popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

abb01.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 27, 2021, 9:58 a.m. Oct. 27, 2021, 10:07 a.m.
Size 564.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 05c21bf3df38d5b8365db71d94dbca37
SHA256 776df245d497af81c0e57fb7ef763c8b08a623ea044da9d79aa3b381192f70e2
CRC32 C700EB1A
ssdeep 12288:ZgdncS3vl2J8aN/EYA3lxI51aU0xLNoSrdhBWaCBKzfgE9AdORCjdza:Zgdnc6l+8m/ER7I51aU0RKSrdjWaqKzB
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49179 -> 104.21.48.190:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 104.21.48.190:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 104.21.48.190:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 66.235.200.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 66.235.200.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 66.235.200.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.217.31.243:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.217.31.243:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.217.31.243:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 195.24.68.30:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 195.24.68.30:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 195.24.68.30:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 198.187.31.159:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 198.187.31.159:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 198.187.31.159:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 183.90.231.50:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 183.90.231.50:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 183.90.231.50:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.234.182.39:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.234.182.39:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.234.182.39:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 162.241.218.205:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 162.241.218.205:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 162.241.218.205:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

section .xxrfn
packer Armadillo v1.71
suspicious_features GET method with no useragent header suspicious_request GET http://www.punkidz.com/xzes/?Kdvl=rzqcJvjlgSW5Q0DcIIC8xd++pVURv744ENb9aTZyPenicGvfgL24Ud0ynRSTOJQXBUt7w4JB&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.publiccoins.online/xzes/?Kdvl=VW6AQLcnjxoI7jrxDei1g2cODa3ue2eSFsZ4Bvo9DMyQyK8UAjcUFoPJ8IfPQZF1RDPYIp/Z&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.theravewizards.com/xzes/?Kdvl=hsby6OIGcqifg7QfYLSyJdZ7YeDc2IcIgsU+0vl3XqAOvbSXWpzKVJM6PZuB2eHAu9gllUpH&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.bestplacementconsultancy.com/xzes/?Kdvl=LjnthlTuvRl4J+3EIJ9NP1/gRJUgaULyYZVaExJaoM7uisdc1HZlEM0fi29oNoOz30dzFEUW&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.coalitionloop.com/xzes/?Kdvl=sVc4hg8Nb35a1Qv00Jvuyl/wkeTMhydkmRbldsgA1PWAcLBgfFlJh6yqTVpSuz5X8HcTsuQ7&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.joannhydeyoga.com/xzes/?Kdvl=M74vbXcjuii9CfP4+YoAkrjESC9Z5XZA/+idMnJLcA1l+40jQcdiWeACfFgfibc/BPlrFTVI&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.alphaore.com/xzes/?Kdvl=4eNc2sSPq0I3hKWHlTSoHHBaaA6Q4rCJrKGoZ0/NjQeIUxPu2TRevZPQl0/5uQYKhlbicKS0&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.7looks-mocha-totalbeauty.com/xzes/?Kdvl=N6kvuAW+pCGZGgyc93Dxm1bATb9xJ8kGsAh+h2nj/e1BNDsoH7tPsC1FoxTYrwS+AS0aA/4N&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--80akukchh.xn--80asehdb/xzes/?Kdvl=CYE3a7bRRPoZ8oLCQIn7MUnG5eL5n4hmaAvMM6ZOb9duInsoaLpTWfgE2J3oFykNq7tVuO80&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.distressedthenblessed.com/xzes/?Kdvl=qta2XgKQK0sYIuKkmdNCsYOZQAr8lLiHkRPEQ6p0qzzA/zCHqYc5ezSCSmHJ8lrWarA+AXEj&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.printyourdays.com/xzes/?Kdvl=WvVdSYazqKi8GE8+azEVjLioWRcomDeCwGXpfuOsOesbk9wXqWr6PQqFFZj71fIVZO7r9iJc&ndidbP=U48Ho
