ScreenShot
| Created | 2024.11.07 14:02 | Machine | s1_win7_x6403 |
| Filename | 1.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | |||
| VT API (file) | 59 detected (Common, Phorpiex, Malicious, score, Unsafe, Mint, Zard, confidence, 100%, Genus, Attribute, HighConfidence, high confidence, KadrBot, kscpaq, CLASSIC, AGEN, DownLoader46, R002C0DIL24, Real Protect, high, Trizt, Static AI, Malicious PE, Detected, Malware@#3h52gx6ozor0i, Tiny, ABRisk, TMYQ, Artemis, Propriex, SecurityProtection, Gencirc, yUvWDXAgyzU, susgen) | ||
| md5 | a775d164cf76e9a9ff6afd7eb1e3ab2e | ||
| sha256 | 794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979 | ||
| ssdeep | 1536:5Ei+lO/FmavM28kR1hDzc3zcq1ZI9PiDQIyQaQG9JXVfKo:WTlROxNs3zLjI4t3UXVfKo | ||
| imphash | 72db0c0dfd8f33f8e37f43333e8c1643 | ||
| impfuzzy | 96:Fs0acR+KycPqpxM/tu9X1f6OgnGrPJLHdcpCRomkDK7k1qKdI:Vy0U9FwGVLHDomkDK741a | ||
Network IP location
Signature (24cnts)
| Level | Description |
|---|---|
| danger | Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) |
| danger | File has been identified by 59 AntiVirus engines on VirusTotal as malicious |
| danger | Disables Windows Security features |
| danger | Stops Windows services |
| watch | Attempts to disable Windows Auto Updates |
| watch | Attempts to remove evidence of file being downloaded from the Internet |
| watch | Attempts to stop active services |
| watch | Communicates with host for which no DNS query was performed |
| watch | Installs itself for autorun at Windows startup |
| watch | Modifies security center warnings |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol |
| notice | Creates a shortcut to an executable file |
| notice | Creates a suspicious process |
| notice | Creates hidden or system file |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (12cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | PowerShell | PowerShell script | scripts |
Network (16cnts) ?
Suricata ids
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
PE API
IAT(Import Address Table) Library
WS2_32.dll
0x41021c gethostname
0x410220 recvfrom
0x410224 setsockopt
0x410228 closesocket
0x41022c htons
0x410230 shutdown
0x410234 WSAStartup
0x410238 connect
0x41023c WSAWaitForMultipleEvents
0x410240 listen
0x410244 WSASocketA
0x410248 WSACreateEvent
0x41024c WSAGetOverlappedResult
0x410250 WSAEventSelect
0x410254 WSAEnumNetworkEvents
0x410258 WSAGetLastError
0x41025c WSASend
0x410260 WSARecv
0x410264 WSACloseEvent
0x410268 accept
0x41026c getpeername
0x410270 getsockname
0x410274 inet_addr
0x410278 gethostbyname
0x41027c inet_ntoa
0x410280 socket
0x410284 ind
0x410288 sendto
0x41028c ioctlsocket
0x410290 recv
0x410294 send
SHLWAPI.dll
0x410168 StrStrIA
0x41016c StrCmpNW
0x410170 StrStrW
