Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

wj3.png

UPX Malicious Library PE File DLL OS Processor Check PE32

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 15, 2021, 12:33 p.m.	Aug. 15, 2021, 12:37 p.m.

Size	160.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`9dc3016597dfa1aa2980b346d16bebec`
SHA256	`c2ffe1c90985faa77498be75bb418791dec8966a610bdd5c81d3d3f6e4404701`
CRC32	`8548C87F`
ssdeep	`3072:XRIHgpslVQSyEJxdB4t6ShtVNlCExwwg9fpyKMoutsmuQO:XRIHgpsVQShMtTEEepyKMoSs`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\wj3.png.dll,Init
564
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\wj3.png.dll,UnInit
2480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\wj3.png.dll,
1744

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 15, 2021, 12:33 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:33 p.m.			0	0

The executable uses a known packer (1 event)

packer

Armadillo v1.xx - v2.xx

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10012000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f10000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73791000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10012000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f10000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73791000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 15, 2021, 12:33 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee1000 process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0002b058

size

0x00000294

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.9dc3016597dfa1aa
McAfee	Artemis!9DC3016597DF
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cyren	W32/Heuristic-Blackmoon!Eldorado
ESET-NOD32	a variant of Win32/Packed.BlackMoon.A potentially unwanted
APEX	Malicious
ClamAV	Win.Dropper.Tiggre-9845940-0
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	Artemis!Trojan
AhnLab-V3	Malware/Win32.Generic.C2339326
ALYac	Gen:Variant.Graftor.704303
Malwarebytes	Malware.AI.2652750484
Fortinet	Riskware/Blackmoon
BitDefenderTheta	Gen:NN.ZedlaF.34058.ku8@aiyBNafb