Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 18, 2021, 2:31 p.m.	Nov. 18, 2021, 2:35 p.m.

Size	1.3MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`cea270aef0733d09aece2d38e7bc18c1`
SHA256	`f8163245c37ac6b3c49c8b2c2c7ab09b547ece6249876379c0106ab832ef5d9e`
CRC32	`1484327A`
ssdeep	`12288:TdsrBdx+TlFAQJ2YN7mWSR3rNUPPXepSGeLm7cBkgzuYzY44AXuF:u4AQ/dmtTUPmMxScBNyFAs`
Yara	Malicious_Packer_Zero - Malicious Packer Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

initis.exe "C:\Users\test22\AppData\Local\Temp\initis.exe"
2320

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (50 out of 851 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0
WriteConsoleW Nov. 18, 2021, 2:31 p.m.	buffer: <INVALID POINTER> console_handle: 0x00000001		0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (10 events)

section	.noncont
section	.noncen
section	.spraich
section	.aghastn
section	.archego
section	.osteody
section	.zoomorp
section	.pontede
section	.sinecur
section	.tayir

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 18, 2021, 2:31 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00461000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 2:31 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 2:31 p.m.	process_identifier: 2320 region_size: 331776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 2:31 p.m.	process_identifier: 2320 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 18, 2021, 2:31 p.m.	process_identifier: 2320 region_size: 294912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00132800', u'virtual_address': u'0x00001000', u'entropy': 7.467373108030023, u'name': u'.text', u'virtual_size': u'0x00141bbd'}

entropy

7.46737310803

description

A section with a high entropy has been found

entropy

0.945258288358

description

Overall entropy of this PE file is high

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.15417
FireEye	Generic.mg.cea270aef0733d09
Malwarebytes	MachineLearning/Anomalous.100%
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.900de1
BitDefenderTheta	Gen:NN.ZexaF.34266.r1Y@aCEeGUbi
ESET-NOD32	a variant of Win32/GenKryptik.FNQF
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Gen:Variant.Lazy.15417
Rising	Malware.Heuristic!ET#82% (RDMK:cmRtazpBkEOwgDqH3bTQWslr/F1H)
Ad-Aware	Gen:Variant.Barys.229746
Emsisoft	Gen:Variant.Barys.229746 (B)
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Trojan.Heur!.01012031
GData	Gen:Variant.Lazy.15417
Cynet	Malicious (score: 100)
Acronis	suspicious
APEX	Malicious
eGambit	PE.Heur.InvalidSig
CrowdStrike	win/malicious_confidence_60% (D)

initis.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All