ScreenShot
| Created | 2024.11.07 14:02 | Machine | s1_win7_x6403 |
| Filename | r.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | |||
| VT API (file) | 55 detected (AIDetectMalware, Phorpiex, Malicious, score, Unsafe, Mint, Zard, confidence, 100%, Attribute, HighConfidence, high confidence, KadrBot, ClipBanker, acoy, ksluau, CLASSIC, Hvnc, caaju, Siggen29, R002C0DJ524, Real Protect, high, Detected, HeurC, KVMH012, Malware@#3cxekyg5gwern, Artemis, BScope, Propriex, SecurityProtection, Gencirc, susgen) | ||
| md5 | 930c41bc0c20865af61a95bcf0c3b289 | ||
| sha256 | 1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff | ||
| ssdeep | 1536:y7zFjdFmav82XA3I9XRH5McIu9Xh0TRvfQaQG9MF7vnn:uRyOPA3MfCwR0toZF7vn | ||
| imphash | 9b21a4a268f5e1d101db096fb67e8aea | ||
| impfuzzy | 96:6Es0fR+KwcPqpxM/lu9X1f6OgnGAUJLHdcpXMomkDq7AKKEc:Ty0s9FwGrLHFomkDq7AVD | ||
Network IP location
Signature (23cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 55 AntiVirus engines on VirusTotal as malicious |
| danger | Disables Windows Security features |
| danger | Stops Windows services |
| watch | Attempts to remove evidence of file being downloaded from the Internet |
| watch | Attempts to stop active services |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Modifies security center warnings |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates hidden or system file |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (11cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PowerShell | PowerShell script | scripts |
Network (16cnts) ?
Suricata ids
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
PE API
IAT(Import Address Table) Library
WS2_32.dll
0x410210 gethostname
0x410214 recvfrom
0x410218 setsockopt
0x41021c ind
0x410220 sendto
0x410224 ioctlsocket
0x410228 WSAStartup
0x41022c shutdown
0x410230 htons
0x410234 socket
0x410238 connect
0x41023c WSAWaitForMultipleEvents
0x410240 listen
0x410244 WSASocketA
0x410248 WSACreateEvent
0x41024c WSAGetOverlappedResult
0x410250 WSAEventSelect
0x410254 WSAEnumNetworkEvents
0x410258 WSAGetLastError
0x41025c WSASend
0x410260 WSARecv
0x410264 WSACloseEvent
0x410268 accept
0x41026c getpeername
0x410270 getsockname
0x410274 inet_addr
0x410278 gethostbyname
0x41027c inet_ntoa
0x410280 closesocket
0x410284 recv
0x410288 send
SHLWAPI.dll
0x41015c StrStrIA
0x410160 StrCmpNW
0x410164 StrStrW
0x410168 PathFileExistsW
0x41016c StrChrA
0x410170 PathFindFileNameW
0x410174 StrCmpNIA
0x410178 PathMatchSpecW
urlmon.dll
0x410308 URLDownloadToFileW
WININET.dll
0x4101d8 InternetOpenW
0x4101dc InternetOpenUrlW
0x4101e0 InternetReadFile
0x4101e4 DeleteUrlCacheEntry
0x4101e8 InternetCloseHandle
0x4101ec HttpSendRequestA
0x4101f0 HttpOpenRequestA
0x4101f4 InternetConnectA
0x4101f8 InternetOpenA
0x4101fc InternetCrackUrlA
0x410200 HttpAddRequestHeadersA
0x410204 HttpQueryInfoA
0x410208 InternetOpenUrlA
ntdll.dll
0x4102a0 strlen
0x4102a4 iswdigit
0x4102a8 iswalpha
0x4102ac memcpy
0x4102b0 memset
0x4102b4 NtQueryVirtualMemory
0x4102b8 RtlUnwind
0x4102bc _chkstk
0x4102c0 _aulldiv
0x4102c4 wcslen
0x4102c8 wcscmp
0x4102cc _allshl
0x4102d0 _aullshr
0x4102d4 strstr
0x4102d8 strcmp
0x4102dc memmove
0x4102e0 memcmp
0x4102e4 RtlTimeToSecondsSince1980
0x4102e8 NtQuerySystemTime
0x4102ec mbstowcs
msvcrt.dll
0x410290 _vscprintf
0x410294 srand
0x410298 rand
KERNEL32.dll
0x410020 GetQueuedCompletionStatus
0x410024 PostQueuedCompletionStatus
0x410028 GetSystemInfo
0x41002c FindClose
0x410030 SetEvent
0x410034 CreateProcessW
