ScreenShot
| Created | 2025.04.07 10:10 | Machine | s1_win7_x6401 |
| Filename | artikelv4%20%281%29.exe | ||
| Type | PE32+ executable (console) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 6 detected (malicious, moderate confidence, Static AI, Suspicious PE) | ||
| md5 | 97c35aa6d14d7dfa07328a79dd3a7fc3 | ||
| sha256 | cfd520adb363177c9575d210629d05fd7d43d0a0faeb97bcb05bb0b9bbc61fff | ||
| ssdeep | 196608:VdhnXMCHGLLc54i1wN+iV0cSXl74w4UqT4qyR+T8oUAf6nmnAZ:j1XMCHWUjqVg74w0T4qBU5JZ | ||
| imphash | 33742414196e45b8b306a928e178f844 | ||
| impfuzzy | 48:0VYjEwEK/X0W/KA4Juf9nUJOZxYw6sst+MEc+pIuVgTQcHZipmbU1M:Kfs9WJuxYw6sst+MEc+pIuSQAwuyM | ||
Network IP location
Signature (7cnts)
| Level | Description |
|---|---|
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Creates executable files on the filesystem |
| notice | File has been identified by 6 AntiVirus engines on VirusTotal as malicious |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (17cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | anti_vm_detect | Possibly employs anti-virtualization techniques | binaries (download) |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (download) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (download) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | zip_file_format | ZIP file format | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
USER32.dll
0x14002d398 TranslateMessage
0x14002d3a0 ShutdownBlockReasonCreate
0x14002d3a8 GetWindowThreadProcessId
0x14002d3b0 SetWindowLongPtrW
0x14002d3b8 GetWindowLongPtrW
0x14002d3c0 MsgWaitForMultipleObjects
0x14002d3c8 ShowWindow
0x14002d3d0 DestroyWindow
0x14002d3d8 CreateWindowExW
0x14002d3e0 RegisterClassW
0x14002d3e8 DefWindowProcW
0x14002d3f0 PeekMessageW
0x14002d3f8 DispatchMessageW
0x14002d400 GetMessageW
KERNEL32.dll
0x14002d028 GetTimeZoneInformation
0x14002d030 GetProcessHeap
0x14002d038 FreeEnvironmentStringsW
0x14002d040 GetEnvironmentStringsW
0x14002d048 GetCPInfo
0x14002d050 GetOEMCP
0x14002d058 GetACP
0x14002d060 IsValidCodePage
0x14002d068 GetStringTypeW
0x14002d070 FormatMessageW
0x14002d078 GetLastError
0x14002d080 GetModuleFileNameW
0x14002d088 LoadLibraryExW
0x14002d090 SetDllDirectoryW
0x14002d098 CreateSymbolicLinkW
0x14002d0a0 GetProcAddress
0x14002d0a8 CreateDirectoryW
0x14002d0b0 GetCommandLineW
0x14002d0b8 GetEnvironmentVariableW
0x14002d0c0 ExpandEnvironmentStringsW
0x14002d0c8 DeleteFileW
0x14002d0d0 FindClose
0x14002d0d8 FindFirstFileW
0x14002d0e0 FindNextFileW
0x14002d0e8 HeapSize
0x14002d0f0 RemoveDirectoryW
0x14002d0f8 GetTempPathW
0x14002d100 CloseHandle
0x14002d108 QueryPerformanceCounter
0x14002d110 QueryPerformanceFrequency
0x14002d118 WaitForSingleObject
0x14002d120 Sleep
0x14002d128 GetCurrentProcess
0x14002d130 GetCurrentProcessId
0x14002d138 TerminateProcess
0x14002d140 GetExitCodeProcess
0x14002d148 CreateProcessW
0x14002d150 GetStartupInfoW
0x14002d158 FreeLibrary
0x14002d160 LocalFree
0x14002d168 SetConsoleCtrlHandler
