Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

MAL.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 20, 2021, 7:40 a.m.	May 20, 2021, 7:44 a.m.

Size	85.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`10c3c7a5841b1a9bf81362243ad9e7e4`
SHA256	`f41cf2a4faf7d08eb8e8f7a1d83943c9bde8c0c460ac8f52fa7f0ea10280d394`
CRC32	`222E3513`
ssdeep	`768:Q+HIsyH80U8EpkZ9ssctWBUKXu0DrnZ9Y9P8dHkaTgoWEU9D0Vb:fou0UhW2sGWmKuaweuIVb`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

MAL.exe "C:\Users\test22\AppData\Local\Temp\MAL.exe"
1108
- RegAsm.exe "C:\Users\test22\AppData\Local\Temp\MAL.exe"
  1828

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:40 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 20, 2021, 7:41 a.m.	process_identifier: 1108 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:41 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:44 a.m.	process_identifier: 1828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:40 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA May 20, 2021, 7:42 a.m.	service_handle: 0x004e3190 service_type: 48 service_status: 3		0	0