popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ly%E7%99%BB%E9%99%86%E5%99%A82021.exe

Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 2, 2021, 9:09 a.m. Aug. 2, 2021, 9:14 a.m.
Size 2.5MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e4dc1316bde5f058c3eaf297a378f07e
SHA256 6e5a7fcf8c27fb801d08efe579582948fea2eb62f2edf9669350c50eaa91ed71
CRC32 D4FDE379
ssdeep 24576:vIt5+bgJZt6Ay6hHW3BfIOcqCqxEclEappvNo6JOyRyjIm5h/29xNkXt/94IFi1s:8kgAADhHW9PcrclEIrRKmnksR0DfM
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
www.dacui.online
CNAME www.dacui.online.w.kunlungr.com
A 58.218.215.138
58.218.215.138
IP Address Status Action
164.124.101.2 Active Moloch
58.218.215.138 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The Superfetch service is stopping
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: The Superfetch service was stopped successfully.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .LY0
section .LY1
request POST http://www.dacui.online/Index/Key
request POST http://www.dacui.online/Index/Verify
request POST http://www.dacui.online/Index/Key
request POST http://www.dacui.online/Index/Verify
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d30000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02fc0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x736e2000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00bca0e8 size 0x00004228
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00bce310 size 0x00000014
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00bce324 size 0x0000022e
section {u'size_of_data': u'0x00271600', u'virtual_address': u'0x00957000', u'entropy': 7.856163701960325, u'name': u'.LY1', u'virtual_size': u'0x002714d1'} entropy 7.85616370196 description A section with a high entropy has been found
entropy 0.992658730159 description Overall entropy of this PE file is high
cmdline net stop SysMain
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x004ad8d0
service_name: SYSMAIN
control_code: 1
1 1 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.535484
FireEye Generic.mg.e4dc1316bde5f058
McAfee Artemis!E4DC1316BDE5
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_70% (D)
K7GW Trojan ( 7000001c1 )
K7AntiVirus Trojan ( 7000001c1 )
Baidu Win32.Packed.VMProtect.a
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Packed.VMProtect.ABD
APEX Malicious
Paloalto generic.ml
BitDefender Gen:Variant.Bulz.535484
Avast Win32:Trojan-gen
Ad-Aware Gen:Variant.Bulz.535484
Sophos Mal/VMProtBad-A
TrendMicro TROJ_GEN.R01FC0RGV21
McAfee-GW-Edition BehavesLike.Win32.BadFile.vc
Emsisoft Gen:Variant.Bulz.535484 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Black.Gen2
MAX malware (ai score=87)
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Heur!.03250021
Microsoft Program:Win32/Wacapew.C!ml
GData Gen:Variant.Bulz.535484
Cynet Malicious (score: 100)
BitDefenderTheta AI:Packer.FA6D5E691F
ALYac Gen:Variant.Bulz.535484
Malwarebytes Malware.AI.1953969706
TrendMicro-HouseCall TROJ_GEN.R01FC0RGV21
Rising Trojan.Generic@ML.89 (RDML:CEXW7a6fPeqegbKXT9EcEQ)
Yandex Trojan.VMProtect!FJQoQc6zoEk
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/VMProtBad.A!tr
AVG Win32:Trojan-gen
Cybereason malicious.6bde5f
Qihoo-360 Win32/Packed.Black.HgIASZQA