Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 1, 2021, 3:01 p.m.	Oct. 1, 2021, 3:03 p.m.

Size	382.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`bcde42776b0996bd7ec03be666fbd8c3`
SHA256	`553251f27280c259bd23c2c7c9bcdc41bed1c3cf0e8326331c9b1397574e271c`
CRC32	`D18FBD50`
ssdeep	`6144:68LxBbme9sEst/Vgdlkk4BAfzmZoxqE/T8uhidhA:MPv/Rs4he5ghA`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) NSIS_Installer - Null Soft Installer

サンプルカタログ2021.exe "C:\Users\test22\AppData\Local\Temp\サンプルカタログ2021.exe"
2284

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 1, 2021, 3:01 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Oct. 1, 2021, 3:01 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18 MessageBoxIndirectA+0x94 MessageBoxIndirectW-0x38 user32+0x6fc65 @ 0x751cfc65 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73dc3f46 registers.esp: 1636732 registers.edi: 0 registers.eax: 1943813958 registers.ebp: 1636772 registers.edx: 0 registers.ebx: 0 registers.esi: 1943813958 registers.ecx: 8457576	1
__exception__ Oct. 1, 2021, 3:01 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18 MessageBoxIndirectA+0x94 MessageBoxIndirectW-0x38 user32+0x6fc65 @ 0x751cfc65 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73dc3f46 registers.esp: 1636732 registers.edi: 0 registers.eax: 1943813958 registers.ebp: 1636772 registers.edx: 0 registers.ebx: 0 registers.esi: 1943813958 registers.ecx: 8457576	1
__exception__ Oct. 1, 2021, 3:01 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x74d1d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x74d1964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x74d04d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x74d06f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x74d0e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x74d06002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x74d05fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x74d049e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x74d05a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77579a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77598f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77598e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76377a25 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x74d33ef4 registers.esp: 1637236 registers.edi: 0 registers.eax: 4792416 registers.ebp: 1637264 registers.edx: 1 registers.ebx: 0 registers.esi: 6192744 registers.ecx: 1943680380	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 1, 2021, 3:01 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxIndirectA+0x94 MessageBoxIndirectW-0x38 user32+0x6fc65 @ 0x751cfc65

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x73dc3f46
registers.esp: 1636732
registers.edi: 0
registers.eax: 1943813958
registers.ebp: 1636772
registers.edx: 0
registers.ebx: 0
registers.esi: 1943813958
registers.ecx: 8457576

__exception__

Oct. 1, 2021, 3:01 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75176de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75176e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7755011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7519cf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x751cf73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x751cfa18
MessageBoxIndirectA+0x94 MessageBoxIndirectW-0x38 user32+0x6fc65 @ 0x751cfc65

__exception__

Oct. 1, 2021, 3:01 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x74d1d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x74d1964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x74d04d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x74d06f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x74d0e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x74d06002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x74d05fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x74d049e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x74d05a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77579a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77598f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77598e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76377a25

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x74d33ef4
registers.esp: 1637236
registers.edi: 0
registers.eax: 4792416
registers.ebp: 1637264
registers.edx: 1
registers.ebx: 0
registers.esi: 6192744
registers.ecx: 1943680380

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.Win32.Noon.l!c
MicroWorld-eScan	Zum.Androm.1
McAfee	Artemis!BCDE42776B09
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Arcabit	Zum.Androm.1
Cyren	W32/Injector.ALY.gen!Eldorado
Symantec	Packed.Generic.606
ESET-NOD32	a variant of Win32/Injector.EQFA
APEX	Malicious
Avast	NSIS:PWSX-gen [Trj]
Kaspersky	UDS:Trojan-Spy.Win32.Noon.gen
BitDefender	Zum.Androm.1
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.fc
FireEye	Generic.mg.bcde42776b0996bd
Emsisoft	Zum.Androm.1 (B)
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Woreflint.A!cl
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Zum.Androm.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4662719
Malwarebytes	Malware.AI.4104074712
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/Injector.EQDZ!tr
AVG	NSIS:PWSX-gen [Trj]

サンプルカタログ2021.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All