Report - analyzer.log

ScreenShot AntiDebug AntiVM
ScreenShot
Created 2024.12.01 02:16 Machine s1_win7_x6401
Filename analyzer.log
Type ASCII text
AI Score Not founds Behavior Score
1.0
ZERO API file : clean
VT API (file)
md5 a6a4a1e82b1baedd0016891a8c19e817
sha256 2abc88e8e732f1f6fe479a644555f6d93344f686d0abccb9efbe36c5626ff0fe
ssdeep 48:Iwf72Bs3tYH2YrbGBtqht4KN3hl32Y5bGKhpXKanh4KXK3KvfGhHsKdDtt4:IQ72B2KHbbMqrLRz3Jb9Gqp6av+1dx+
imphash
impfuzzy
  Network IP location

Signature (3cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice Yara rule detected in process memory
info Checks amount of memory in system

Rules (9cnts)

Level Name Description Collection
notice ScreenShot Take ScreenShot memory
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure