ScreenShot
| Created | 2025.02.21 16:36 | Machine | s1_win7_x6403 |
| Filename | CCleanerPerformanceOptimizer.dll | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 52 detected (AIDetectMalware, VMProtect, Malicious, score, Ghanarava, GenericKD, Unsafe, Save, confidence, 100%, Attribute, HighConfidence, high confidence, AG suspicious, xbsfls, Kryptik@AI, RDML, B9l7NXNKMsIFOajg2KsMqw, AGEN, Real Protect, moderate, Generic Reputation PUA, Static AI, Malicious PE, Detected, SpyLoader, Artemis, Chgt, R002H09A425, Gencirc, susgen) | ||
| md5 | ce21e6627863d977338c069a9ac8e2a3 | ||
| sha256 | 446be17643e7bdea9beeefb956da722046c815191d8e16d87d758bb6aa037cf6 | ||
| ssdeep | 196608:eqfS2IaO5elFJGE18Ozqugl1XLvTaGLpcZQJLl8N:zXIE18xueLryC | ||
| imphash | 4f994dfbd4bb00f4b00ec110ca20942d | ||
| impfuzzy | 12:8HqTlLOFJ2Glzm8lJ2Q4W2zKMP4PKLfa04HLuD1FGWTOZGqAJcDW:8o6n2i55UKMPQeULu5FGEadNDW | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 52 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (3cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x1405c7000 ResumeThread
USER32.dll
0x1405c7010 GetClipboardData
GDI32.dll
0x1405c7020 CreateRoundRectRgn
ADVAPI32.dll
0x1405c7030 GetUserNameA
SHELL32.dll
0x1405c7040 ShellExecuteA
IMM32.dll
0x1405c7050 ImmGetContext
MSVCP140.dll
0x1405c7060 ?_Throw_Cpp_error@std@@YAXH@Z
WININET.dll
0x1405c7070 InternetReadFile
urlmon.dll
0x1405c7080 UrlMkSetSessionOption
d3d9.dll
0x1405c7090 Direct3DCreate9
VCRUNTIME140_1.dll
0x1405c70a0 __CxxFrameHandler4
VCRUNTIME140.dll
0x1405c70b0 memmove
api-ms-win-crt-stdio-l1-1-0.dll
0x1405c70c0 _set_fmode
api-ms-win-crt-string-l1-1-0.dll
0x1405c70d0 strncpy
api-ms-win-crt-utility-l1-1-0.dll
0x1405c70e0 rand
api-ms-win-crt-heap-l1-1-0.dll
0x1405c70f0 malloc
api-ms-win-crt-convert-l1-1-0.dll
0x1405c7100 mbstowcs
api-ms-win-crt-runtime-l1-1-0.dll
0x1405c7110 _set_app_type
api-ms-win-crt-filesystem-l1-1-0.dll
0x1405c7120 rename
api-ms-win-crt-time-l1-1-0.dll
0x1405c7130 _time64
api-ms-win-crt-math-l1-1-0.dll
0x1405c7140 ceil
api-ms-win-crt-locale-l1-1-0.dll
0x1405c7150 _configthreadlocale
ntdll.dll
0x1405c7160 RtlLookupFunctionEntry
KERNEL32.dll
0x1405c7170 GetSystemTimeAsFileTime
KERNEL32.dll
0x1405c7180 HeapAlloc
0x1405c7188 HeapFree
0x1405c7190 ExitProcess
0x1405c7198 LoadLibraryA
0x1405c71a0 GetModuleHandleA
0x1405c71a8 GetProcAddress
EAT(Export Address Table) is none
KERNEL32.dll
0x1405c7000 ResumeThread
USER32.dll
0x1405c7010 GetClipboardData
GDI32.dll
0x1405c7020 CreateRoundRectRgn
ADVAPI32.dll
0x1405c7030 GetUserNameA
SHELL32.dll
0x1405c7040 ShellExecuteA
IMM32.dll
0x1405c7050 ImmGetContext
MSVCP140.dll
0x1405c7060 ?_Throw_Cpp_error@std@@YAXH@Z
WININET.dll
0x1405c7070 InternetReadFile
urlmon.dll
0x1405c7080 UrlMkSetSessionOption
d3d9.dll
0x1405c7090 Direct3DCreate9
VCRUNTIME140_1.dll
0x1405c70a0 __CxxFrameHandler4
VCRUNTIME140.dll
0x1405c70b0 memmove
api-ms-win-crt-stdio-l1-1-0.dll
0x1405c70c0 _set_fmode
api-ms-win-crt-string-l1-1-0.dll
0x1405c70d0 strncpy
api-ms-win-crt-utility-l1-1-0.dll
0x1405c70e0 rand
api-ms-win-crt-heap-l1-1-0.dll
0x1405c70f0 malloc
api-ms-win-crt-convert-l1-1-0.dll
0x1405c7100 mbstowcs
api-ms-win-crt-runtime-l1-1-0.dll
0x1405c7110 _set_app_type
api-ms-win-crt-filesystem-l1-1-0.dll
0x1405c7120 rename
api-ms-win-crt-time-l1-1-0.dll
0x1405c7130 _time64
api-ms-win-crt-math-l1-1-0.dll
0x1405c7140 ceil
api-ms-win-crt-locale-l1-1-0.dll
0x1405c7150 _configthreadlocale
ntdll.dll
0x1405c7160 RtlLookupFunctionEntry
KERNEL32.dll
0x1405c7170 GetSystemTimeAsFileTime
KERNEL32.dll
0x1405c7180 HeapAlloc
0x1405c7188 HeapFree
0x1405c7190 ExitProcess
0x1405c7198 LoadLibraryA
0x1405c71a0 GetModuleHandleA
0x1405c71a8 GetProcAddress
EAT(Export Address Table) is none