Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...
11.13 02:11
ua.exe

Latest News
11.13 04:11
가트너, “AI 데이터센터 40%, 20...
11.13 04:11
미라트 쇼룸, DDP에서 약 1.5만명 방문
11.13 04:11
IBM, AI와 복잡내성 보안 강화한 I...
11.13 04:11
Fake Job Ads and Fake ...
11.13 04:11
노크, 전국 30만 대학생 소통의 장 열어
11.13 04:11
종로 골드게이트, 예물반지용 랩다이아몬드...
11.13 04:11
코오롱베니트, 글로벌 소프트웨어 기업 에...
11.13 04:11
사회복지법인 대한사회복지회, 한양대학교 ...
11.13 04:11
한싹, AI 답변 생성 솔루션 ‘블루러닝...
11.13 04:11
'바툼 시스템 히터' 오는15일 현대홈쇼...

Summary | ZeroBOX

MAL.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 20, 2021, 7:40 a.m.	May 20, 2021, 7:44 a.m.

Size	85.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`10c3c7a5841b1a9bf81362243ad9e7e4`
SHA256	`f41cf2a4faf7d08eb8e8f7a1d83943c9bde8c0c460ac8f52fa7f0ea10280d394`
CRC32	`222E3513`
ssdeep	`768:Q+HIsyH80U8EpkZ9ssctWBUKXu0DrnZ9Y9P8dHkaTgoWEU9D0Vb:fou0UhW2sGWmKuaweuIVb`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

MAL.exe "C:\Users\test22\AppData\Local\Temp\MAL.exe"
1108
- RegAsm.exe "C:\Users\test22\AppData\Local\Temp\MAL.exe"
  1828

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:40 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 20, 2021, 7:41 a.m.	process_identifier: 1108 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:41 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:44 a.m.	process_identifier: 1828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:40 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA May 20, 2021, 7:42 a.m.	service_handle: 0x004e3190 service_type: 48 service_status: 3		0	0