Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 6, 2021, 1:28 p.m.	Oct. 6, 2021, 1:30 p.m.

Size	3.1MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`3c4bb0d8ea06d2b95ee937a82a860d69`
SHA256	`5368d720c17234fa4aac42b20464b7d0a0fb02436a67dd65d088f3488ece563f`
CRC32	`407F5FBF`
ssdeep	`24576:50l9FjBRhJQ06bwIsNdvh+RB8dBxw9QVxiFaDxuLrPQY+/voV+VjHd976Dr7RMyS:58zYUJmWdM5SgQmfRDk7`
Yara	PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware IsPE32 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description)

new.exe "C:\Users\test22\AppData\Local\Temp\new.exe"
1608

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
192.162.242.94	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 6, 2021, 1:28 p.m.			0	0
IsDebuggerPresent Oct. 6, 2021, 1:28 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 6, 2021, 1:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00578b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 1:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00578b90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 1:28 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00578c10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 6, 2021, 1:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.themida
section	14" IPS
section	Asus Exp

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	IMAGE_FILE
resource name	RTF_FILE

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Oct. 6, 2021, 1:28 p.m.	stacktrace: new+0x2ee6c0 @ 0x11be6c0 new+0x2ee76f @ 0x11be76f exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 c5 a2 8d 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 2946912 registers.edi: 16039936 registers.eax: 2946912 registers.ebp: 2946992 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2002482219 registers.ecx: 2560622592	1
__exception__ Oct. 6, 2021, 1:28 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 a6 5f e5 ff exception.symbol: new+0x32ec63 exception.instruction: in eax, dx exception.module: new.exe exception.exception_code: 0xc0000096 exception.offset: 3337315 exception.address: 0x11fec63 registers.esp: 2947032 registers.edi: 17147620 registers.eax: 1750617430 registers.ebp: 16039936 registers.edx: 22614 registers.ebx: 15532032 registers.esi: 17160057 registers.ecx: 20	1
__exception__ Oct. 6, 2021, 1:28 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: new+0x32ecd7 exception.instruction: in eax, dx exception.module: new.exe exception.exception_code: 0xc0000096 exception.offset: 3337431 exception.address: 0x11fecd7 registers.esp: 2947032 registers.edi: 17147620 registers.eax: 1447909480 registers.ebp: 16039936 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 17160057 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 126 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76123000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76373000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7517f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75188000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76784000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76373000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76377000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76374000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7639c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76788000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7638c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76375000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 1:28 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7677c000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (8 events)

section

{u'size_of_data': u'0x00015c00', u'virtual_address': u'0x00002000', u'entropy': 7.9963510462751595, u'name': u' ', u'virtual_size': u'0x00036000'}

entropy

7.99635104628

description