popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

3306.exe

UPX Malicious Library Malicious Packer PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 2, 2021, 12:52 p.m. Oct. 2, 2021, 12:56 p.m.
Size 62.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 22858abb5a0f5c76115674d9ef7fe1cc
SHA256 4fe96b4353ad07439307eda82ce0936778a0dd86022532978a7447bfeb75d55a
CRC32 61265410
ssdeep 768:jbz3IhpglwpDEq2m0j6Tf8V4Ie7ZZa3R1fb961vNPrl7sJnCJ0ukN:n4+wpDElm2IAUZZo1fbs1RVsZCJ0H
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
caiyundf.cn
A 103.45.185.68
103.45.185.68
IP Address Status Action
103.45.185.68 Active Moloch
142.250.204.46 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name None
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011828 size 0x000002d0
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document text sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011190 size 0x0000028b
name None language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011770 size 0x000000b6
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 2
password:
display_name: System Remote Data Simulation Layer
filepath: C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "CYSRDSL"
service_name: CYSRDSL
filepath_r: %SystemRoot%\System32\svchost.exe -k "CYSRDSL"
desired_access: 983551
service_handle: 0x002b3fe8
error_control: 0
service_type: 272
service_manager_handle: 0x002b4088
1 2834408 0
host 142.250.204.46
service_name CYSRDSL service_path C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "CYSRDSL"
reg_key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CYSRDSL\Parameters\ServiceDll reg_value C:\Windows\system32\22155843.txt