Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 8, 2021, 9:59 a.m.	June 8, 2021, 10:16 a.m.

Size	18.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`7e69d9b8cf9b27f9b918736123267086`
SHA256	`7f9995e4c63c57c0326bb3c9a03bcc17ff42d1be9ba5b854e18e163ae3efc812`
CRC32	`2F3D9F70`
ssdeep	`393216:HEP2i6Mzb3OWvST1aaw2QYjRDs9c01RwVC3VsqfZOTeecf8ad:HlMP3JaT1656RDPDCFGTeZd`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

Dota 2 Offline Launcher + Emu 06212019.exe "C:\Users\test22\AppData\Local\Temp\Dota 2 Offline Launcher + Emu 06212019.exe"
7724

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 8, 2021, 9:59 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73871000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72711000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71fc1000 process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 8, 2021, 9:59 a.m.	process_identifier: 7724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef90000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00046e00', u'virtual_address': u'0x0004e000', u'entropy': 7.7297315639665385, u'name': u'.rsrc', u'virtual_size': u'0x00046c04'}

entropy

7.72973156397

description

A section with a high entropy has been found

entropy

0.618995633188

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

FireEye	Trojan.GenericKD.41393153
CAT-QuickHeal	Trojan.Occamy
ALYac	Trojan.GenericKD.41393153
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Riskware.Win32.Gamech.1!c
Sangfor	Trojan.Win32.Occamy.C
K7AntiVirus	Trojan ( 005009671 )
Alibaba	Trojan:Win32/Tiggre.1b7c0ff3
K7GW	Trojan ( 005009671 )
Cybereason	malicious.8cf9b2
Arcabit	Trojan.Generic.D2779C01
Cyren	W32/AutoIt.EZ.gen!Eldorado
ESET-NOD32	a variant of Win32/Packed.Themida.HFK
APEX	Malicious
Paloalto	generic.ml
BitDefender	Trojan.GenericKD.41393153
NANO-Antivirus	Trojan.Win32.StartPage1.frtigt
Avast	Win32:Trojan-gen
Rising	Malware.Heuristic!ET#95% (RDMK:cmRtazrDBynQaUHdci0WIVlOjxhP)
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R002C0DBH21
McAfee-GW-Edition	Artemis
Emsisoft	Trojan.GenericKD.41393153 (B)
Ikarus	Trojan.Win32.Themida
Webroot	W32.Trojan.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.304B330
Gridinsoft	Trojan.Win32.Packed.ns
Microsoft	Trojan:Win32/Occamy.C7F
GData	Trojan.GenericKD.41393153
McAfee	Artemis!7E69D9B8CF9B
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Malware.AI.1448680080
TrendMicro-HouseCall	TROJ_GEN.R002C0DBH21
Yandex	Trojan.Themida!xgqxltXy9SM
MaxSecure	Trojan.Malware.74750423.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Trojan-gen

Dota 2 Offline Launcher + Emu 06212019.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All