Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 29, 2021, 10:04 a.m.	Sept. 29, 2021, 10:06 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e66d37e430a767a356d8fdeae27788d3`
SHA256	`37e1958166a5cb3b5d218fc5c1ce9cb7878e4d3b50499e6670d8d22563044502`
CRC32	`976A7C02`
ssdeep	`24576:7bx5ACyRtvPExqgcSSu5bqhD92oK8t7yz5b/UXq60Lnyx2M3Tttxnv:vAVRBPhbSFAhcKtYiq60LnKTVn`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

ppt_82000007451308.exe "C:\Users\test22\AppData\Local\Temp\ppt_82000007451308.exe"
1948

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (50 out of 239 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 10:04 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 29, 2021, 10:04 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02270000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02271000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02274000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02279000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0227a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04440000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04441000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0444b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04491000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04451000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04461000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04481000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04871000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04876000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0487b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00abf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0487c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 29, 2021, 10:04 a.m.	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0487d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ppt_82000007451308.exe tried to sleep 265 seconds, actually delayed analysis time by 265 seconds

Foreign language identified in PE resource (8 events)

name

RT_ICON

language

LANG_KASHMIRI

filetype

PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_NEUTRAL

offset

0x00150880

size

0x0000a9cb

name

RT_ICON

language

LANG_KASHMIRI

filetype

PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_NEUTRAL

offset

0x00150880

size

0x0000a9cb

name

RT_ICON

language

LANG_KASHMIRI

filetype

PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_NEUTRAL

offset

0x00150880

size

0x0000a9cb

name

RT_ICON

language

LANG_KASHMIRI

filetype

PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_NEUTRAL

offset

0x00150880

size

0x0000a9cb

name

RT_DIALOG

language

LANG_KASHMIRI

filetype

data

sublanguage

SUBLANG_NEUTRAL

offset

0x0015b24c

size

0x00000076

name

RT_GROUP_ICON

language

LANG_KASHMIRI

filetype

data

sublanguage

SUBLANG_NEUTRAL

offset

0x0015b2c4

size

0x0000003e

name

RT_VERSION

language

LANG_KASHMIRI

filetype

data

sublanguage

SUBLANG_NEUTRAL

offset

0x0015b304

size

0x00000264

name

RT_MANIFEST

language

LANG_KASHMIRI

filetype

XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

sublanguage

SUBLANG_NEUTRAL

offset

0x0015b568

size

0x000001ea

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00149600', u'virtual_address': u'0x00002000', u'entropy': 7.7294852333936745, u'name': u'.text', u'virtual_size': u'0x00149414'}

entropy

7.72948523339

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0000f800', u'virtual_address': u'0x0014c000', u'entropy': 7.5184633210896985, u'name': u'.rsrc', u'virtual_size': u'0x0000f752'}

entropy

7.51846332109

description

A section with a high entropy has been found

entropy

0.999637681159

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 29, 2021, 10:04 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.e66d37e430a767a3
McAfee	GenericRXQC-VZ!E66D37E430A7
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/Injector.3a7e1b11
Cybereason	malicious.dbe1b2
Cyren	W32/MSIL_Kryptik.FOQ.gen!Eldorado
ESET-NOD32	a variant of MSIL/Injector.VRI
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win32:RATX-gen [Trj]
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.Mardom.C4656510
BitDefenderTheta	Gen:NN.ZemsilF.34170.wn0@aeS!OCpG
Malwarebytes	MachineLearning/Anomalous.95%
AVG	Win32:RATX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

ppt_82000007451308.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All