popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

note866.exe

Malicious Library UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 26, 2021, 2:34 p.m. Oct. 26, 2021, 2:34 p.m.
Size 2.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5 77294635b863561ecd6267711c5222a2
SHA256 b1dd835c2d5caae422469d55c05823f95f649829db8ed2dddc3a4f3e5a228b28
CRC32 3DBD2442
ssdeep 49152:ASXSNLA7IvAVurnKd1MZLGSUs0f/i+94vR0NN:ASD0YVurnKd1MZrUHfK+UR
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
iplogger.org
A 88.99.66.31
88.99.66.31
IP Address Status Action
164.124.101.2 Active Moloch
186.2.171.3 Active Moloch
88.99.66.31 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49201 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49201
88.99.66.31:443 		C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
packer PECompact 2.xx --> BitSum Technologies
resource name PNG
resource name STYLE_XML
resource name None
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 6c ee 7e
exception.symbol: note866+0x1016
exception.instruction: mov dword ptr [eax], ecx
exception.module: note866.exe
exception.exception_code: 0xc0000005
exception.offset: 4118
exception.address: 0x401016
registers.esp: 1638276
registers.edi: 0
registers.eax: 0
registers.ebp: 1638292
registers.edx: 4198400
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://186.2.171.3/seemorebty/il.php?e=note866
request GET http://186.2.171.3/seemorebty/il.php?e=note866
request GET https://iplogger.org/ZdUWq
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00310000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
name PNG language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x004d03c0 size 0x00001623
section {u'size_of_data': u'0x001e3200', u'virtual_address': u'0x00001000', u'entropy': 7.999905905334937, u'name': u'.text', u'virtual_size': u'0x0053b000'} entropy 7.99990590533 description A section with a high entropy has been found
entropy 0.922874880611 description Overall entropy of this PE file is high
host 186.2.171.3
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000520
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
Lionic Trojan.Win32.Passteal.7!c
MicroWorld-eScan Trojan.GenericKD.37863841
FireEye Trojan.GenericKD.37863841
McAfee Artemis!77294635B863
Cylance Unsafe
Sangfor Trojan.Win32.Passteal.qe
K7AntiVirus Password-Stealer ( 0055912f1 )
Alibaba TrojanPSW:Win32/Generic.7673b671
K7GW Password-Stealer ( 0055912f1 )
Cybereason malicious.8eefac
Cyren W32/Agent.DRF.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/PSW.Agent.OHG
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan-Banker.Win32.Passteal.qe
BitDefender Trojan.GenericKD.37863841
Ad-Aware Trojan.GenericKD.37863841
Sophos Mal/Generic-S
DrWeb Trojan.DownLoader43.54254
McAfee-GW-Edition BehavesLike.Win32.Trojan.vc
Emsisoft Trojan.GenericKD.37863841 (B)
MAX malware (ai score=84)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft Trojan.Win32.Agent.ns
Arcabit Trojan.Generic.D241C275
GData Trojan.GenericKD.37863841
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R445505
BitDefenderTheta Gen:NN.ZexaF.34236.ck0aaSLsSZl
ALYac Trojan.GenericKD.37863841
Malwarebytes Spyware.PasswordStealer
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002H0DJO21
Fortinet W32/Agent.OLG!tr.pws
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]