Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...

Latest News
11.15 03:11
Microfluidic Motors Co...
11.15 03:11
Novel ShrinkLocker ran...
11.15 03:11
Neuberger recommends c...
11.15 03:11
Outmaneuvering Rhysida...
11.15 02:11
The Intersection of Ma...
11.15 02:11
Revisiting Battery Safety
11.15 02:11
Diamond Sports Wins Ap...
11.15 02:11
From risks to resilien...
11.15 02:11
Newly patched Windows ...
11.15 02:11
Chinese targeting of U...

Summary | ZeroBOX

lv.exe

Gen1 Malicious Library UPX Malicious Packer PE File PE32 DLL

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 26, 2021, 9:24 a.m.	July 26, 2021, 9:29 a.m.

Size	554.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`421e541774fdd6972119a0840bc3d3f7`
SHA256	`30231c7dedac2240fd26491f352289c76dc03894687b4654553797129f413de0`
CRC32	`DFD4A37A`
ssdeep	`12288:60gq6fdyZTg1Jjri9ZETbm1N8fAOw7kunelNE1nQS1:1/61ZPri9KeiEbneIl1`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

lv.exe "C:\Users\test22\AppData\Local\Temp\lv.exe"
1120
- 4.exe "C:\Users\test22\AppData\Local\Temp\New Feature\4.exe"
  2564
- vpn.exe "C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe"
  3060

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 26, 2021, 9:24 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74231000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cd4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 1120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74221000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a93000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 2564 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00953000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 26, 2021, 9:24 a.m.	process_identifier: 3060 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (6 events)

file	C:\Program Files (x86)\foler\olader\acppage.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe
file	C:\Program Files (x86)\foler\olader\acledit.dll
file	C:\Program Files (x86)\foler\olader\adprovider.dll
file	C:\Users\test22\AppData\Local\Temp\nsjF2A2.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\nsjF2A2.tmp\UAC.dll
file	C:\Users\test22\AppData\Local\Temp\New Feature\4.exe
file	C:\Users\test22\AppData\Local\Temp\New Feature\vpn.exe