ScreenShot
| Created | 2025.05.04 12:59 | Machine | s1_win7_x6403 |
| Filename | f746365d-e454-4fac-a059-be9e01e75e0f | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 61 detected (Common, Lumma, Malicious, score, Trojanpws, RAHack, Lazy, Unsafe, Save, confidence, 100%, GenusT, EVXL, Attribute, HighConfidence, high confidence, Kryptik, MalwareX, Cryp, Generickdz, GenKryptik, RQXP1syK4OE, eauvo, AMADEY, YXFDQZ, Krypt, Static AI, Suspicious PE, Detected, Sabsik, Malware@#l2xfxuqrg9re, LummaC, ABTrojan, JFLR, R700938, Artemis, TrojanPSW, Chgt, PE04C9Z, BSZouKqpwC0, susgen) | ||
| md5 | 36bf166a1ffe829e06d98d49040f8f52 | ||
| sha256 | b58247965374b18d62e2ba91ef3e217ffdc89136ab45d51357a05cc787d53be7 | ||
| ssdeep | 24576:3Kcz2aN34WWXN/FA2TSfMwnFOQtbuxw8uDSfBgTSfMwnFOQtbuxw8uDSfBJ:ZV3WFA22E/QxuwXaBg2E/QxuwXaBJ | ||
| imphash | 27edcdc26ece14730711ef2521583ca2 | ||
| impfuzzy | 24:hWnxWDoQlQtyOovbOGMUD1ulvgkWDpZWylnjBLPxQXRKT07GyiJUJYjz:hWxQo3l3612MZxJjBbxQrGyJJC | ||
Network IP location
Signature (5cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 61 AntiVirus engines on VirusTotal as malicious |
| watch | Communicates with host for which no DNS query was performed |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x14007d758 AcquireSRWLockExclusive
0x14007d760 CloseHandle
0x14007d768 CreateFileA
0x14007d770 CreateFileW
0x14007d778 CreateThread
0x14007d780 DecodePointer
0x14007d788 DeleteCriticalSection
0x14007d790 EncodePointer
0x14007d798 EnterCriticalSection
0x14007d7a0 EnumSystemLocalesW
0x14007d7a8 ExitProcess
0x14007d7b0 ExitThread
0x14007d7b8 FindClose
0x14007d7c0 FindFirstFileExW
0x14007d7c8 FindNextFileW
0x14007d7d0 FlsAlloc
0x14007d7d8 FlsFree
0x14007d7e0 FlsGetValue
0x14007d7e8 FlsSetValue
0x14007d7f0 FlushFileBuffers
0x14007d7f8 FreeEnvironmentStringsW
0x14007d800 FreeLibrary
0x14007d808 FreeLibraryAndExitThread
0x14007d810 GetACP
0x14007d818 GetCPInfo
0x14007d820 GetCommandLineA
0x14007d828 GetCommandLineW
0x14007d830 GetConsoleMode
0x14007d838 GetConsoleOutputCP
0x14007d840 GetCurrentProcess
0x14007d848 GetCurrentProcessId
0x14007d850 GetCurrentThreadId
0x14007d858 GetEnvironmentStringsW
0x14007d860 GetExitCodeThread
0x14007d868 GetFileSize
0x14007d870 GetFileSizeEx
0x14007d878 GetFileType
0x14007d880 GetLastError
0x14007d888 GetLocaleInfoW
0x14007d890 GetModuleFileNameW
0x14007d898 GetModuleHandleA
0x14007d8a0 GetModuleHandleExW
0x14007d8a8 GetModuleHandleW
0x14007d8b0 GetOEMCP
0x14007d8b8 GetProcAddress
0x14007d8c0 GetProcessHeap
0x14007d8c8 GetStartupInfoW
0x14007d8d0 GetStdHandle
0x14007d8d8 GetStringTypeW
0x14007d8e0 GetSystemTimeAsFileTime
0x14007d8e8 GetUserDefaultLCID
0x14007d8f0 HeapAlloc
0x14007d8f8 HeapFree
0x14007d900 HeapReAlloc
0x14007d908 HeapSize
0x14007d910 InitializeCriticalSectionAndSpinCount
0x14007d918 InitializeCriticalSectionEx
0x14007d920 InitializeSListHead
0x14007d928 IsDebuggerPresent
0x14007d930 IsProcessorFeaturePresent
0x14007d938 IsValidCodePage
0x14007d940 IsValidLocale
0x14007d948 LCMapStringEx
0x14007d950 LCMapStringW
0x14007d958 LeaveCriticalSection
0x14007d960 LoadLibraryExW
0x14007d968 MultiByteToWideChar
0x14007d970 QueryPerformanceCounter
0x14007d978 QueryPerformanceFrequency
0x14007d980 RaiseException
0x14007d988 ReadConsoleW
0x14007d990 ReadFile
0x14007d998 ReleaseSRWLockExclusive
0x14007d9a0 RtlCaptureContext
0x14007d9a8 RtlLookupFunctionEntry
0x14007d9b0 RtlPcToFileHeader
0x14007d9b8 RtlUnwind