0x410038 GetLocaleInfoA
0x41003c DeleteCriticalSection
0x410040 GetCurrentThread
0x410044 GetThreadPriority
0x410048 SetThreadPriority
0x41004c GetCurrentProcess
0x410050 DuplicateHandle
0x410054 IsBadReadPtr
0x410058 InterlockedExchangeAdd
0x41005c InterlockedIncrement
0x410060 WaitForSingleObject
0x410064 InterlockedDecrement
0x410068 InterlockedExchange
0x41006c HeapFree
0x410070 HeapValidate
0x410074 HeapReAlloc
0x410078 GetProcessHeaps
0x41007c HeapCreate
0x410080 HeapSetInformation
0x410084 GetCurrentProcessId
0x410088 HeapAlloc
0x41008c CreateMutexA
0x410090 GetLastError
0x410094 ExitProcess
0x410098 CreateEventA
0x41009c CreateThread
0x4100a0 GetModuleFileNameW
0x4100a4 GetVolumeInformationW
0x4100a8 GetDiskFreeSpaceExW
0x4100ac SetFileAttributesW
0x4100b0 CopyFileW
0x4100b4 lstrcmpiW
0x4100b8 CreateDirectoryW
0x4100bc FindFirstFileW
0x4100c0 lstrcmpW
0x4100c4 MoveFileExW
0x4100c8 FindNextFileW
0x4100cc CreateIoCompletionPort
0x4100d0 RemoveDirectoryW
0x4100d4 ExpandEnvironmentStringsW
0x4100d8 DeleteFileW
0x4100dc GetLogicalDrives
0x4100e0 GetDriveTypeW
0x4100e4 QueryDosDeviceW
0x4100e8 lstrcpyW
0x4100ec WriteFile
0x4100f0 FlushFileBuffers
0x4100f4 EnterCriticalSection
0x4100f8 LeaveCriticalSection
0x4100fc InitializeCriticalSection
0x410100 CreateFileW
0x410104 CreateFileMappingW
0x410108 MapViewOfFile
0x41010c GetFileSize
0x410110 UnmapViewOfFile
0x410114 lstrlenW
0x410118 GlobalUnlock
0x41011c GlobalLock
0x410120 GlobalAlloc
0x410124 lstrlenA
0x410128 lstrcpynW
0x41012c MultiByteToWideChar
0x410130 ExitThread
0x410134 GetTickCount
0x410138 Sleep
0x41013c GetModuleHandleW
0x410140 CloseHandle
USER32.dll
0x410180 RegisterClassExW
0x410184 CreateWindowExW
0x410188 GetMessageA
0x41018c TranslateMessage
0x410190 wsprintfW
0x410194 DefWindowProcA
0x410198 ChangeClipboardChain
0x41019c RegisterRawInputDevices
0x4101a0 GetClipboardData
0x4101a4 DispatchMessageA
0x4101a8 OpenClipboard
0x4101ac EmptyClipboard
0x4101b0 SetClipboardData
0x4101b4 IsClipboardFormatAvailable
0x4101b8 SendMessageA
0x4101bc SetWindowLongW
0x4101c0 SetClipboardViewer
0x4101c4 GetWindowLongW
0x4101c8 wsprintfA
0x4101cc wvsprintfA
0x4101d0 CloseClipboard
ADVAPI32.dll
0x410000 CryptAcquireContextW
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegSetValueExW
0x410010 CryptReleaseContext
0x410014 RegCloseKey
0x410018 CryptGenRandom
SHELL32.dll
0x410154 ShellExecuteW
ole32.dll
0x4102f4 CoInitializeEx
0x4102f8 CoUninitialize
0x4102fc CoInitialize
0x410300 CoCreateInstance
OLEAUT32.dll
0x410148 SysFreeString
0x41014c SysAllocString
EAT(Export Address Table) is none
WS2_32.dll
0x410210 gethostname
0x410214 recvfrom
0x410218 setsockopt
0x41021c ind
0x410220 sendto
0x410224 ioctlsocket
0x410228 WSAStartup
0x41022c shutdown
0x410230 htons
0x410234 socket
0x410238 connect
0x41023c WSAWaitForMultipleEvents
0x410240 listen
0x410244 WSASocketA
0x410248 WSACreateEvent
0x41024c WSAGetOverlappedResult
0x410250 WSAEventSelect
0x410254 WSAEnumNetworkEvents
0x410258 WSAGetLastError
0x41025c WSASend
0x410260 WSARecv
0x410264 WSACloseEvent
0x410268 accept
0x41026c getpeername
0x410270 getsockname
0x410274 inet_addr
0x410278 gethostbyname
0x41027c inet_ntoa
0x410280 closesocket
0x410284 recv
0x410288 send
SHLWAPI.dll
0x41015c StrStrIA
0x410160 StrCmpNW
0x410164 StrStrW
0x410168 PathFileExistsW
0x41016c StrChrA
0x410170 PathFindFileNameW
0x410174 StrCmpNIA
0x410178 PathMatchSpecW
urlmon.dll
0x410308 URLDownloadToFileW
WININET.dll
0x4101d8 InternetOpenW
0x4101dc InternetOpenUrlW
