Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 8, 2021, 1:09 p.m.	July 8, 2021, 1:11 p.m.

Size	701.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`051e7c8022b3f9edbb78c6cc9fb6fb98`
SHA256	`5b2d2e7727f30c8d5a91f1b7b8efbf61fa511cd64ef31e9a68cfd0948261b8f6`
CRC32	`BC1F5F55`
ssdeep	`12288:yVQ66KSyqoGwu5AHFFXcBLy6WHdvUFgHLpBNf6vmKKZdMd0X3Aqz:yVQ66X+Gwu5AHFFXcBLy6WHdvUFgHLpp`
Yara	Antivirus - Contains references to security software IsPE32 - (no description) PE_Header_Zero - PE File Signature

adobe (4).exe "C:\Users\test22\AppData\Local\Temp\adobe (4).exe"
2948

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 8, 2021, 1:09 p.m.	stacktrace: gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x755c0d27 CallWindowProcW+0x1b SetRectEmpty-0x38 user32+0x20d4d @ 0x755c0d4d adobe (4)+0x74cd2 @ 0x474cd2 adobe (4)+0x751ce @ 0x4751ce adobe (4)+0x74e09 @ 0x474e09 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 adobe (4)+0x3c1e @ 0x403c1e RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 4e 34 89 4f 04 89 f9 83 c1 48 89 4f 0c 83 c1 exception.instruction: mov ecx, dword ptr [esi + 0x34] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2dcbd48 registers.esp: 1637060 registers.edi: 4980736 registers.eax: 2000419504 registers.ebp: 1637060 registers.edx: 2130566132 registers.ebx: 48021473 registers.esi: 3936034732 registers.ecx: 46776416	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 8, 2021, 1:09 p.m.

stacktrace:

gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x755c0d27
CallWindowProcW+0x1b SetRectEmpty-0x38 user32+0x20d4d @ 0x755c0d4d
adobe (4)+0x74cd2 @ 0x474cd2
adobe (4)+0x751ce @ 0x4751ce
adobe (4)+0x74e09 @ 0x474e09
EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048
BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e
ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981
ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa
ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600
adobe (4)+0x3c1e @ 0x403c1e
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 4e 34 89 4f 04 89 f9 83 c1 48 89 4f 0c 83 c1
exception.instruction: mov ecx, dword ptr [esi + 0x34]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2dcbd48
registers.esp: 1637060
registers.edi: 4980736
registers.eax: 2000419504
registers.ebp: 1637060
registers.edx: 2130566132
registers.ebx: 48021473
registers.esi: 3936034732
registers.ecx: 46776416

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 8, 2021, 1:09 p.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 8, 2021, 1:09 p.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (2 events)

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x0007c7cc

size

0x0000002c

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x0007c7cc

size

0x0000002c

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 8, 2021, 1:09 p.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.MSIL.Crysan.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Johnnie.358690
Qihoo-360	Win32/Trojan.Generic.HwMAYkAA
ALYac	Gen:Variant.Johnnie.358690
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Arcabit	Trojan.Johnnie.D57922
Cyren	W32/VBInject.AFJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FHFO
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Johnnie-9875544-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Johnnie.358690
Avast	Win32:Malware-gen
Rising	HackTool.VBInject!1.6481 (CLASSIC)
Ad-Aware	Gen:Variant.Johnnie.358690
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.VbCrypt.250
McAfee-GW-Edition	BehavesLike.Win32.Trojan.bc
FireEye	Generic.mg.051e7c8022b3f9ed
Emsisoft	Gen:Variant.Johnnie.358690 (B)
SentinelOne	Static AI - Suspicious PE
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Johnnie.358690
McAfee	Artemis!051E7C8022B3
VBA32	Malware-Cryptor.VB.gen.1
Malwarebytes	Malware.AI.3800961425
TrendMicro-HouseCall	TROJ_GEN.R002H09G521
Ikarus	Win32.Outbreak
Fortinet	W32/GenKryptik.FHFO!tr
BitDefenderTheta	Gen:NN.ZevbaF.34790.Rm3@aG8T@soO
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

adobe (4).exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All