ScreenShot
| Created | 2024.12.06 09:32 | Machine | s1_win7_x6401 |
| Filename | vorpgkadeg.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 57 detected (AIDetectMalware, Stealc, Malicious, score, Trojanpws, Stealerc, Zusy, Unsafe, confidence, GenusT, EDMA, Attribute, HighConfidence, Windows, Threat, PWSX, LummaStealer, ccmw, VfAEMpoxsdU, ZPACK, Real Protect, moderate, Static AI, Suspicious PE, Detected, Artemis, BScope, Vidar, GdSda, Gencirc, Meterpreter, susgen, Cometer) | ||
| md5 | 4d58df8719d488378f0b6462b39d3c63 | ||
| sha256 | ecf528593210cf58333743a790294e67535d3499994823d79a1c8d4fa40ec88d | ||
| ssdeep | 3072:k1yu7KQnXARW09He9XRzD8xkMpC/SjZeEU2HpC99nzaPJE8:M/Gmd0Z4QJsadeExIfzKD | ||
| imphash | 9688495fa0fb07674109d4238c74f5ee | ||
| impfuzzy | 24:t8f48u8J93qsQCTEB3czG1tUalSfMyDkqjY/J3IU:tq48u8r3qVCTE3QG1tp8fMzV/ | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 57 AntiVirus engines on VirusTotal as malicious |
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | Communicates with host for which no DNS query was performed |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Antivirus | Contains references to security software | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
msvcrt.dll
0x42b0b4 rand
0x42b0b8 strncpy
0x42b0bc ??_V@YAXPAX@Z
0x42b0c0 strtok
0x42b0c4 memchr
0x42b0c8 strtok_s
0x42b0cc ??_U@YAPAXI@Z
0x42b0d0 strcpy_s
0x42b0d4 vsprintf_s
0x42b0d8 memmove
0x42b0dc strlen
0x42b0e0 malloc
0x42b0e4 free
0x42b0e8 memcmp
0x42b0ec ??2@YAPAXI@Z
0x42b0f0 memset
0x42b0f4 memcpy
0x42b0f8 __CxxFrameHandler3
0x42b0fc _except_handler3
KERNEL32.dll
0x42b000 GetModuleFileNameW
0x42b004 GetStringTypeW
0x42b008 MultiByteToWideChar
0x42b00c LCMapStringW
0x42b010 lstrlenA
0x42b014 HeapAlloc
0x42b018 GetProcessHeap
0x42b01c VirtualProtect
0x42b020 CreateProcessA
0x42b024 lstrcatA
0x42b028 VirtualQueryEx
0x42b02c OpenProcess
0x42b030 ReadProcessMemory
0x42b034 UnhandledExceptionFilter
0x42b038 SetUnhandledExceptionFilter
0x42b03c IsDebuggerPresent
0x42b040 EncodePointer
0x42b044 DecodePointer
0x42b048 TerminateProcess
0x42b04c GetCurrentProcess
0x42b050 InitializeCriticalSectionAndSpinCount
0x42b054 LeaveCriticalSection
0x42b058 EnterCriticalSection
0x42b05c RtlUnwind
0x42b060 GetProcAddress
0x42b064 GetModuleHandleW
0x42b068 ExitProcess
0x42b06c Sleep
0x42b070 WriteFile
0x42b074 GetStdHandle
0x42b078 GetLastError
0x42b07c LoadLibraryW
0x42b080 TlsGetValue
0x42b084 TlsSetValue
0x42b088 InterlockedIncrement
0x42b08c SetLastError
0x42b090 GetCurrentThreadId
0x42b094 InterlockedDecrement
0x42b098 WideCharToMultiByte
0x42b09c GetCPInfo
0x42b0a0 GetACP
0x42b0a4 GetOEMCP
0x42b0a8 IsValidCodePage
0x42b0ac RaiseException
EAT(Export Address Table) is none
msvcrt.dll
0x42b0b4 rand
0x42b0b8 strncpy
0x42b0bc ??_V@YAXPAX@Z
0x42b0c0 strtok
0x42b0c4 memchr
0x42b0c8 strtok_s
0x42b0cc ??_U@YAPAXI@Z
0x42b0d0 strcpy_s
0x42b0d4 vsprintf_s
0x42b0d8 memmove
0x42b0dc strlen
0x42b0e0 malloc
0x42b0e4 free
0x42b0e8 memcmp
0x42b0ec ??2@YAPAXI@Z
0x42b0f0 memset
0x42b0f4 memcpy
0x42b0f8 __CxxFrameHandler3
0x42b0fc _except_handler3
KERNEL32.dll
0x42b000 GetModuleFileNameW
0x42b004 GetStringTypeW
0x42b008 MultiByteToWideChar
0x42b00c LCMapStringW
0x42b010 lstrlenA
0x42b014 HeapAlloc
0x42b018 GetProcessHeap
0x42b01c VirtualProtect
0x42b020 CreateProcessA
0x42b024 lstrcatA
0x42b028 VirtualQueryEx
0x42b02c OpenProcess
0x42b030 ReadProcessMemory
0x42b034 UnhandledExceptionFilter
0x42b038 SetUnhandledExceptionFilter
0x42b03c IsDebuggerPresent
0x42b040 EncodePointer
0x42b044 DecodePointer
0x42b048 TerminateProcess
0x42b04c GetCurrentProcess
0x42b050 InitializeCriticalSectionAndSpinCount
0x42b054 LeaveCriticalSection
0x42b058 EnterCriticalSection
0x42b05c RtlUnwind
0x42b060 GetProcAddress
0x42b064 GetModuleHandleW
0x42b068 ExitProcess
0x42b06c Sleep
0x42b070 WriteFile
0x42b074 GetStdHandle
0x42b078 GetLastError
0x42b07c LoadLibraryW
0x42b080 TlsGetValue
0x42b084 TlsSetValue
0x42b088 InterlockedIncrement
0x42b08c SetLastError
0x42b090 GetCurrentThreadId
0x42b094 InterlockedDecrement
0x42b098 WideCharToMultiByte
0x42b09c GetCPInfo
0x42b0a0 GetACP
0x42b0a4 GetOEMCP
0x42b0a8 IsValidCodePage
0x42b0ac RaiseException
EAT(Export Address Table) is none