Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 9, 2021, 5:13 p.m.	Aug. 9, 2021, 5:15 p.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5	`d20ea08fef3b921c8f7c716f29281110`
SHA256	`9369fb712545f6b6fec5fbf8b1dd228e57ca7899933bbe354b7c4351c8700c99`
CRC32	`2F320992`
ssdeep	`24576:5FIAHcjqpyjJ/IeUz5nmerq425WIuz+oaJiWEUtsoB+NaMUc:Lr8KyjVIe0n25W7z+oaHEUtsoB81`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

readerdc_en_ka_cra_install.exe "C:\Users\test22\AppData\Local\Temp\readerdc_en_ka_cra_install.exe"
2072
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
get.adobe.com	CNAME get.wip4.adobe.com A 192.147.130.63	193.104.215.66

IP Address	Status	Action
164.124.101.2	Active	Moloch
192.147.130.63	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49201 -> 192.147.130.63:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 192.147.130.63:443	C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1	C=US, ST=California, L=San Jose, O=Adobe Inc., CN=get.adobe.com	05:d9:ed:4e:4e:df:9e:c6:d3:f9:e3:93:de:3c:cf:6b:d1:57:a3:20

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 9, 2021, 4:06 p.m.		1	1	0

The executable uses a known packer (1 event)

packer

PECompact 2.xx --> BitSum Technologies

The file contains an unknown PE resource name possibly indicative of a packer (6 events)

resource name	CONFIG
resource name	DICTIONARY
resource name	EXE
resource name	GIF
resource name	PNG
resource name	SC

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 9, 2021, 4:06 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 db a7 bb exception.symbol: readerdc_en_ka_cra_install+0x1016 exception.instruction: mov dword ptr [eax], ecx exception.module: readerdc_en_ka_cra_install.exe exception.exception_code: 0xc0000005 exception.offset: 4118 exception.address: 0x1241016 registers.esp: 3669692 registers.edi: 0 registers.eax: 0 registers.ebp: 3669708 registers.edx: 19140608 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://get.adobe.com/reader/webservices/adm/?cname=readerdc_en_ka_install.exe&bname=readerdc&site=live&type=install&language=kr

Allocates read-write-execute memory (usually to unpack itself) (50 out of 129 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00260000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72642000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fc9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fca000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03fca000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Aug. 9, 2021, 4:07 p.m.	total_number_of_free_bytes: 13725364224 free_bytes_available: 13725364224 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 event)

Jiangmin

Trojan.Generic.eqmyj

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 9, 2021, 4:06 p.m.	process_identifier: 2072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x03fc0000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 9, 2021, 4:06 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00120e00', u'virtual_address': u'0x00001000', u'entropy': 7.999821419920657, u'name': u'.text', u'virtual_size': u'0x00440000'}

entropy

7.99982141992

description

A section with a high entropy has been found

entropy

0.979652395083

description

Overall entropy of this PE file is high

readerdc_en_ka_cra_install.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All