Summary | ZeroBOX

ComparePlus.dll

Lazarus Family UPX Malicious Library PE File DLL OS Processor Check PE32
Category Machine Started Completed
FILE s1_win7_x6401 July 20, 2021, 9:45 a.m. July 20, 2021, 9:47 a.m.
Size 463.9KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 b3a8c88297daecdb9b0ac54a3c107797
SHA256 a881c9f40c1a5be3919cafb2ebe2bb5b19e29f0f7b28186ee1f4b554d692e776
CRC32 75AFF609
ssdeep 12288:6wK18bRRnjb5/DvI4opt3FjOGAlQ1OT3bs/y7n:6wKObRRNDvIpdF/kQ1QbsaT
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Lazarus_Zero - Lazarus Generic Malware
  • IsDLL - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
rundll32+0x137d @ 0x15137d
rundll32+0x1326 @ 0x151326
rundll32+0x1901 @ 0x151901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c7 00 22 00 00 00 b8 d8 b3 d6 73 5d c3 cc cc cc
exception.instruction: mov dword ptr [eax], 0x22
exception.exception_code: 0xc0000005
exception.symbol: getFuncsArray+0x6 getName-0x1a compareplus+0x11d16
exception.address: 0x73d11d16
registers.esp: 3145248
registers.edi: 0
registers.eax: 590434
registers.ebp: 3145248
registers.edx: 4
registers.ebx: 0
registers.esi: 590434
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ad4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72a34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72a34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72a34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72a34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d54000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73770000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72a34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72b12000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da1000
process_handle: 0xffffffff
1 0 0
MicroWorld-eScan Trojan.GenericKD.46589140
CAT-QuickHeal Trojan.Agentb
McAfee RDN/Generic.dx
Cylance Unsafe
Zillya Trojan.Agent.Win32.2282086
Sangfor Trojan.Win32.Agentb.gen
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2C6E4D4
ESET-NOD32 Win32/NukeSped.KE
Kaspersky HEUR:Trojan.Win32.Agentb.gen
BitDefender Trojan.GenericKD.46589140
Avast Win32:Malware-gen
Ad-Aware Trojan.GenericKD.46589140
Sophos Mal/Generic-S
TrendMicro TROJ_FRS.VSNTG521
McAfee-GW-Edition RDN/Generic.dx
FireEye Trojan.GenericKD.46589140
Emsisoft Trojan.GenericKD.46589140 (B)
Ikarus Trojan.Win32.NukeSped
Avira TR/NukeSped.eltin
GData Trojan.GenericKD.46589140
AhnLab-V3 Trojan/Win.Lazardoor.R422302
ALYac Trojan.Agent.475016L
MAX malware (ai score=100)
TrendMicro-HouseCall TROJ_FRS.VSNTG521
MaxSecure Trojan.Malware.9325066.susgen
Fortinet W32/FRS.VSNTG521!tr
AVG Win32:Malware-gen
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.Agentb.HgkASX4A