popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

winbox.exe

Generic Malware Malicious Library Admin Tool (Sysinternals etc ...) UPX PE File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 18, 2021, 1:58 p.m. Nov. 18, 2021, 2:01 p.m.
Size 1.7MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d6b53ece8c20cf28f16303c1e79bd51c
SHA256 6f1aca95db1e7e20fada011cb594fd2aa32665003df111413f8de351cf9bc211
CRC32 81CE10A0
ssdeep 49152:C3/YW2+3loiYH+hTg2KKU9RgH5ND0R5MCjA+M:C3/z2qii7CjA+M
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name STRING
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74622000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2148
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741c3000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 16
family: 2
1 0 0