popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

win32.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 13, 2021, 9:58 a.m. April 13, 2021, 10:28 a.m.
Size 366.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 b2e46b8ad3081ee99c70acb3c1b17027
SHA256 51176a8d50bde78f39d91c45d1286ae6394996c10248a50e46b4134da1903511
CRC32 97DDEEC7
ssdeep 6144:rdeFFFFFFFFFFFF3CHgezqTUXtW+s5nzHh0jvy6HynjlUS6kMt:QTezqTYtWFxDdHnCHPt
Yara
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasRichSignature - Rich Signature Check

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.formula-kuhni.com/hx3a/?kfL4bD=caEAE6TMNpstNWNzBS8nf+GDaIfP+W5I+AjwjXTPkb+IEfM7tlcs+MNsJ0nLlfwLg5GA5aWf&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.freeworldsin.com/hx3a/?kfL4bD=3DLg49gztkEwDEpIhVA6GAYr4+4EzSmtPlay4vrQXwYdcq0BUm/96tiO2YO0ZgN2rKAOBP6W&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.stkify.com/hx3a/?kfL4bD=BjXYzYy3Wwi6aFrEgM1HjT0aBbEvvpOSUIS/nNRAIJdaTtvHKKMsj+M6Q3I+cHJNNRrjAE2C&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.aksharnewtown.com/hx3a/?kfL4bD=UKCdSLR8412vaMHIP2MhlUsk7yfSGMFZEuzAx2SZAjE0ZNyfcYSEyp6nktJEVuEc4C6Qs51w&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.roughcuttavernorder.com/hx3a/?kfL4bD=SZwlqd8Hzn3rpaEWsCajdeS5oRp1CcdbOIkzozoaJWcxcB0oMm0zINyb01h8HBqPBgXJWi1M&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.recovatek.com/hx3a/?kfL4bD=fCmUcBRjRsJN2niul11B/xiypSW2fUD8cUjfy08rELK4cGFPgnyxy4j4Y+fYFi5gkgSESZTn&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.sellingdealsinheels.com/hx3a/?kfL4bD=ZQONasgLaIqJtl+Y9ynHdAMgHGG3yPHQMSSB3SdTownDFaJtrUUp853ISMl3zW6kC1fHv0WQ&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.bookbeachchairs.com/hx3a/?kfL4bD=EBC1Cs7uqSFNwkQnGgLKPc+2rIVZ9PU/AWUwkk97HGSV6MybJ9/jFS+r7M72vm+mHjcr9wDF&jBZx=D8b0b
suspicious_features GET method with no useragent header suspicious_request GET http://www.sxqyws.net/hx3a/?kfL4bD=T9MXgcgL1KL8QuajaJKCENDo6nNTCJSWQpkqYg4zOpZsIFxlmDBTIA+IF+ioP0h6JnMBeNuT&jBZx=D8b0b
request POST http://www.formula-kuhni.com/hx3a/
request GET http://www.formula-kuhni.com/hx3a/?kfL4bD=caEAE6TMNpstNWNzBS8nf+GDaIfP+W5I+AjwjXTPkb+IEfM7tlcs+MNsJ0nLlfwLg5GA5aWf&jBZx=D8b0b
request POST http://www.freeworldsin.com/hx3a/
request GET http://www.freeworldsin.com/hx3a/?kfL4bD=3DLg49gztkEwDEpIhVA6GAYr4+4EzSmtPlay4vrQXwYdcq0BUm/96tiO2YO0ZgN2rKAOBP6W&jBZx=D8b0b
request POST http://www.stkify.com/hx3a/
request GET http://www.stkify.com/hx3a/?kfL4bD=BjXYzYy3Wwi6aFrEgM1HjT0aBbEvvpOSUIS/nNRAIJdaTtvHKKMsj+M6Q3I+cHJNNRrjAE2C&jBZx=D8b0b
request POST http://www.aksharnewtown.com/hx3a/
request GET http://www.aksharnewtown.com/hx3a/?kfL4bD=UKCdSLR8412vaMHIP2MhlUsk7yfSGMFZEuzAx2SZAjE0ZNyfcYSEyp6nktJEVuEc4C6Qs51w&jBZx=D8b0b
request POST http://www.roughcuttavernorder.com/hx3a/
request GET http://www.roughcuttavernorder.com/hx3a/?kfL4bD=SZwlqd8Hzn3rpaEWsCajdeS5oRp1CcdbOIkzozoaJWcxcB0oMm0zINyb01h8HBqPBgXJWi1M&jBZx=D8b0b
request POST http://www.recovatek.com/hx3a/
request GET http://www.recovatek.com/hx3a/?kfL4bD=fCmUcBRjRsJN2niul11B/xiypSW2fUD8cUjfy08rELK4cGFPgnyxy4j4Y+fYFi5gkgSESZTn&jBZx=D8b0b
request POST http://www.sellingdealsinheels.com/hx3a/
request GET http://www.sellingdealsinheels.com/hx3a/?kfL4bD=ZQONasgLaIqJtl+Y9ynHdAMgHGG3yPHQMSSB3SdTownDFaJtrUUp853ISMl3zW6kC1fHv0WQ&jBZx=D8b0b
request POST http://www.bookbeachchairs.com/hx3a/
request GET http://www.bookbeachchairs.com/hx3a/?kfL4bD=EBC1Cs7uqSFNwkQnGgLKPc+2rIVZ9PU/AWUwkk97HGSV6MybJ9/jFS+r7M72vm+mHjcr9wDF&jBZx=D8b0b
request POST http://www.sxqyws.net/hx3a/
request GET http://www.sxqyws.net/hx3a/?kfL4bD=T9MXgcgL1KL8QuajaJKCENDo6nNTCJSWQpkqYg4zOpZsIFxlmDBTIA+IF+ioP0h6JnMBeNuT&jBZx=D8b0b
request POST http://www.formula-kuhni.com/hx3a/
request POST http://www.freeworldsin.com/hx3a/
request POST http://www.stkify.com/hx3a/
request POST http://www.aksharnewtown.com/hx3a/
request POST http://www.roughcuttavernorder.com/hx3a/
request POST http://www.recovatek.com/hx3a/
request POST http://www.sellingdealsinheels.com/hx3a/
request POST http://www.bookbeachchairs.com/hx3a/
request POST http://www.sxqyws.net/hx3a/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 4208
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 4208
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 12288
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d00000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5192
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00810000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nse53.tmp\h336ss.dll
file C:\Users\test22\AppData\Local\Temp\nse53.tmp\h336ss.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 172.217.25.14
host 59.18.44.14
Process injection Process 4208 called NtSetContextThread to modify thread in remote process 5192
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313248
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000204
process_identifier: 5192
1 0 0
MicroWorld-eScan Gen:Variant.Jaik.45088
FireEye Generic.mg.b2e46b8ad3081ee9
McAfee Artemis!B2E46B8AD308
Cybereason malicious.fb1209
Cyren W32/Injector.AGZ.gen!Eldorado
ESET-NOD32 a variant of Win32/Injector.EPCK
APEX Malicious
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Jaik.45088
Ad-Aware Gen:Variant.Jaik.45088
Emsisoft Gen:Variant.Jaik.45088 (B)
McAfee-GW-Edition Artemis!Trojan
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=85)
Microsoft Program:Win32/Wacapew.C!ml
GData Gen:Variant.Jaik.45088
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZedlaF.34670.au4@a0Gz9mai
ALYac Gen:Variant.Jaik.45088
Ikarus Trojan.NSIS.Agent
Fortinet W32/Injector.EPAI!tr
Qihoo-360 QVM42.0.Malware.Gen