0x14007d9c0 RtlUnwindEx
0x14007d9c8 RtlVirtualUnwind
0x14007d9d0 SetFilePointerEx
0x14007d9d8 SetLastError
0x14007d9e0 SetStdHandle
0x14007d9e8 SetUnhandledExceptionFilter
0x14007d9f0 Sleep
0x14007d9f8 SleepConditionVariableSRW
0x14007da00 TerminateProcess
0x14007da08 TlsAlloc
0x14007da10 TlsFree
0x14007da18 TlsGetValue
0x14007da20 TlsSetValue
0x14007da28 TryAcquireSRWLockExclusive
0x14007da30 UnhandledExceptionFilter
0x14007da38 WaitForSingleObjectEx
0x14007da40 WakeAllConditionVariable
0x14007da48 WideCharToMultiByte
0x14007da50 WriteConsoleW
0x14007da58 WriteFile
EAT(Export Address Table) is none
KERNEL32.dll
0x14007d758 AcquireSRWLockExclusive
0x14007d760 CloseHandle
0x14007d768 CreateFileA
0x14007d770 CreateFileW
0x14007d778 CreateThread
0x14007d780 DecodePointer
0x14007d788 DeleteCriticalSection
0x14007d790 EncodePointer
0x14007d798 EnterCriticalSection
0x14007d7a0 EnumSystemLocalesW
0x14007d7a8 ExitProcess
0x14007d7b0 ExitThread
0x14007d7b8 FindClose
0x14007d7c0 FindFirstFileExW
0x14007d7c8 FindNextFileW
0x14007d7d0 FlsAlloc
0x14007d7d8 FlsFree
0x14007d7e0 FlsGetValue
0x14007d7e8 FlsSetValue
0x14007d7f0 FlushFileBuffers
0x14007d7f8 FreeEnvironmentStringsW
0x14007d800 FreeLibrary
0x14007d808 FreeLibraryAndExitThread
0x14007d810 GetACP
0x14007d818 GetCPInfo
0x14007d820 GetCommandLineA
0x14007d828 GetCommandLineW
0x14007d830 GetConsoleMode
0x14007d838 GetConsoleOutputCP
0x14007d840 GetCurrentProcess
0x14007d848 GetCurrentProcessId
0x14007d850 GetCurrentThreadId
0x14007d858 GetEnvironmentStringsW
0x14007d860 GetExitCodeThread
0x14007d868 GetFileSize
0x14007d870 GetFileSizeEx
0x14007d878 GetFileType
0x14007d880 GetLastError
0x14007d888 GetLocaleInfoW
0x14007d890 GetModuleFileNameW
0x14007d898 GetModuleHandleA
0x14007d8a0 GetModuleHandleExW
0x14007d8a8 GetModuleHandleW
0x14007d8b0 GetOEMCP
0x14007d8b8 GetProcAddress
0x14007d8c0 GetProcessHeap
0x14007d8c8 GetStartupInfoW
0x14007d8d0 GetStdHandle
0x14007d8d8 GetStringTypeW
0x14007d8e0 GetSystemTimeAsFileTime
0x14007d8e8 GetUserDefaultLCID
0x14007d8f0 HeapAlloc
0x14007d8f8 HeapFree
0x14007d900 HeapReAlloc
0x14007d908 HeapSize
0x14007d910 InitializeCriticalSectionAndSpinCount
0x14007d918 InitializeCriticalSectionEx
0x14007d920 InitializeSListHead
0x14007d928 IsDebuggerPresent
0x14007d930 IsProcessorFeaturePresent
0x14007d938 IsValidCodePage
0x14007d940 IsValidLocale
0x14007d948 LCMapStringEx
0x14007d950 LCMapStringW
0x14007d958 LeaveCriticalSection
0x14007d960 LoadLibraryExW
0x14007d968 MultiByteToWideChar
0x14007d970 QueryPerformanceCounter
0x14007d978 QueryPerformanceFrequency
0x14007d980 RaiseException
0x14007d988 ReadConsoleW
0x14007d990 ReadFile
0x14007d998 ReleaseSRWLockExclusive
0x14007d9a0 RtlCaptureContext
0x14007d9a8 RtlLookupFunctionEntry
0x14007d9b0 RtlPcToFileHeader
0x14007d9b8 RtlUnwind
0x14007d9c0 RtlUnwindEx
0x14007d9c8 RtlVirtualUnwind
0x14007d9d0 SetFilePointerEx
0x14007d9d8 SetLastError
0x14007d9e0 SetStdHandle
0x14007d9e8 SetUnhandledExceptionFilter
0x14007d9f0 Sleep
0x14007d9f8 SleepConditionVariableSRW
0x14007da00 TerminateProcess
0x14007da08 TlsAlloc
0x14007da10 TlsFree
0x14007da18 TlsGetValue
0x14007da20 TlsSetValue
0x14007da28 TryAcquireSRWLockExclusive
0x14007da30 UnhandledExceptionFilter
0x14007da38 WaitForSingleObjectEx
0x14007da40 WakeAllConditionVariable
0x14007da48 WideCharToMultiByte
0x14007da50 WriteConsoleW
0x14007da58 WriteFile
EAT(Export Address Table) is none