Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 31, 2021, 6:11 p.m.	March 31, 2021, 6:22 p.m.

Size	98.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8ec48d6b3c508eb2b55cc4d2bbbe689e`
SHA256	`3f9d5b3c82e841a570d286b23580f0a039168d5f588042922267a6b1fd279e40`
CRC32	`1CB35425`
ssdeep	`384:OnvIqZQySdNBYxGMoH/JBINoDLWaQgXqXfXDX60XeX5XqXhXsXAXSXbXsXCXsXpa:+Zm/Jsh6ZKYy6cQ`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

PO_3351_60_20.pdf "C:\Users\test22\AppData\Local\Temp\PO_3351_60_20.pdf"
4944

Name	Response	Post-Analysis Lookup
dqdqededqedqe.tk	A 104.21.87.185 A 172.67.145.154	104.21.87.185

IP Address	Status	Action
104.21.87.185	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 31, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 31, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 31, 2021, 6:11 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-BE0D6008B79DBE9449CE5256CFD03D71.html
suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C12F8004069E83623AB2711F1604EE2D.html
suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-082FF195ECF6455BE11B051ADD7792F7.html

Performs some HTTP requests (3 events)

request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-BE0D6008B79DBE9449CE5256CFD03D71.html
request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-C12F8004069E83623AB2711F1604EE2D.html
request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-082FF195ECF6455BE11B051ADD7792F7.html

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 4944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 31, 2021, 6:11 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.8ec48d6b3c508eb2
McAfee	Artemis!8EC48D6B3C50
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:MSIL/Generic.3f7e2af9
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HQY
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/AgentTesla!ml
BitDefenderTheta	Gen:NN.ZemsilF.34662.gm0@aeaHDNai
Rising	Downloader.Agent!8.B23 (CLOUD)
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

PO_3351_60_20.pdf

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All