Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 12, 2021, 10:28 a.m.	Nov. 12, 2021, 10:40 a.m.

Size	542.6KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b526f0a2b32de1e6685fd3bade38f257`
SHA256	`85641fdd05980c31b2e8d6d3f6218391dd089780df85a53e24a1f3f0abdf6a24`
CRC32	`EBF09298`
ssdeep	`6144:PDd4WUPG/AMDnBZDyqOSOrD57DEbmQlaCBHFSiSREeYGojAg/0z1OmB9ukaNfE:PDd4nG/AMzBlONlDEbm/1Yi1OwIka6`
PDB Path	C:\workspace\clean-subscriptions\src\ResourceManagement\KeyVault\obj\Release\net452\Microsoft.Azure.Management.KeyVault.Fluent.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

seminude.exe "C:\Users\test22\AppData\Local\Temp\seminude.exe"
2408

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Nov. 12, 2021, 10:28 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Nov. 12, 2021, 10:28 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 12, 2021, 10:28 a.m.			0	0
IsDebuggerPresent Nov. 12, 2021, 10:28 a.m.			0	0
IsDebuggerPresent Nov. 12, 2021, 10:28 a.m.			0	0
IsDebuggerPresent Nov. 12, 2021, 10:28 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 12, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691f18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 12, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691f18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 12, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00691f58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\workspace\clean-subscriptions\src\ResourceManagement\KeyVault\obj\Release\net452\Microsoft.Azure.Management.KeyVault.Fluent.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 12, 2021, 10:28 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73942000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 12, 2021, 10:28 a.m.	process_identifier: 2408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00085e00', u'virtual_address': u'0x00002000', u'entropy': 7.624080901233762, u'name': u'.text', u'virtual_size': u'0x00085cb6'}

entropy

7.62408090123

description

A section with a high entropy has been found

entropy

0.996279069767

description

Overall entropy of this PE file is high

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Lionic	Trojan.Multi.Generic.4!c
DrWeb	Trojan.Siggen15.38691
MicroWorld-eScan	Trojan.GenericKD.37992625
FireEye	Trojan.GenericKD.37992625
McAfee	RDN/Generic.dx
Cylance	Unsafe
Alibaba	Trojan:MSIL/GenKryptik.b5fb4b06
K7GW	Trojan ( 0058a04b1 )
Arcabit	Trojan.Generic.D2D2D4FB
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FNCW
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.37992625
Avast	FileRepMalware
Ad-Aware	Trojan.GenericKD.37992625
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.37992625 (B)
Ikarus	Win32.Outbreak
Avira	TR/AD.GenSteal.byhze
Microsoft	VirTool:MSIL/DefVMCheck!MTB
GData	Trojan.GenericKD.37992625
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.37992625
MAX	malware (ai score=89)
Malwarebytes	Trojan.FakeMS
TrendMicro-HouseCall	TROJ_GEN.R002H0DKA21
Fortinet	MSIL/GenKryptik.FNCW!tr
Webroot	W32.Trojan.Gen
AVG	FileRepMalware

seminude.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All