0x410174 PathFileExistsW
0x410178 StrChrA
0x41017c PathFindFileNameW
0x410180 StrCmpNIA
0x410184 PathMatchSpecW
urlmon.dll
0x410314 URLDownloadToFileW
WININET.dll
0x4101e4 InternetOpenW
0x4101e8 InternetOpenUrlW
0x4101ec DeleteUrlCacheEntry
0x4101f0 InternetCloseHandle
0x4101f4 InternetReadFile
0x4101f8 HttpSendRequestA
0x4101fc HttpOpenRequestA
0x410200 InternetConnectA
0x410204 InternetOpenA
0x410208 InternetCrackUrlA
0x41020c HttpAddRequestHeadersA
0x410210 HttpQueryInfoA
0x410214 InternetOpenUrlA
ntdll.dll
0x4102ac strlen
0x4102b0 iswdigit
0x4102b4 iswalpha
0x4102b8 memcpy
0x4102bc memset
0x4102c0 NtQueryVirtualMemory
0x4102c4 RtlUnwind
0x4102c8 _chkstk
0x4102cc _aulldiv
0x4102d0 wcslen
0x4102d4 wcscmp
0x4102d8 _allshl
0x4102dc _aullshr
0x4102e0 strstr
0x4102e4 strcmp
0x4102e8 memmove
0x4102ec memcmp
0x4102f0 RtlTimeToSecondsSince1980
0x4102f4 NtQuerySystemTime
0x4102f8 mbstowcs
msvcrt.dll
0x41029c _vscprintf
0x4102a0 srand
0x4102a4 rand
KERNEL32.dll
0x41002c GetQueuedCompletionStatus
0x410030 PostQueuedCompletionStatus
0x410034 GetSystemInfo
0x410038 FindNextFileW
0x41003c SetEvent
0x410040 CreateProcessW
0x410044 GetLocaleInfoA
0x410048 DeleteCriticalSection
0x41004c GetCurrentThread
0x410050 GetThreadPriority
0x410054 SetThreadPriority
0x410058 GetCurrentProcess
0x41005c DuplicateHandle
0x410060 IsBadReadPtr
0x410064 InterlockedExchangeAdd
0x410068 InterlockedIncrement
0x41006c WaitForSingleObject
0x410070 InterlockedDecrement
0x410074 InterlockedExchange
0x410078 HeapFree
0x41007c HeapValidate
0x410080 HeapReAlloc
0x410084 GetProcessHeaps
0x410088 HeapCreate
0x41008c HeapSetInformation
0x410090 GetCurrentProcessId
0x410094 HeapAlloc
0x410098 CreateMutexA
0x41009c GetLastError
0x4100a0 ExitProcess
0x4100a4 CreateEventA
0x4100a8 CreateThread
0x4100ac GetModuleFileNameW
0x4100b0 GetVolumeInformationW
0x4100b4 GetDiskFreeSpaceExW
0x4100b8 SetFileAttributesW
0x4100bc CopyFileW
0x4100c0 lstrcmpiW
0x4100c4 CreateDirectoryW
0x4100c8 FindFirstFileW
0x4100cc lstrcmpW
0x4100d0 MoveFileExW
0x4100d4 CreateIoCompletionPort
0x4100d8 FindClose
0x4100dc RemoveDirectoryW
0x4100e0 ExpandEnvironmentStringsW
0x4100e4 DeleteFileW
0x4100e8 GetLogicalDrives
0x4100ec GetDriveTypeW
0x4100f0 QueryDosDeviceW
0x4100f4 lstrcpyW
0x4100f8 WriteFile
0x4100fc FlushFileBuffers
0x410100 EnterCriticalSection
0x410104 LeaveCriticalSection
0x410108 InitializeCriticalSection
0x41010c CreateFileW
0x410110 CreateFileMappingW
0x410114 GlobalUnlock
0x410118 GlobalLock
0x41011c GlobalAlloc
0x410120 lstrlenA
0x410124 lstrlenW
0x410128 lstrcpynW
0x41012c MultiByteToWideChar
0x410130 ExitThread
0x410134 GetTickCount
0x410138 Sleep
0x41013c GetModuleHandleW
0x410140 CloseHandle
0x410144 UnmapViewOfFile
0x410148 GetFileSize
0x41014c MapViewOfFile
USER32.dll
