ScreenShot
| Created | 2025.04.28 10:44 | Machine | s1_win7_x6401 |
| Filename | verify-sec | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 46 detected (AIDetectMalware, Malicious, score, FXGK, Tedy, Unsafe, Kryptik, V7tc, confidence, 100%, Attribute, HighConfidence, high confidence, GenKryptik, HAJD, MalwareX, Misc, smehcm, Kryptik@AI, RDML, ESU+HpQK3fxL6Jbh7y6G0Q, woivq, Detected, Wacatac, ABTrojan, MMRF, Neshta, FileInfector, Krypt, R002H06DA25, Gencirc, susgen) | ||
| md5 | 7b5660eccce9ebca4c58bd1181c636c7 | ||
| sha256 | 306f26d8f5da8e4def57db3127ef442c6f23bdf2921b58beae86bd626a19c2b5 | ||
| ssdeep | 12288:CUcEohewQciZdLG2TnPoL48OJ8O1bg1V3fymNhWem1jvUr2:CUcjwvc6LBTnPx8OeOq3PymNQeUjS | ||
| imphash | 2eaaa17d2af3723312759bf7667b8cfe | ||
| impfuzzy | 24:qPl7sJFxcplE5jVZD502toSEOBg3JeYz9RXvwOSOovbO9ZfM9v:q9A1cpentoSEOBg1zHJ3W | ||
Network IP location
Signature (3cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 46 AntiVirus engines on VirusTotal as malicious |
| info | Checks amount of memory in system |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140026000 GetProcessHeap
0x140026008 RtlCompareMemory
0x140026010 lstrcatW
0x140026018 lstrcpyW
0x140026020 GetModuleFileNameW
0x140026028 GetComputerNameExW
0x140026030 HeapAlloc
0x140026038 GetCurrentThreadId
0x140026040 GetLastError
0x140026048 CreateFileW
0x140026050 HeapReAlloc
0x140026058 HeapSize
0x140026060 HeapFree
0x140026068 SetFilePointerEx
0x140026070 CloseHandle
0x140026078 EnterCriticalSection
0x140026080 LeaveCriticalSection
0x140026088 InitializeCriticalSectionAndSpinCount
0x140026090 DeleteCriticalSection
0x140026098 SetEvent
0x1400260a0 ResetEvent
0x1400260a8 WaitForSingleObjectEx
0x1400260b0 CreateEventW
0x1400260b8 GetModuleHandleW
0x1400260c0 GetProcAddress
0x1400260c8 RtlCaptureContext
0x1400260d0 RtlLookupFunctionEntry
0x1400260d8 RtlVirtualUnwind
0x1400260e0 UnhandledExceptionFilter
0x1400260e8 SetUnhandledExceptionFilter
0x1400260f0 GetCurrentProcess
0x1400260f8 TerminateProcess
0x140026100 IsProcessorFeaturePresent
0x140026108 IsDebuggerPresent
0x140026110 GetStartupInfoW
0x140026118 QueryPerformanceCounter
0x140026120 GetCurrentProcessId
0x140026128 GetSystemTimeAsFileTime
0x140026130 InitializeSListHead
0x140026138 ExitProcess
0x140026140 RtlUnwindEx
0x140026148 RtlPcToFileHeader
0x140026150 RaiseException
0x140026158 SetLastError
0x140026160 EncodePointer
0x140026168 RtlUnwind
0x140026170 TlsAlloc
0x140026178 TlsGetValue
0x140026180 TlsSetValue
0x140026188 TlsFree
0x140026190 FreeLibrary
0x140026198 LoadLibraryExW
0x1400261a0 GetModuleHandleExW
0x1400261a8 GetStdHandle
0x1400261b0 WriteFile
0x1400261b8 GetFileType
0x1400261c0 FlsAlloc
0x1400261c8 FlsGetValue
0x1400261d0 FlsSetValue
0x1400261d8 FlsFree
0x1400261e0 LCMapStringW
0x1400261e8 FindClose