0x14002d170 GetConsoleWindow
0x14002d178 K32EnumProcessModules
0x14002d180 K32GetModuleFileNameExW
0x14002d188 CreateFileW
0x14002d190 FindFirstFileExW
0x14002d198 GetFinalPathNameByHandleW
0x14002d1a0 MultiByteToWideChar
0x14002d1a8 WideCharToMultiByte
0x14002d1b0 GetFileAttributesExW
0x14002d1b8 HeapReAlloc
0x14002d1c0 WriteConsoleW
0x14002d1c8 SetEndOfFile
0x14002d1d0 GetDriveTypeW
0x14002d1d8 GetModuleHandleW
0x14002d1e0 RtlCaptureContext
0x14002d1e8 RtlLookupFunctionEntry
0x14002d1f0 RtlVirtualUnwind
0x14002d1f8 UnhandledExceptionFilter
0x14002d200 SetUnhandledExceptionFilter
0x14002d208 IsProcessorFeaturePresent
0x14002d210 GetCurrentThreadId
0x14002d218 GetSystemTimeAsFileTime
0x14002d220 InitializeSListHead
0x14002d228 IsDebuggerPresent
0x14002d230 RtlUnwindEx
0x14002d238 SetLastError
0x14002d240 EnterCriticalSection
0x14002d248 LeaveCriticalSection
0x14002d250 DeleteCriticalSection
0x14002d258 InitializeCriticalSectionAndSpinCount
0x14002d260 TlsAlloc
0x14002d268 TlsGetValue
0x14002d270 TlsSetValue
0x14002d278 TlsFree
0x14002d280 EncodePointer
0x14002d288 RaiseException
0x14002d290 RtlPcToFileHeader
0x14002d298 GetFileInformationByHandle
0x14002d2a0 GetFileType
0x14002d2a8 PeekNamedPipe
0x14002d2b0 SystemTimeToTzSpecificLocalTime
0x14002d2b8 FileTimeToSystemTime
0x14002d2c0 ReadFile
0x14002d2c8 GetFullPathNameW
0x14002d2d0 SetStdHandle
0x14002d2d8 GetStdHandle
0x14002d2e0 WriteFile
0x14002d2e8 ExitProcess
0x14002d2f0 GetModuleHandleExW
0x14002d2f8 GetCommandLineA
0x14002d300 HeapFree
0x14002d308 GetConsoleMode
0x14002d310 ReadConsoleW
0x14002d318 SetFilePointerEx
0x14002d320 GetConsoleOutputCP
0x14002d328 GetFileSizeEx
0x14002d330 HeapAlloc
0x14002d338 FlsAlloc
0x14002d340 FlsGetValue
0x14002d348 FlsSetValue
0x14002d350 FlsFree
0x14002d358 InitializeCriticalSectionEx
0x14002d360 VirtualProtect
0x14002d368 CompareStringW
0x14002d370 LCMapStringW
0x14002d378 GetCurrentDirectoryW
0x14002d380 FlushFileBuffers
0x14002d388 SetEnvironmentVariableW
ADVAPI32.dll
0x14002d000 ConvertSidToStringSidW
0x14002d008 GetTokenInformation
0x14002d010 OpenProcessToken
0x14002d018 ConvertStringSecurityDescriptorToSecurityDescriptorW
EAT(Export Address Table) is none
USER32.dll
0x14002d398 TranslateMessage
0x14002d3a0 ShutdownBlockReasonCreate
0x14002d3a8 GetWindowThreadProcessId
0x14002d3b0 SetWindowLongPtrW
0x14002d3b8 GetWindowLongPtrW
0x14002d3c0 MsgWaitForMultipleObjects
0x14002d3c8 ShowWindow
0x14002d3d0 DestroyWindow
0x14002d3d8 CreateWindowExW
0x14002d3e0 RegisterClassW
0x14002d3e8 DefWindowProcW
0x14002d3f0 PeekMessageW
0x14002d3f8 DispatchMessageW
0x14002d400 GetMessageW
KERNEL32.dll
0x14002d028 GetTimeZoneInformation
0x14002d030 GetProcessHeap
0x14002d038 FreeEnvironmentStringsW
0x14002d040 GetEnvironmentStringsW
0x14002d048 GetCPInfo
0x14002d050 GetOEMCP
0x14002d058 GetACP
0x14002d060 IsValidCodePage
0x14002d068 GetStringTypeW
0x14002d070 FormatMessageW
0x14002d078 GetLastError
0x14002d080 GetModuleFileNameW
0x14002d088 LoadLibraryExW
