popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspab2.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 7, 2021, 10:14 a.m. Nov. 7, 2021, 10:41 a.m.
Size 201.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b9e5185e5dc7a5403ac864d41ca32e73
SHA256 f4f3615381360275a09da4194604720a7ee6e752679c97b6a6f8628b7db2ecd7
CRC32 BC780E71
ssdeep 3072:davKSMG26qZ+qcCfrMq/Q56Wrxpzbgqru+sxkgaBChXhUr4ZWkia:dL8RqYqVBLuzbgwu7igakUkWk
PDB Path C:\kebozedo91\xawizokududi\100-pagoxag\honiliyoxi.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path C:\kebozedo91\xawizokududi\100-pagoxag\honiliyoxi.pdb
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2860
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2860
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00038628 size 0x00000468
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0002ba48 size 0x0000004c
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0002ba48 size 0x0000004c
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x0002ba48 size 0x0000004c
section {u'size_of_data': u'0x00015e00', u'virtual_address': u'0x00001000', u'entropy': 7.381738167182967, u'name': u'.text', u'virtual_size': u'0x00015cf0'} entropy 7.38173816718 description A section with a high entropy has been found
entropy 0.4375 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3024
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3024
process_handle: 0x00000080
1 1 0
Process injection Process 2860 called NtSetContextThread to modify thread in remote process 3024
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206330
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 3024
1 0 0
Process injection Process 2860 resumed a thread in remote process 3024
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 3024
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 3028
thread_handle: 0x0000007c
process_identifier: 3024
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\toolspab2.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\toolspab2.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\toolspab2.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 3024
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3024
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3024
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206330
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 3024
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 3024
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.38608
FireEye Generic.mg.b9e5185e5dc7a540
McAfee GenericRXQC-OC!B9E5185E5DC7
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7GW Hacktool ( 700007861 )
Cybereason malicious.02d73f
BitDefenderTheta Gen:NN.ZexaF.34266.mq0@aipFmipI
Cyren W32/Kryptik.FOQ.gen!Eldorado
Symantec Packed.Generic.528
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan.Win32.Convagent.gen
BitDefender Gen:Variant.Fragtor.38608
Rising Trojan.Generic@ML.100 (RDML:p922nxcxpjfpicRTwY1VqA)
Ad-Aware Gen:Variant.Fragtor.38608
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Emotet.dh
Emsisoft Gen:Variant.Fragtor.38608 (B)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_55%
MAX malware (ai score=80)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Gen:Variant.Fragtor.38608
AhnLab-V3 Malware/Win.OC.R448947
Acronis suspicious
VBA32 Malware-Cryptor.2LA.gen
Malwarebytes Malware.AI.3526614876
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Malware.300983.susgen
CrowdStrike win/malicious_confidence_80% (D)