0x41018c RegisterClassExW
0x410190 CreateWindowExW
0x410194 GetMessageA
0x410198 TranslateMessage
0x41019c wsprintfW
0x4101a0 DefWindowProcA
0x4101a4 ChangeClipboardChain
0x4101a8 RegisterRawInputDevices
0x4101ac GetClipboardData
0x4101b0 DispatchMessageA
0x4101b4 EmptyClipboard
0x4101b8 SetClipboardData
0x4101bc CloseClipboard
0x4101c0 IsClipboardFormatAvailable
0x4101c4 SendMessageA
0x4101c8 SetWindowLongW
0x4101cc SetClipboardViewer
0x4101d0 GetWindowLongW
0x4101d4 wsprintfA
0x4101d8 wvsprintfA
0x4101dc OpenClipboard
ADVAPI32.dll
0x410000 CryptReleaseContext
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegOpenKeyExA
0x410010 RegCreateKeyExW
0x410014 CryptAcquireContextW
0x410018 CryptGenRandom
0x41001c RegCloseKey
0x410020 RegSetValueExW
0x410024 RegSetValueExA
SHELL32.dll
0x410160 ShellExecuteW
ole32.dll
0x410300 CoInitializeEx
0x410304 CoUninitialize
0x410308 CoInitialize
0x41030c CoCreateInstance
OLEAUT32.dll
0x410154 SysFreeString
0x410158 SysAllocString
EAT(Export Address Table) is none
WS2_32.dll
0x41021c gethostname
0x410220 recvfrom
0x410224 setsockopt
0x410228 closesocket
0x41022c htons
0x410230 shutdown
0x410234 WSAStartup
0x410238 connect
0x41023c WSAWaitForMultipleEvents
0x410240 listen
0x410244 WSASocketA
0x410248 WSACreateEvent
0x41024c WSAGetOverlappedResult
0x410250 WSAEventSelect
0x410254 WSAEnumNetworkEvents
0x410258 WSAGetLastError
0x41025c WSASend
0x410260 WSARecv
0x410264 WSACloseEvent
0x410268 accept
0x41026c getpeername
0x410270 getsockname
0x410274 inet_addr
0x410278 gethostbyname
0x41027c inet_ntoa
0x410280 socket
0x410284 ind
0x410288 sendto
0x41028c ioctlsocket
0x410290 recv
0x410294 send
SHLWAPI.dll
0x410168 StrStrIA
0x41016c StrCmpNW
0x410170 StrStrW
0x410174 PathFileExistsW
0x410178 StrChrA
0x41017c PathFindFileNameW
0x410180 StrCmpNIA
0x410184 PathMatchSpecW
urlmon.dll
0x410314 URLDownloadToFileW
WININET.dll
0x4101e4 InternetOpenW
0x4101e8 InternetOpenUrlW
0x4101ec DeleteUrlCacheEntry
0x4101f0 InternetCloseHandle
0x4101f4 InternetReadFile
0x4101f8 HttpSendRequestA
0x4101fc HttpOpenRequestA
0x410200 InternetConnectA
0x410204 InternetOpenA
0x410208 InternetCrackUrlA
0x41020c HttpAddRequestHeadersA
0x410210 HttpQueryInfoA
0x410214 InternetOpenUrlA
ntdll.dll
0x4102ac strlen
0x4102b0 iswdigit
0x4102b4 iswalpha
0x4102b8 memcpy
0x4102bc memset
0x4102c0 NtQueryVirtualMemory
0x4102c4 RtlUnwind
0x4102c8 _chkstk
0x4102cc _aulldiv
0x4102d0 wcslen
0x4102d4 wcscmp
0x4102d8 _allshl
0x4102dc _aullshr
0x4102e0 strstr
0x4102e4 strcmp
0x4102e8 memmove
0x4102ec memcmp
0x4102f0 RtlTimeToSecondsSince1980
0x4102f4 NtQuerySystemTime
0x4102f8 mbstowcs
msvcrt.dll
0x41029c _vscprintf
0x4102a0 srand
0x4102a4 rand
KERNEL32.dll
0x41002c GetQueuedCompletionStatus
0x410030 PostQueuedCompletionStatus
