Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...

Latest News
11.15 02:11
The Intersection of Ma...
11.15 02:11
Revisiting Battery Safety
11.15 02:11
Diamond Sports Wins Ap...
11.15 02:11
From risks to resilien...
11.15 02:11
Newly patched Windows ...
11.15 02:11
Chinese targeting of U...
11.15 02:11
Expanded cyberattacks ...
11.15 02:11
Data aggregator breach...
11.15 02:11
Chinese malware attack...
11.15 02:11
American Associated Ph...

Summary | ZeroBOX

fxbggzfdhfgdgn.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 29, 2021, 10:45 a.m.	July 29, 2021, 11:11 a.m.

Size	184.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`fe690cdae7fb62b504be7cdc64cda45e`
SHA256	`4075714cf40071629b9858a706f24bc3544c80b02a69379f1ad9eef2e039968a`
CRC32	`07CA851E`
ssdeep	`1536:0uWzNS11Z63nuN1dUQt+mjJbIdk3O6XSoeqxD:XZq3n6Us1hIeO6iC`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature

fxbggzfdhfgdgn.exe "C:\Users\test22\AppData\Local\Temp\fxbggzfdhfgdgn.exe"
1016

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 29, 2021, 10:45 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 29, 2021, 10:45 a.m.	process_identifier: 1016 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

offset

0x0002e150

size

0x000002f8

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 29, 2021, 10:45 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004b0000 process_handle: 0xffffffff	1	0	0

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/Kryptik.DVQ.gen!Eldorado
ESET-NOD32	a variant of Win32/Injector.EPVQ
APEX	Malicious
MaxSecure	Trojan.Malware.300983.susgen
FireEye	Generic.mg.fe690cdae7fb62b5
Avira	HEUR/AGEN.1143811
AhnLab-V3	Win-Trojan/VBKrypt.RP.X1764
SentinelOne	Static AI - Malicious PE
BitDefenderTheta	Gen:NN.ZevbaF.34050.lm0@a4tI2Chb
Cybereason	malicious.a5595a
Qihoo-360	HEUR/QVM03.0.E41F.Malware.Gen