popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

MT103-150621-PDF.scr

PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 15, 2021, 10:16 a.m. June 15, 2021, 10:23 a.m.
Size 202.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 755f6460de480381eb4e94768fe27c92
SHA256 4558ca0720eed3f8e2554006b53c896b3f6e57a1ab25e62f5914478f2b89e111
CRC32 8879D9AA
ssdeep 3072:cLk395hYXJ2MT4mZdWFeBr3gDcd9CtA375zPK0mpl5QqvfDjirQ5Qky2px7IVt:cQqJ0mZdWEBzdbC2rY0mpHRv7Naa+t
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x47d110
registers.esp: 1638284
registers.edi: 0
registers.eax: 1970484152
registers.ebp: 1638292
registers.edx: 4706576
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 8072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x745e4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x745d4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 47953
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00567900
process_handle: 0xffffffff
3221225477 0
file C:\Users\test22\AppData\Local\Temp\nsgFE01.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nsgFE01.tmp\System.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
host 172.217.25.14
DrWeb Trojan.Loader.838
McAfee Artemis!755F6460DE48
Cyren W32/Ninjector.J.gen!Camelot
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos Generic ML PUA (PUA)
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Tnega!ml
Cynet Malicious (score: 100)
Fortinet W32/Kryptik.J!tr
Process injection Process 8072 called NtSetContextThread to modify thread in remote process 5628
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4509968
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001dc
process_identifier: 5628
1 0 0