ScreenShot
| Created | 2025.03.26 13:25 | Machine | s1_win7_x6403 |
| Filename | loader.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | |||
| VT API (file) | 50 detected (Common, Malicious, score, Ghanarava, GenericKD, Unsafe, Vnab, confidence, 100%, Attribute, HighConfidence, high confidence, AGen, MalwareX, xyddpc, AgentAGen, kvpilm, CLOUD, pqgnx, Generic Reputation PUA, Static AI, Malicious PE, Detected, Malgent, ABApplication, IYNA, R692944, Artemis, R007H09BG25, Gencirc, susgen, Behavior) | ||
| md5 | c797beeee8e4aa8a65f2ec466d923404 | ||
| sha256 | e5c75a6e453ef91b594a3ad744ddbfa165784718e394f1250fc4ca25ac4702f9 | ||
| ssdeep | 384:+JXIOV5jGRG5GGnfa8Rh0+W6CXCpsj20OX:+BIOTji0aohZsyd | ||
| imphash | 9e9012fce1d985d6218cdb2dab474e32 | ||
| impfuzzy | 48:ZtMS1iE6EBTEl4FSmNZj9ZxW8XGRg0+BMQSLMA:ZtMS1cEBTEl4FlNZj9ZICGRa6 | ||
Network IP location
Signature (2cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 50 AntiVirus engines on VirusTotal as malicious |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140003000 SetConsoleTextAttribute
0x140003008 SetConsoleTitleA
0x140003010 GetStdHandle
0x140003018 Sleep
0x140003020 RtlLookupFunctionEntry
0x140003028 RtlVirtualUnwind
0x140003030 UnhandledExceptionFilter
0x140003038 SetUnhandledExceptionFilter
0x140003040 GetCurrentProcess
0x140003048 TerminateProcess
0x140003050 IsProcessorFeaturePresent
0x140003058 QueryPerformanceCounter
0x140003060 GetCurrentProcessId
0x140003068 GetCurrentThreadId
0x140003070 GetSystemTimeAsFileTime
0x140003078 InitializeSListHead
0x140003080 IsDebuggerPresent
0x140003088 GetModuleHandleW
0x140003090 RtlCaptureContext
SHELL32.dll
0x1400030f0 ShellExecuteW
MSVCP140.dll
0x1400030a0 ?good@ios_base@std@@QEBA_NXZ
0x1400030a8 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x1400030b0 ?uncaught_exception@std@@YA_NXZ
0x1400030b8 ?_Xlength_error@std@@YAXPEBD@Z
0x1400030c0 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
0x1400030c8 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
0x1400030d0 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
0x1400030d8 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
0x1400030e0 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
urlmon.dll
0x140003280 URLDownloadToFileW
VCRUNTIME140_1.dll
0x140003158 __CxxFrameHandler4
VCRUNTIME140.dll
0x140003100 __C_specific_handler
0x140003108 __std_terminate
0x140003110 __current_exception
0x140003118 __std_exception_destroy
0x140003120 memcpy
0x140003128 _CxxThrowException
0x140003130 memmove
0x140003138 __std_exception_copy
0x140003140 __current_exception_context
0x140003148 memset
api-ms-win-crt-runtime-l1-1-0.dll
0x1400031c0 _register_onexit_function
0x1400031c8 _crt_atexit
0x1400031d0 _c_exit
0x1400031d8 __p___argv
0x1400031e0 _initterm_e
0x1400031e8 _initialize_onexit_table
0x1400031f0 exit
0x1400031f8 _register_thread_local_exe_atexit_callback
0x140003200 _initterm
0x140003208 _get_initial_narrow_environment
0x140003210 _initialize_narrow_environment
0x140003218 _cexit
0x140003220 _set_app_type
0x140003228 _seh_filter_exe
0x140003230 __p___argc
0x140003238 _exit
0x140003240 _invalid_parameter_noinfo_noreturn
0x140003248 system
0x140003250 terminate
0x140003258 _configure_narrow_argv
api-ms-win-crt-filesystem-l1-1-0.dll
0x140003168 remove
api-ms-win-crt-heap-l1-1-0.dll
0x140003178 _set_new_mode
0x140003180 free
0x140003188 _callnewh
0x140003190 malloc
api-ms-win-crt-math-l1-1-0.dll
0x1400031b0 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003268 _set_fmode
0x140003270 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x1400031a0 _configthreadlocale
EAT(Export Address Table) is none
KERNEL32.dll
0x140003000 SetConsoleTextAttribute
0x140003008 SetConsoleTitleA
0x140003010 GetStdHandle
0x140003018 Sleep
0x140003020 RtlLookupFunctionEntry
0x140003028 RtlVirtualUnwind
0x140003030 UnhandledExceptionFilter
0x140003038 SetUnhandledExceptionFilter
0x140003040 GetCurrentProcess
0x140003048 TerminateProcess
0x140003050 IsProcessorFeaturePresent
0x140003058 QueryPerformanceCounter
0x140003060 GetCurrentProcessId
0x140003068 GetCurrentThreadId
0x140003070 GetSystemTimeAsFileTime
0x140003078 InitializeSListHead
0x140003080 IsDebuggerPresent
0x140003088 GetModuleHandleW
0x140003090 RtlCaptureContext
SHELL32.dll
0x1400030f0 ShellExecuteW
MSVCP140.dll
0x1400030a0 ?good@ios_base@std@@QEBA_NXZ
0x1400030a8 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
0x1400030b0 ?uncaught_exception@std@@YA_NXZ
0x1400030b8 ?_Xlength_error@std@@YAXPEBD@Z
0x1400030c0 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
0x1400030c8 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
0x1400030d0 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
0x1400030d8 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
0x1400030e0 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
urlmon.dll
0x140003280 URLDownloadToFileW
VCRUNTIME140_1.dll
0x140003158 __CxxFrameHandler4
VCRUNTIME140.dll
0x140003100 __C_specific_handler
0x140003108 __std_terminate
0x140003110 __current_exception
0x140003118 __std_exception_destroy
0x140003120 memcpy
0x140003128 _CxxThrowException
0x140003130 memmove
0x140003138 __std_exception_copy
0x140003140 __current_exception_context
0x140003148 memset
api-ms-win-crt-runtime-l1-1-0.dll
0x1400031c0 _register_onexit_function
0x1400031c8 _crt_atexit
0x1400031d0 _c_exit
0x1400031d8 __p___argv
0x1400031e0 _initterm_e
0x1400031e8 _initialize_onexit_table
0x1400031f0 exit
0x1400031f8 _register_thread_local_exe_atexit_callback
0x140003200 _initterm
0x140003208 _get_initial_narrow_environment
0x140003210 _initialize_narrow_environment
0x140003218 _cexit
0x140003220 _set_app_type
0x140003228 _seh_filter_exe
0x140003230 __p___argc
0x140003238 _exit
0x140003240 _invalid_parameter_noinfo_noreturn
0x140003248 system
0x140003250 terminate
0x140003258 _configure_narrow_argv
api-ms-win-crt-filesystem-l1-1-0.dll
0x140003168 remove
api-ms-win-crt-heap-l1-1-0.dll
0x140003178 _set_new_mode
0x140003180 free
0x140003188 _callnewh
0x140003190 malloc
api-ms-win-crt-math-l1-1-0.dll
0x1400031b0 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003268 _set_fmode
0x140003270 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x1400031a0 _configthreadlocale
EAT(Export Address Table) is none