Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 28, 2021, 1:30 p.m.	July 28, 2021, 1:32 p.m.

Size	1.3MB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`028e4fe5858806375cef3fe66b45b5f8`
SHA256	`40f219a36486262df19e84e30da1b49e1eb0f9af1741afb69e6f28a22e0029ea`
CRC32	`AF97E7DC`
ssdeep	`24576:g1x7AHiA9aU2CzIMTF1z/uGgWwHmpKi6uHzJG3IAdZNc7hE4Pk8+2FBIFG5EL:iPAAFCzIMTKGpKi6uHzJG3IAdZNc7hEF`
PDB Path	C:\Users\neymar\repos\document(4.5)\document\obj\Release\document.pdb
Yara	IsPE32 - (no description) Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature NPKI_Zero - File included NPKI Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Conf Pts.pdf _ _ _.pdf.exe "C:\Users\test22\AppData\Local\Temp\Conf Pts.pdf _ _ _.pdf.exe"
760
- AcroRd32.exe "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\test22\AppData\Roaming\file.pdf"
  2176
  - Adobe_Updater.exe "C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -doActionAppID=reader9rdr-en_US
    2452
  - Adobe_Updater.exe "C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=1 -AU_DISPLAY_LANG=en_US -AU_LAUNCH_APPID=reader9rdr-en_US
    3060
explorer.exe C:\Windows\Explorer.EXE
1248

Name	Response	Post-Analysis Lookup
swupmf.adobe.com	CNAME ssl.adobe.com.edgekey.net CNAME e4578.dscb.akamaiedge.net A 23.212.12.57 A 23.201.36.139	23.201.36.139

IP Address	Status	Action
164.124.101.2	Active	Moloch
23.201.36.139	Active	Moloch
23.212.12.57	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2021, 1:30 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:30 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:30 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:30 p.m.			0	0
IsDebuggerPresent July 28, 2021, 1:30 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA July 28, 2021, 1:30 p.m.	buffer: File Exsist console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\neymar\repos\document(4.5)\document\obj\Release\document.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 28, 2021, 1:30 p.m.		1	1	0

Performs some HTTP requests (2 events)

request	GET http://swupmf.adobe.com/manifest/60/win/reader9rdr-en_US.upd
request	GET http://swupmf.adobe.com/manifest/60/win/AdobeUpdater.upd

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73552000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:30 p.m.	process_identifier: 2176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71763000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 28, 2021, 1:31 p.m.	process_identifier: 1248 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 28, 2021, 1:31 p.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73552000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\file.pdf

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\AddIns\Windows Module Installr.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Roaming\file.pdf

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\AddIns\Windows Module Installr.exe

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win-module

reg_value

C:\Users\test22\AppData\Roaming\Microsoft\AddIns\Windows Module Installr.exe

One or more non-whitelisted processes were created (2 events)

parent_process	acrord32.exe				martian_process	"C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=1 -AU_DISPLAY_LANG=en_US -AU_LAUNCH_APPID=reader9rdr-en_US
parent_process	acrord32.exe				martian_process	"C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -doActionAppID=reader9rdr-en_US

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.MSIL.Crypt.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46410259
ALYac	Trojan.MSIL.Crypt.gen
Cylance	Unsafe
Zillya	Trojan.Crypt.Win32.71564
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0057ece81 )
Alibaba	Trojan:Win32/Kryptik.2747508d
K7GW	Trojan ( 0057ece81 )
Cybereason	malicious.af7821
Arcabit	Trojan.Generic.D2C42A13
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FGE
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.46410259
NANO-Antivirus	Trojan.Win32.Crypt.ixcrwf
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.46410259
Sophos	Generic ML PUA (PUA)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0WF421
McAfee-GW-Edition	GenericRXPF-ZV!028E4FE58588
FireEye	Generic.mg.028e4fe585880637
Emsisoft	Trojan.GenericKD.46410259 (B)
Ikarus	Trojan.Crypt
Jiangmin	Trojan.MSIL.aalwq
Avira	TR/Kryptik.fizdh
eGambit	Unsafe.AI_Score_100%
Microsoft	Backdoor:Win32/Bladabindi!ml
GData	Trojan.GenericKD.46410259
Cynet	Malicious (score: 99)
McAfee	GenericRXPF-ZV!028E4FE58588
MAX	malware (ai score=88)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.1753008988
TrendMicro-HouseCall	TROJ_GEN.R002C0WF421
Tencent	Msil.Trojan.Crypt.Dva
Yandex	Trojan.Crypt!coA6J5ieOJM
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.11716371.susgen
Fortinet	Malicious_Behavior.SB
BitDefenderTheta	Gen:NN.ZemsilF.34050.rn0@aqi!XTb
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.Crypt.HgIASVsA

Conf Pts.pdf _ _ _.pdf.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All