0x1400261f0 FindFirstFileExW
0x1400261f8 FindNextFileW
0x140026200 IsValidCodePage
0x140026208 GetACP
0x140026210 GetOEMCP
0x140026218 GetCPInfo
0x140026220 GetCommandLineA
0x140026228 GetCommandLineW
0x140026230 MultiByteToWideChar
0x140026238 WideCharToMultiByte
0x140026240 GetEnvironmentStringsW
0x140026248 FreeEnvironmentStringsW
0x140026250 SetStdHandle
0x140026258 GetStringTypeW
0x140026260 GetConsoleMode
0x140026268 FlushFileBuffers
0x140026270 GetConsoleOutputCP
0x140026278 WriteConsoleW
EAT(Export Address Table) is none
KERNEL32.dll
0x140026000 GetProcessHeap
0x140026008 RtlCompareMemory
0x140026010 lstrcatW
0x140026018 lstrcpyW
0x140026020 GetModuleFileNameW
0x140026028 GetComputerNameExW
0x140026030 HeapAlloc
0x140026038 GetCurrentThreadId
0x140026040 GetLastError
0x140026048 CreateFileW
0x140026050 HeapReAlloc
0x140026058 HeapSize
0x140026060 HeapFree
0x140026068 SetFilePointerEx
0x140026070 CloseHandle
0x140026078 EnterCriticalSection
0x140026080 LeaveCriticalSection
0x140026088 InitializeCriticalSectionAndSpinCount
0x140026090 DeleteCriticalSection
0x140026098 SetEvent
0x1400260a0 ResetEvent
0x1400260a8 WaitForSingleObjectEx
0x1400260b0 CreateEventW
0x1400260b8 GetModuleHandleW
0x1400260c0 GetProcAddress
0x1400260c8 RtlCaptureContext
0x1400260d0 RtlLookupFunctionEntry
0x1400260d8 RtlVirtualUnwind
0x1400260e0 UnhandledExceptionFilter
0x1400260e8 SetUnhandledExceptionFilter
0x1400260f0 GetCurrentProcess
0x1400260f8 TerminateProcess
0x140026100 IsProcessorFeaturePresent
0x140026108 IsDebuggerPresent
0x140026110 GetStartupInfoW
0x140026118 QueryPerformanceCounter
0x140026120 GetCurrentProcessId
0x140026128 GetSystemTimeAsFileTime
0x140026130 InitializeSListHead
0x140026138 ExitProcess
0x140026140 RtlUnwindEx
0x140026148 RtlPcToFileHeader
0x140026150 RaiseException
0x140026158 SetLastError
0x140026160 EncodePointer
0x140026168 RtlUnwind
0x140026170 TlsAlloc
0x140026178 TlsGetValue
0x140026180 TlsSetValue
0x140026188 TlsFree
0x140026190 FreeLibrary
0x140026198 LoadLibraryExW
0x1400261a0 GetModuleHandleExW
0x1400261a8 GetStdHandle
0x1400261b0 WriteFile
0x1400261b8 GetFileType
0x1400261c0 FlsAlloc
0x1400261c8 FlsGetValue
0x1400261d0 FlsSetValue
0x1400261d8 FlsFree
0x1400261e0 LCMapStringW
0x1400261e8 FindClose
0x1400261f0 FindFirstFileExW
0x1400261f8 FindNextFileW
0x140026200 IsValidCodePage
0x140026208 GetACP
0x140026210 GetOEMCP
0x140026218 GetCPInfo
0x140026220 GetCommandLineA
0x140026228 GetCommandLineW
0x140026230 MultiByteToWideChar
0x140026238 WideCharToMultiByte
0x140026240 GetEnvironmentStringsW
0x140026248 FreeEnvironmentStringsW
0x140026250 SetStdHandle
0x140026258 GetStringTypeW
0x140026260 GetConsoleMode
0x140026268 FlushFileBuffers
0x140026270 GetConsoleOutputCP
0x140026278 WriteConsoleW
EAT(Export Address Table) is none