ScreenShot
| Created | 2025.03.31 12:12 | Machine | s1_win7_x6403 |
| Filename | EPTwCQd.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 49 detected (AIDetectMalware, Caynamer, Malicious, score, Ghanarava, Trickbot, Unsafe, GenericKDZ, Kryptik, Vi93, confidence, 100%, Attribute, HighConfidence, high confidence, GenKryptik, HHRD, InjectorNetT, CLOUD, frxdy, Static AI, Suspicious PE, Detected, Wacatac, LummaStealer, O96P9Z, NGAW, Artemis, Krypt, Chgt, PE04C9V, FalseSign, Simw, susgen, B9nj) | ||
| md5 | 19cc136b64066f972db18ef9cc2da8ca | ||
| sha256 | d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597 | ||
| ssdeep | 12288:SIR5x+u6RfbWYCrt/22puGGh6abmMbvZwPO5ICWVJ2GV8q7xnrVAAUcLCf6I+Y1x:w3WYatucdvDv/xrVpmx2gzTt | ||
| imphash | 8beb5ca1ff83475ee16fa1a921765aab | ||
| impfuzzy | 24:aWDCelQtWOovbOGMUD1uUvg0WDQyl3LPOTw07GiJUsO:aQC5x361PihbONGJsO | ||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 49 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140052ad8 CloseHandle
0x140052ae0 CreateFileA
0x140052ae8 CreateFileW
0x140052af0 DeleteCriticalSection
0x140052af8 EncodePointer
0x140052b00 EnterCriticalSection
0x140052b08 ExitProcess
0x140052b10 FindClose
0x140052b18 FindFirstFileExW
0x140052b20 FindNextFileW
0x140052b28 FlsAlloc
0x140052b30 FlsFree
0x140052b38 FlsGetValue
0x140052b40 FlsSetValue
0x140052b48 FlushFileBuffers
0x140052b50 FreeEnvironmentStringsW
0x140052b58 FreeLibrary
0x140052b60 GetACP
0x140052b68 GetCPInfo
0x140052b70 GetCommandLineA
0x140052b78 GetCommandLineW
0x140052b80 GetConsoleMode
0x140052b88 GetConsoleOutputCP
0x140052b90 GetCurrentProcess
0x140052b98 GetCurrentProcessId
0x140052ba0 GetCurrentThreadId
0x140052ba8 GetEnvironmentStringsW
0x140052bb0 GetFileSize
0x140052bb8 GetFileSizeEx
0x140052bc0 GetFileType
0x140052bc8 GetLastError
0x140052bd0 GetModuleFileNameA
0x140052bd8 GetModuleFileNameW
0x140052be0 GetModuleHandleExW
0x140052be8 GetModuleHandleW
0x140052bf0 GetOEMCP
0x140052bf8 GetProcAddress
0x140052c00 GetProcessHeap
0x140052c08 GetStartupInfoW
0x140052c10 GetStdHandle
0x140052c18 GetStringTypeW
0x140052c20 GetSystemTimeAsFileTime
0x140052c28 HeapAlloc
0x140052c30 HeapFree
0x140052c38 HeapReAlloc
0x140052c40 HeapSize
0x140052c48 InitializeCriticalSectionAndSpinCount
0x140052c50 InitializeSListHead
0x140052c58 IsDebuggerPresent
0x140052c60 IsProcessorFeaturePresent
0x140052c68 IsValidCodePage
0x140052c70 LCMapStringW
0x140052c78 LeaveCriticalSection
0x140052c80 LoadLibraryExW
0x140052c88 MultiByteToWideChar
0x140052c90 QueryPerformanceCounter
0x140052c98 RaiseException
0x140052ca0 ReadFile
0x140052ca8 RtlCaptureContext
0x140052cb0 RtlLookupFunctionEntry
