Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 25, 2021, 2:58 p.m.	June 25, 2021, 3:02 p.m.

Size	3.8MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`63c173c494e79d63ef61a432fed6a7dd`
SHA256	`7a92342da6840a0bc0901205b44b91ab861f05c91a9f920fb856d676c6a7fc96`
CRC32	`ACDF70FF`
ssdeep	`98304:pPUXmPlJ8b5Fl1u1p2a6ZPirXOCtwA/i2KeobSSin3253C6fM2Z:psX48V26PireC7i2roin325y6x`
Yara	Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description) PE_Header_Zero - PE File Signature

svhost.exe "C:\Users\test22\AppData\Local\Temp\svhost.exe"
4656

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 2:57 p.m.			0	0
IsDebuggerPresent June 25, 2021, 2:57 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey June 25, 2021, 2:58 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ca770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 2:58 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ca730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 25, 2021, 2:58 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006ca730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2021, 2:57 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:57 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:58 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:58 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:58 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 2:58 p.m.	process_identifier: 4656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x003c6a00', u'virtual_address': u'0x00002000', u'entropy': 7.999931818430216, u'name': u'.text', u'virtual_size': u'0x003c6904'}

entropy

7.99993181843

description

A section with a high entropy has been found

entropy

0.999483003748

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Elastic	malicious (high confidence)
ClamAV	Win.Packed.Razy-7334624-0
CAT-QuickHeal	Backdoor.MSIL
McAfee	PWS-FCUT!63C173C494E7
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056052a1 )
Alibaba	Backdoor:MSIL/NanoCore.c5cd235a
K7GW	Trojan ( 0056052a1 )
Cybereason	malicious.494e79
Arcabit	Trojan.Razy.D8B711
Cyren	W32/Azorult.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.UHV
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Gen:Variant.Razy.571153
MicroWorld-eScan	Gen:Variant.Razy.571153
Avast	Win32:CrypterX-gen [Trj]
Tencent	Msil.Backdoor.Bladabindi.Wpjl
Ad-Aware	Gen:Variant.Razy.571153
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Agent.vnepq@0
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject3.30759
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DFK21
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
FireEye	Generic.mg.63c173c494e79d63
Emsisoft	Gen:Variant.Razy.571153 (B)
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.Gen
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:MSIL/NanoCore.DHB!MTB
AegisLab	Trojan.MSIL.Bladabindi.m!c
ZoneAlarm	HEUR:Backdoor.MSIL.Bladabindi.gen
GData	Gen:Variant.Razy.571153
AhnLab-V3	Trojan/Win32.RL_Generic.C3447461
Acronis	suspicious
VBA32	TScope.Trojan.MSIL
ALYac	Gen:Variant.Razy.571153
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.Generic
TrendMicro-HouseCall	TROJ_GEN.R002C0DFK21
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.SZH!tr

svhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All