

--------------------------------------------------------------------------------
File Information (time: 0:00:01.458924)
--------------------------------------------------------------------------------
filename         sample08.exe
filetype         PE32 executable (GUI) Intel 80386, for MS Windows
filesize         13824
hash sha256      e551275aa089805c48ec1734d3d4ecd03997663e58892323bf174f0b7eb52504
virustotal       /
imagebase        0x400000
entrypoint       0x1000
imphash          801793b2be29822524e8824fc3c47535
datetime         2021-03-18 07:16:23
dll              False
directories      import, tls, relocations
sections         .text, .rdata, .data, .reloc
features         mutex, antidbg, packer


--------------------------------------------------------------------------------
Yara Plugins
--------------------------------------------------------------------------------
IsPE32
IsWindowsGUI
HasRichSignature


--------------------------------------------------------------------------------
Behavior
--------------------------------------------------------------------------------
Xor
network tcp socket
network dns
win mutex
win token
win files operation


--------------------------------------------------------------------------------
Packer
--------------------------------------------------------------------------------
MASMTASM
TASM MASM
TASM MASM additional
PE Diminisher v01 additional


--------------------------------------------------------------------------------
Mutex Api
--------------------------------------------------------------------------------
CreateMutexA
OpenMutexA
WaitForSingleObject


--------------------------------------------------------------------------------
Anti Debug
--------------------------------------------------------------------------------
GetWindowThreadProcessId


--------------------------------------------------------------------------------
Sections Suspicious
--------------------------------------------------------------------------------
For each section the value of entropy is less than 6


--------------------------------------------------------------------------------
Import function
--------------------------------------------------------------------------------
user32.dll       16
kernel32.dll     30
advapi32.dll     3
wsock32.dll      12
shell32.dll      1
ws2_32.dll       3
ole32.dll        3
secur32.dll      2
psapi.dll        1


--------------------------------------------------------------------------------
Possibile Breakpoint
--------------------------------------------------------------------------------
CloseHandle
CreateFileA
CreateMutexA
CreateThread
DeleteFileA
ExitProcess
GetCommandLineA
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetModuleFileNameA
GetModuleFileNameExA
GetModuleHandleA
GetProcAddress
GetTempPathA
GetWindowThreadProcessId
OpenMutexA
OpenProcess
OpenProcessToken
SetFilePointer
Sleep
VirtualAlloc
VirtualFree
WSAStartup
WaitForSingleObject
WriteFile
closesocket
connect
recv
send
socket


--------------------------------------------------------------------------------
Ip Address
--------------------------------------------------------------------------------
192.53.123.202
93.115.29.50


--------------------------------------------------------------------------------
File
--------------------------------------------------------------------------------
user32.dll       Library
kernel32.dll     Library
advapi32.dll     Library
wsock32.dll      Library
shell32.dll      Library
ws2_32.dll       Library
ole32.dll        Library
secur32.dll      Library
psapi.dll        Library
ntdll.dll        Library