0x14002d090 SetDllDirectoryW
0x14002d098 CreateSymbolicLinkW
0x14002d0a0 GetProcAddress
0x14002d0a8 CreateDirectoryW
0x14002d0b0 GetCommandLineW
0x14002d0b8 GetEnvironmentVariableW
0x14002d0c0 ExpandEnvironmentStringsW
0x14002d0c8 DeleteFileW
0x14002d0d0 FindClose
0x14002d0d8 FindFirstFileW
0x14002d0e0 FindNextFileW
0x14002d0e8 HeapSize
0x14002d0f0 RemoveDirectoryW
0x14002d0f8 GetTempPathW
0x14002d100 CloseHandle
0x14002d108 QueryPerformanceCounter
0x14002d110 QueryPerformanceFrequency
0x14002d118 WaitForSingleObject
0x14002d120 Sleep
0x14002d128 GetCurrentProcess
0x14002d130 GetCurrentProcessId
0x14002d138 TerminateProcess
0x14002d140 GetExitCodeProcess
0x14002d148 CreateProcessW
0x14002d150 GetStartupInfoW
0x14002d158 FreeLibrary
0x14002d160 LocalFree
0x14002d168 SetConsoleCtrlHandler
0x14002d170 GetConsoleWindow
0x14002d178 K32EnumProcessModules
0x14002d180 K32GetModuleFileNameExW
0x14002d188 CreateFileW
0x14002d190 FindFirstFileExW
0x14002d198 GetFinalPathNameByHandleW
0x14002d1a0 MultiByteToWideChar
0x14002d1a8 WideCharToMultiByte
0x14002d1b0 GetFileAttributesExW
0x14002d1b8 HeapReAlloc
0x14002d1c0 WriteConsoleW
0x14002d1c8 SetEndOfFile
0x14002d1d0 GetDriveTypeW
0x14002d1d8 GetModuleHandleW
0x14002d1e0 RtlCaptureContext
0x14002d1e8 RtlLookupFunctionEntry
0x14002d1f0 RtlVirtualUnwind
0x14002d1f8 UnhandledExceptionFilter
0x14002d200 SetUnhandledExceptionFilter
0x14002d208 IsProcessorFeaturePresent
0x14002d210 GetCurrentThreadId
0x14002d218 GetSystemTimeAsFileTime
0x14002d220 InitializeSListHead
0x14002d228 IsDebuggerPresent
0x14002d230 RtlUnwindEx
0x14002d238 SetLastError
0x14002d240 EnterCriticalSection
0x14002d248 LeaveCriticalSection
0x14002d250 DeleteCriticalSection
0x14002d258 InitializeCriticalSectionAndSpinCount
0x14002d260 TlsAlloc
0x14002d268 TlsGetValue
0x14002d270 TlsSetValue
0x14002d278 TlsFree
0x14002d280 EncodePointer
0x14002d288 RaiseException
0x14002d290 RtlPcToFileHeader
0x14002d298 GetFileInformationByHandle
0x14002d2a0 GetFileType
0x14002d2a8 PeekNamedPipe
0x14002d2b0 SystemTimeToTzSpecificLocalTime
0x14002d2b8 FileTimeToSystemTime
0x14002d2c0 ReadFile
0x14002d2c8 GetFullPathNameW
0x14002d2d0 SetStdHandle
0x14002d2d8 GetStdHandle
0x14002d2e0 WriteFile
0x14002d2e8 ExitProcess
0x14002d2f0 GetModuleHandleExW
0x14002d2f8 GetCommandLineA
0x14002d300 HeapFree
0x14002d308 GetConsoleMode
0x14002d310 ReadConsoleW
0x14002d318 SetFilePointerEx
0x14002d320 GetConsoleOutputCP
0x14002d328 GetFileSizeEx
0x14002d330 HeapAlloc
0x14002d338 FlsAlloc
0x14002d340 FlsGetValue
0x14002d348 FlsSetValue
0x14002d350 FlsFree
0x14002d358 InitializeCriticalSectionEx
0x14002d360 VirtualProtect
0x14002d368 CompareStringW
0x14002d370 LCMapStringW
0x14002d378 GetCurrentDirectoryW
0x14002d380 FlushFileBuffers
0x14002d388 SetEnvironmentVariableW
ADVAPI32.dll
0x14002d000 ConvertSidToStringSidW
0x14002d008 GetTokenInformation
0x14002d010 OpenProcessToken
0x14002d018 ConvertStringSecurityDescriptorToSecurityDescriptorW
EAT(Export Address Table) is none