popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

atualiza_tec.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 16, 2021, 9:55 a.m. April 16, 2021, 9:58 a.m.
Size 534.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a6ac13ea37c979e7623b73b8ac8670eb
SHA256 c41e59e5e3c85ccf7f88f316b7ed81659be1864e2c9c87da5c881cb23d291cfc
CRC32 01413714
ssdeep 12288:tusISQoVSFM0oTHCbi+dY/n4VDY1SSjxnsnd+:MLcEFzeIxcn4m1S2snd
Yara
  • PE_Header_Zero - PE File Signature Zero
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • network_ssl - Communications over SSL
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • win_registry - Affect system registries
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • borland_delphi - Borland Delphi 2.0 - 7.0 / 2005 - 2007

Name Response Post-Analysis Lookup
www.technoinfo.com.br
CNAME technoinfo.com.br
A 177.47.177.54
177.47.177.54
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
177.47.177.54 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 177.47.177.54:80 -> 192.168.56.102:49806 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
atualiza_tec+0x58b04 @ 0x458b04
atualiza_tec+0x58a52 @ 0x458a52
atualiza_tec+0x58a13 @ 0x458a13
atualiza_tec+0x617c5 @ 0x4617c5
atualiza_tec+0x6c90f @ 0x46c90f
atualiza_tec+0x6cc25 @ 0x46cc25
atualiza_tec+0x6cdd6 @ 0x46cdd6
atualiza_tec+0x6bf61 @ 0x46bf61
atualiza_tec+0x6f201 @ 0x46f201
atualiza_tec+0x6f029 @ 0x46f029
atualiza_tec+0x39d78 @ 0x439d78
atualiza_tec+0x399f3 @ 0x4399f3
atualiza_tec+0x1bffa @ 0x41bffa
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetWindow+0x3f0 SendMessageW-0x1b user32+0x1965e @ 0x755b965e
SendMessageA+0x4c GetAppCompatFlags-0x72 user32+0x2617a @ 0x755c617a
atualiza_tec+0x4c22d @ 0x44c22d
atualiza_tec+0x39c85 @ 0x439c85
atualiza_tec+0x1bffa @ 0x41bffa
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
atualiza_tec+0x50515 @ 0x450515
atualiza_tec+0x39d78 @ 0x439d78
atualiza_tec+0x399f3 @ 0x4399f3
atualiza_tec+0x1bffa @ 0x41bffa
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
atualiza_tec+0x36e2b @ 0x436e2b
atualiza_tec+0x39d78 @ 0x439d78
atualiza_tec+0x36bfb @ 0x436bfb
atualiza_tec+0x398cc @ 0x4398cc
atualiza_tec+0x39937 @ 0x439937
atualiza_tec+0x39d78 @ 0x439d78
atualiza_tec+0x36bfb @ 0x436bfb
atualiza_tec+0x35978 @ 0x435978
atualiza_tec+0x6ff60 @ 0x46ff60
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1634480
registers.edi: 1634668
registers.eax: 1634480
registers.ebp: 1634560
registers.edx: 0
registers.ebx: 4559452
registers.esi: 10060
registers.ecx: 7
1 0 0
request GET http://www.technoinfo.com.br/softwares/tcommerce_atual/Tcommerce.exe
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 5776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x000845fc size 0x00000ea8
name RT_ICON language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x000845fc size 0x00000ea8
name RT_ICON language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x000845fc size 0x00000ea8
name RT_GROUP_ICON language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x0008a2ec size 0x00000030
host 172.217.25.14
Bkav W32.AIDetectVM.malware2
FireEye Generic.mg.a6ac13ea37c979e7
APEX Malicious
Paloalto generic.ml
McAfee-GW-Edition BehavesLike.Win32.Worm.hh
McAfee Artemis!A6AC13EA37C9
VBA32 TScope.Trojan.Delf
eGambit Unsafe.AI_Score_99%
BitDefenderTheta Gen:NN.ZelphiF.34634.HGW@a4ODLjoG
Panda Trj/GdSda.A