Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 6, 2021, 10:35 a.m.	May 6, 2021, 10:40 a.m.

Size	385.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`96764a0a62e66a147a3d4db0e59a6e34`
SHA256	`9663dc275239aa93ceccedae7a0d54e10def18dd177d231264a323a4175a23d4`
CRC32	`BD260B49`
ssdeep	`12288:Kas/PVuNmL/dJ4OrQS+Q/F+Dgn91ZmkNE+yp:tNmhJ4OrQSfdwU9PmkNE+y`
Yara	IsPE64 - (no description) OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature

rest.exe "C:\Users\test22\AppData\Local\Temp\rest.exe"
4892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 6, 2021, 10:35 a.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AFX_DIALOG_LAYOUT

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 6, 2021, 10:35 a.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c56000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 6, 2021, 10:35 a.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c5a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 6, 2021, 10:35 a.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c63000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 6, 2021, 10:35 a.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c66000 process_handle: 0xffffffffffffffff	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Cynet	Malicious (score: 100)
McAfee	Artemis!96764A0A62E6
APEX	Malicious
Paloalto	generic.ml
McAfee-GW-Edition	BehavesLike.Win64.Dropper.fh
FireEye	Generic.mg.96764a0a62e66a14
Fortinet	PossibleThreat.PALLAS.H
CrowdStrike	win/malicious_confidence_80% (W)

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0004e400', u'virtual_address': u'0x00001000', u'entropy': 6.886500185018278, u'name': u'.text', u'virtual_size': u'0x0004e230'}

entropy

6.88650018502

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00003a00', u'virtual_address': u'0x0005c000', u'entropy': 7.2941549537391905, u'name': u'.data', u'virtual_size': u'0x00004b60'}

entropy

7.29415495374

description

A section with a high entropy has been found

entropy

0.852864583333

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData May 6, 2021, 10:35 a.m.	buffer: 01ca0431 fdb0c77c.01ca0431 fec9a6f8.TEST22-PC.7c6024ad hash_handle: 0x000000000014bc00 flags: 0	1	1	0

rest.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All