0x410034 GetSystemInfo
0x410038 FindNextFileW
0x41003c SetEvent
0x410040 CreateProcessW
0x410044 GetLocaleInfoA
0x410048 DeleteCriticalSection
0x41004c GetCurrentThread
0x410050 GetThreadPriority
0x410054 SetThreadPriority
0x410058 GetCurrentProcess
0x41005c DuplicateHandle
0x410060 IsBadReadPtr
0x410064 InterlockedExchangeAdd
0x410068 InterlockedIncrement
0x41006c WaitForSingleObject
0x410070 InterlockedDecrement
0x410074 InterlockedExchange
0x410078 HeapFree
0x41007c HeapValidate
0x410080 HeapReAlloc
0x410084 GetProcessHeaps
0x410088 HeapCreate
0x41008c HeapSetInformation
0x410090 GetCurrentProcessId
0x410094 HeapAlloc
0x410098 CreateMutexA
0x41009c GetLastError
0x4100a0 ExitProcess
0x4100a4 CreateEventA
0x4100a8 CreateThread
0x4100ac GetModuleFileNameW
0x4100b0 GetVolumeInformationW
0x4100b4 GetDiskFreeSpaceExW
0x4100b8 SetFileAttributesW
0x4100bc CopyFileW
0x4100c0 lstrcmpiW
0x4100c4 CreateDirectoryW
0x4100c8 FindFirstFileW
0x4100cc lstrcmpW
0x4100d0 MoveFileExW
0x4100d4 CreateIoCompletionPort
0x4100d8 FindClose
0x4100dc RemoveDirectoryW
0x4100e0 ExpandEnvironmentStringsW
0x4100e4 DeleteFileW
0x4100e8 GetLogicalDrives
0x4100ec GetDriveTypeW
0x4100f0 QueryDosDeviceW
0x4100f4 lstrcpyW
0x4100f8 WriteFile
0x4100fc FlushFileBuffers
0x410100 EnterCriticalSection
0x410104 LeaveCriticalSection
0x410108 InitializeCriticalSection
0x41010c CreateFileW
0x410110 CreateFileMappingW
0x410114 GlobalUnlock
0x410118 GlobalLock
0x41011c GlobalAlloc
0x410120 lstrlenA
0x410124 lstrlenW
0x410128 lstrcpynW
0x41012c MultiByteToWideChar
0x410130 ExitThread
0x410134 GetTickCount
0x410138 Sleep
0x41013c GetModuleHandleW
0x410140 CloseHandle
0x410144 UnmapViewOfFile
0x410148 GetFileSize
0x41014c MapViewOfFile
USER32.dll
0x41018c RegisterClassExW
0x410190 CreateWindowExW
0x410194 GetMessageA
0x410198 TranslateMessage
0x41019c wsprintfW
0x4101a0 DefWindowProcA
0x4101a4 ChangeClipboardChain
0x4101a8 RegisterRawInputDevices
0x4101ac GetClipboardData
0x4101b0 DispatchMessageA
0x4101b4 EmptyClipboard
0x4101b8 SetClipboardData
0x4101bc CloseClipboard
0x4101c0 IsClipboardFormatAvailable
0x4101c4 SendMessageA
0x4101c8 SetWindowLongW
0x4101cc SetClipboardViewer
0x4101d0 GetWindowLongW
0x4101d4 wsprintfA
0x4101d8 wvsprintfA
0x4101dc OpenClipboard
ADVAPI32.dll
0x410000 CryptReleaseContext
0x410004 RegQueryValueExW
0x410008 RegOpenKeyExW
0x41000c RegOpenKeyExA
0x410010 RegCreateKeyExW
0x410014 CryptAcquireContextW
0x410018 CryptGenRandom
0x41001c RegCloseKey
0x410020 RegSetValueExW
0x410024 RegSetValueExA
SHELL32.dll
0x410160 ShellExecuteW
ole32.dll
0x410300 CoInitializeEx
0x410304 CoUninitialize
0x410308 CoInitialize
0x41030c CoCreateInstance
OLEAUT32.dll
0x410154 SysFreeString
0x410158 SysAllocString
EAT(Export Address Table) is none