Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
10.03 05:10
cliloc_fix.exe
10.02 02:10
66fbfccd837ac_vadggdsa...
10.02 02:10
66fc5c187ba75_lyla343.exe
10.02 02:10
66fbfcc301a31_swws.exe
10.02 02:10
66fbd9a4db4c9_Governme...
10.02 02:10
66fb2538369cb_EdgeUpda...
10.02 02:10
cc.js
10.02 02:10
kixx.js
10.02 02:10
66f55533ca7d6_RDPWInst...
10.02 02:10
SPOOF.exe

Latest News
10.04 12:10
Satellite Hacking
10.04 12:10
New Perfctl Malware Ta...
10.03 11:10
The Silent Epidemic: U...
10.03 11:10
The Silent Epidemic: U...
10.03 11:10
LevelBlue: Driving Cyb...
10.03 11:10
Polaris Dawn, and the ...
10.03 11:10
Not Black Mirror: Meta...
10.03 11:10
Browser Guard now flag...
10.03 11:10
NYC Schools Reverse Co...
10.03 11:10
North Korean Hackers U...

Summary | ZeroBOX

Missilem.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer PE File OS Processor Check PE32 DLL

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 24, 2022, 10:08 a.m.	Feb. 24, 2022, 10:11 a.m.

Size	712.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`831081db0026e04d7189e8239fe30b8a`
SHA256	`fcf12026f370daa296e7820ce0b64cd8a63bd63ebbc7fef08ff0dbf24fe024f4`
CRC32	`B7810097`
ssdeep	`12288:iblEFplTpLHvo09Impr3mH3laistR0J5AtePPW92/rutMyljWM1QEFO:iblEFplhh9IKr2H3labC5AtSW9Q2pQoO`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

Missilem.exe "C:\Users\test22\AppData\Local\Temp\Missilem.exe"
2416

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 24, 2022, 10:08 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 24, 2022, 10:08 a.m.	process_identifier: 2416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c65000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Feb. 24, 2022, 10:08 a.m.	process_identifier: 2416 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Feb. 24, 2022, 10:08 a.m.	process_identifier: 2416 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x032c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Feb. 24, 2022, 10:08 a.m.	process_identifier: 2416 region_size: 1052672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x033c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (10 events)

file	C:\Users\test22\AppData\Local\Temp\mfaudiocnv.dll
file	C:\Users\test22\AppData\Local\Temp\net1.exe
file	C:\Users\test22\AppData\Local\Temp\gdi32.dll
file	C:\Users\test22\AppData\Local\Temp\userenv.dll
file	C:\Users\test22\AppData\Local\Temp\nso8DC9.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\OneSettingsClient.dll
file	C:\Users\test22\AppData\Local\Temp\vcomp140.dll
file	C:\Users\test22\AppData\Local\Temp\netjoin.dll
file	C:\Users\test22\AppData\Local\Temp\Clipc.dll
file	C:\Users\test22\AppData\Local\Temp\prntvpt.dll

Drops an executable to the user AppData folder (10 events)

file	C:\Users\test22\AppData\Local\Temp\mfaudiocnv.dll
file	C:\Users\test22\AppData\Local\Temp\gdi32.dll
file	C:\Users\test22\AppData\Local\Temp\Clipc.dll
file	C:\Users\test22\AppData\Local\Temp\net1.exe
file	C:\Users\test22\AppData\Local\Temp\nso8DC9.tmp\System.dll
file	C:\Users\test22\AppData\Local\Temp\prntvpt.dll
file	C:\Users\test22\AppData\Local\Temp\vcomp140.dll
file	C:\Users\test22\AppData\Local\Temp\userenv.dll
file	C:\Users\test22\AppData\Local\Temp\OneSettingsClient.dll
file	C:\Users\test22\AppData\Local\Temp\netjoin.dll

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Bkav	W32.AIDetect.malware2
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
APEX	Malicious
Trapmine	suspicious.low.ml.score
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware
AVG	FileRepMalware