suspicious_features GET method with no useragent header suspicious_request GET http://www.captekbrasil.com/xzes/?Kdvl=nm3KboQC3LfSgL/zvgWiiAhLuySCjSAIrKPwMPaNYLQTgNUrE1tMoNUDfMG3u5xrJqSESYJN&ndidbP=U48Ho
request GET http://www.punkidz.com/xzes/?Kdvl=rzqcJvjlgSW5Q0DcIIC8xd++pVURv744ENb9aTZyPenicGvfgL24Ud0ynRSTOJQXBUt7w4JB&ndidbP=U48Ho
request GET http://www.publiccoins.online/xzes/?Kdvl=VW6AQLcnjxoI7jrxDei1g2cODa3ue2eSFsZ4Bvo9DMyQyK8UAjcUFoPJ8IfPQZF1RDPYIp/Z&ndidbP=U48Ho
request GET http://www.theravewizards.com/xzes/?Kdvl=hsby6OIGcqifg7QfYLSyJdZ7YeDc2IcIgsU+0vl3XqAOvbSXWpzKVJM6PZuB2eHAu9gllUpH&ndidbP=U48Ho
request GET http://www.bestplacementconsultancy.com/xzes/?Kdvl=LjnthlTuvRl4J+3EIJ9NP1/gRJUgaULyYZVaExJaoM7uisdc1HZlEM0fi29oNoOz30dzFEUW&ndidbP=U48Ho
request GET http://www.coalitionloop.com/xzes/?Kdvl=sVc4hg8Nb35a1Qv00Jvuyl/wkeTMhydkmRbldsgA1PWAcLBgfFlJh6yqTVpSuz5X8HcTsuQ7&ndidbP=U48Ho
request GET http://www.joannhydeyoga.com/xzes/?Kdvl=M74vbXcjuii9CfP4+YoAkrjESC9Z5XZA/+idMnJLcA1l+40jQcdiWeACfFgfibc/BPlrFTVI&ndidbP=U48Ho
request GET http://www.alphaore.com/xzes/?Kdvl=4eNc2sSPq0I3hKWHlTSoHHBaaA6Q4rCJrKGoZ0/NjQeIUxPu2TRevZPQl0/5uQYKhlbicKS0&ndidbP=U48Ho
request GET http://www.7looks-mocha-totalbeauty.com/xzes/?Kdvl=N6kvuAW+pCGZGgyc93Dxm1bATb9xJ8kGsAh+h2nj/e1BNDsoH7tPsC1FoxTYrwS+AS0aA/4N&ndidbP=U48Ho
request GET http://www.xn--80akukchh.xn--80asehdb/xzes/?Kdvl=CYE3a7bRRPoZ8oLCQIn7MUnG5eL5n4hmaAvMM6ZOb9duInsoaLpTWfgE2J3oFykNq7tVuO80&ndidbP=U48Ho
request GET http://www.distressedthenblessed.com/xzes/?Kdvl=qta2XgKQK0sYIuKkmdNCsYOZQAr8lLiHkRPEQ6p0qzzA/zCHqYc5ezSCSmHJ8lrWarA+AXEj&ndidbP=U48Ho
request GET http://www.printyourdays.com/xzes/?Kdvl=WvVdSYazqKi8GE8+azEVjLioWRcomDeCwGXpfuOsOesbk9wXqWr6PQqFFZj71fIVZO7r9iJc&ndidbP=U48Ho
request GET http://www.captekbrasil.com/xzes/?Kdvl=nm3KboQC3LfSgL/zvgWiiAhLuySCjSAIrKPwMPaNYLQTgNUrE1tMoNUDfMG3u5xrJqSESYJN&ndidbP=U48Ho
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00449000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00860000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00006000', u'virtual_address': u'0x0005e000', u'entropy': 7.214614291012478, u'name': u'.data', u'virtual_size': u'0x0000a2a8'} entropy 7.21461429101 description A section with a high entropy has been found
section {u'size_of_data': u'0x00029000', u'virtual_address': u'0x00069000', u'entropy': 7.982678593284681, u'name': u'.xxrfn', u'virtual_size': u'0x00028ea5'} entropy 7.98267859328 description A section with a high entropy has been found
entropy 0.335714285714 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Noon.l!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
McAfee RDN/Generic.rp
Cylance Unsafe
Sangfor Trojan.Win32.Noon.gen
K7AntiVirus Trojan ( 0054e2e21 )
Alibaba Trojan:Win32/Kryptik.16e54cc8
K7GW Trojan ( 0054e2e21 )
Cybereason malicious.41c9d2
Arcabit Trojan.Babar.D688B
Cyren W32/Agent.BEB.gen!Eldorado
ESET-NOD32 Win32/Formbook.AA
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Babar.26763
MicroWorld-eScan Gen:Variant.Babar.26763
Avast Win32:Trojan-gen
Ad-Aware Gen:Variant.Babar.26763
Sophos ML/PE-A
TrendMicro TROJ_GEN.R002C0WJP21
FireEye Generic.mg.05c21bf3df38d5b8
Emsisoft Gen:Variant.Babar.26763 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Crypt.Agent.brhtk
Gridinsoft Trojan.Heur!.02012021
Microsoft Trojan:Win32/Fareit.SM!MTB
GData Win32.Trojan-Stealer.FormBook.175TO8
VBA32 Trojan.Sabsik.FL
ALYac Gen:Variant.Babar.26763
MAX malware (ai score=85)
Malwarebytes Trojan.Crypt
TrendMicro-HouseCall TROJ_GEN.R002C0WJP21
Rising Trojan.Generic@ML.83 (RDMK:bh6KbND3bkNLJnt+W7ISrg)
Ikarus Trojan.Win32.Crypt
Fortinet W32/Kryptik.GSUC!tr
BitDefenderTheta Gen:NN.ZexaF.34236.JqW@aatoScd
AVG Win32:Trojan-gen
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_90% (W)
MaxSecure Trojan.Malware.300983.susgen