0x140052cb8 RtlPcToFileHeader
0x140052cc0 RtlUnwindEx
0x140052cc8 RtlVirtualUnwind
0x140052cd0 SetFilePointerEx
0x140052cd8 SetLastError
0x140052ce0 SetStdHandle
0x140052ce8 SetUnhandledExceptionFilter
0x140052cf0 TerminateProcess
0x140052cf8 TlsAlloc
0x140052d00 TlsFree
0x140052d08 TlsGetValue
0x140052d10 TlsSetValue
0x140052d18 UnhandledExceptionFilter
0x140052d20 WideCharToMultiByte
0x140052d28 WriteConsoleW
0x140052d30 WriteFile
EAT(Export Address Table) is none
KERNEL32.dll
0x140052ad8 CloseHandle
0x140052ae0 CreateFileA
0x140052ae8 CreateFileW
0x140052af0 DeleteCriticalSection
0x140052af8 EncodePointer
0x140052b00 EnterCriticalSection
0x140052b08 ExitProcess
0x140052b10 FindClose
0x140052b18 FindFirstFileExW
0x140052b20 FindNextFileW
0x140052b28 FlsAlloc
0x140052b30 FlsFree
0x140052b38 FlsGetValue
0x140052b40 FlsSetValue
0x140052b48 FlushFileBuffers
0x140052b50 FreeEnvironmentStringsW
0x140052b58 FreeLibrary
0x140052b60 GetACP
0x140052b68 GetCPInfo
0x140052b70 GetCommandLineA
0x140052b78 GetCommandLineW
0x140052b80 GetConsoleMode
0x140052b88 GetConsoleOutputCP
0x140052b90 GetCurrentProcess
0x140052b98 GetCurrentProcessId
0x140052ba0 GetCurrentThreadId
0x140052ba8 GetEnvironmentStringsW
0x140052bb0 GetFileSize
0x140052bb8 GetFileSizeEx
0x140052bc0 GetFileType
0x140052bc8 GetLastError
0x140052bd0 GetModuleFileNameA
0x140052bd8 GetModuleFileNameW
0x140052be0 GetModuleHandleExW
0x140052be8 GetModuleHandleW
0x140052bf0 GetOEMCP
0x140052bf8 GetProcAddress
0x140052c00 GetProcessHeap
0x140052c08 GetStartupInfoW
0x140052c10 GetStdHandle
0x140052c18 GetStringTypeW
0x140052c20 GetSystemTimeAsFileTime
0x140052c28 HeapAlloc
0x140052c30 HeapFree
0x140052c38 HeapReAlloc
0x140052c40 HeapSize
0x140052c48 InitializeCriticalSectionAndSpinCount
0x140052c50 InitializeSListHead
0x140052c58 IsDebuggerPresent
0x140052c60 IsProcessorFeaturePresent
0x140052c68 IsValidCodePage
0x140052c70 LCMapStringW
0x140052c78 LeaveCriticalSection
0x140052c80 LoadLibraryExW
0x140052c88 MultiByteToWideChar
0x140052c90 QueryPerformanceCounter
0x140052c98 RaiseException
0x140052ca0 ReadFile
0x140052ca8 RtlCaptureContext
0x140052cb0 RtlLookupFunctionEntry
0x140052cb8 RtlPcToFileHeader
0x140052cc0 RtlUnwindEx
0x140052cc8 RtlVirtualUnwind
0x140052cd0 SetFilePointerEx
0x140052cd8 SetLastError
0x140052ce0 SetStdHandle
0x140052ce8 SetUnhandledExceptionFilter
0x140052cf0 TerminateProcess
0x140052cf8 TlsAlloc
0x140052d00 TlsFree
0x140052d08 TlsGetValue
0x140052d10 TlsSetValue
0x140052d18 UnhandledExceptionFilter
0x140052d20 WideCharToMultiByte
0x140052d28 WriteConsoleW
0x140052d30 WriteFile
EAT(Export Address Table) is none