-crt-math-l1-1-0.dll
0x1402100c0 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x1402100d0 _configthreadlocale
KERNEL32.dll
0x1402100e0 GetSystemTimeAsFileTime
KERNEL32.dll
0x1402100f0 HeapAlloc
0x1402100f8 HeapFree
0x140210100 ExitProcess
0x140210108 LoadLibraryA
0x140210110 GetModuleHandleA
0x140210118 GetProcAddress
EAT(Export Address Table) is none
KERNEL32.dll
0x140210000 LocalFree
ADVAPI32.dll
0x140210010 RegSetKeySecurity
SHELL32.dll
0x140210020 ShellExecuteExW
MSVCP140.dll
0x140210030 ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
urlmon.dll
0x140210040 URLDownloadToFileW
d3d9.dll
0x140210050 Direct3DCreate9
VCRUNTIME140_1.dll
0x140210060 __CxxFrameHandler4
VCRUNTIME140.dll
0x140210070 __current_exception_context
api-ms-win-crt-stdio-l1-1-0.dll
0x140210080 ungetc
api-ms-win-crt-filesystem-l1-1-0.dll
0x140210090 _lock_file
api-ms-win-crt-runtime-l1-1-0.dll
0x1402100a0 _exit
api-ms-win-crt-heap-l1-1-0.dll
0x1402100b0 _callnewh
api-ms-win-crt-math-l1-1-0.dll
0x1402100c0 __setusermatherr
api-ms-win-crt-locale-l1-1-0.dll
0x1402100d0 _configthreadlocale
KERNEL32.dll
0x1402100e0 GetSystemTimeAsFileTime
KERNEL32.dll
0x1402100f0 HeapAlloc
0x1402100f8 HeapFree
0x140210100 ExitProcess
0x140210108 LoadLibraryA
0x140210110 GetModuleHandleA
0x140210118 GetProcAddress
EAT(Export Address Table) is none