0x4101e0 InternetReadFile
0x4101e4 DeleteUrlCacheEntry
0x4101e8 InternetCloseHandle
0x4101ec HttpSendRequestA
0x4101f0 HttpOpenRequestA
0x4101f4 InternetConnectA
0x4101f8 InternetOpenA
0x4101fc InternetCrackUrlA
0x410200 HttpAddRequestHeadersA
0x410204 HttpQueryInfoA
0x410208 InternetOpenUrlA
ntdll.dll
0x4102a0 strlen
0x4102a4 iswdigit
0x4102a8 iswalpha
0x4102ac memcpy
0x4102b0 memset
0x4102b4 NtQueryVirtualMemory
0x4102b8 RtlUnwind
0x4102bc _chkstk
0x4102c0 _aulldiv
0x4102c4 wcslen
0x4102c8 wcscmp
0x4102cc _allshl
0x4102d0 _aullshr
0x4102d4 strstr
0x4102d8 strcmp
0x4102dc memmove
0x4102e0 memcmp
0x4102e4 RtlTimeToSecondsSince1980
0x4102e8 NtQuerySystemTime
0x4102ec mbstowcs
msvcrt.dll
0x410290 _vscprintf
0x410294 srand
0x410298 rand
KERNEL32.dll
0x410020 GetQueuedCompletionStatus
0x410024 PostQueuedCompletionStatus
0x410028 GetSystemInfo
0x41002c FindClose
0x410030 SetEvent
0x410034 CreateProcessW
0x410038 GetLocaleInfoA
0x41003c DeleteCriticalSection
0x410040 GetCurrentThread
0x410044 GetThreadPriority
0x410048 SetThreadPriority
0x41004c GetCurrentProcess
0x410050 DuplicateHandle
0x410054 IsBadReadPtr
0x410058 InterlockedExchangeAdd
0x41005c InterlockedIncrement
0x410060 WaitForSingleObject
0x410064 InterlockedDecrement
0x410068 InterlockedExchange
0x41006c HeapFree
0x410070 HeapValidate
0x410074 HeapReAlloc
0x410078 GetProcessHeaps
0x41007c HeapCreate
0x410080 HeapSetInformation
0x410084 GetCurrentProcessId
0x410088 HeapAlloc
0x41008c CreateMutexA
0x410090 GetLastError
0x410094 ExitProcess
0x410098 CreateEventA
0x41009c CreateThread
0x4100a0 GetModuleFileNameW
0x4100a4 GetVolumeInformationW
0x4100a8 GetDiskFreeSpaceExW
0x4100ac SetFileAttributesW
0x4100b0 CopyFileW
0x4100b4 lstrcmpiW
0x4100b8 CreateDirectoryW
0x4100bc FindFirstFileW
0x4100c0 lstrcmpW
0x4100c4 MoveFileExW
0x4100c8 FindNextFileW
0x4100cc CreateIoCompletionPort
0x4100d0 RemoveDirectoryW
0x4100d4 ExpandEnvironmentStringsW
0x4100d8 DeleteFileW
0x4100dc GetLogicalDrives
0x4100e0 GetDriveTypeW
0x4100e4 QueryDosDeviceW
0x4100e8 lstrcpyW
0x4100ec WriteFile
0x4100f0 FlushFileBuffers
0x4100f4 EnterCriticalSection
0x4100f8 LeaveCriticalSection
0x4100fc InitializeCriticalSection
0x410100 CreateFileW
0x410104 CreateFileMappingW
0x410108 MapViewOfFile
0x41010c GetFileSize
0x410110 UnmapViewOfFile
0x410114 lstrlenW
0x410118 GlobalUnlock
0x41011c GlobalLock
0x410120 GlobalAlloc
0x410124 lstrlenA
0x410128 lstrcpynW
0x41012c MultiByteToWideChar
0x410130 ExitThread
0x410134 GetTickCount
0x410138 Sleep
0x41013c GetModuleHandleW
0x410140 CloseHandle
USER32.dll
0x410180 RegisterClassExW
0x410184 CreateWindowExW
0x410188 GetMessageA
0x41018c TranslateMessage
0x410190 wsprintfW
0x410194 DefWindowProcA
0x410198 ChangeClipboardChain
0x41019c RegisterRawInputDevices
0x4101a0 GetClipboardData
0x4101a4 DispatchMessageA
0x4101a8 OpenClipboard
0x4101ac EmptyClipboard
0x4101b0 SetClipboardData
0x4101b4 IsClipboardFormatAvailable
0x4101b8 SendMessageA
0x4101bc SetWindowLongW
0x4101c0 SetClipboardViewer
0x4101c4 GetWindowLongW
0x4101c8 wsprintfA
0x4101cc wvsprintfA
0x4101d0 CloseClipboard
ADVAPI32.dll
0x410000 CryptAcquireContextW
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegSetValueExW
0x410010 CryptReleaseContext
0x410014 RegCloseKey
0x410018 CryptGenRandom
SHELL32.dll
0x410154 ShellExecuteW
ole32.dll
0x4102f4 CoInitializeEx
0x4102f8 CoUninitialize
0x4102fc CoInitialize
0x410300 CoCreateInstance
OLEAUT32.dll
0x410148 SysFreeString
0x41014c SysAllocString
EAT(Export Address Table) is none