popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mic.exe

UPX Malicious Library PE64 .NET DLL PE File DLL OS Processor Check PE32 JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 27, 2022, 7:52 a.m. April 27, 2022, 7:54 a.m.
Size 419.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 4a039ccf1c333214953856f96659e016
SHA256 29f965bf7b3c668eea93c555096dc628ed64bb78b5eeb610d16e5a146334787e
CRC32 5B4CCAC7
ssdeep 12288:+YWExQYB0CKwxzarEzctJpVZxozGTJxh5Uj:+YWEqSKCewzctJvZ+z2x4j
Yara
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd5000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2324
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03a20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 10237071360
free_bytes_available: 10237071360
root_path: C:\Users\test22\AppData\Local\Temp
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 10235625472
free_bytes_available: 10235625472
root_path: C:\Users\test22\AppData\Local\Temp
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\HPSUPD-Win32Exe.exe
file C:\Users\test22\AppData\Local\Temp\nsj8CC1.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\Common.dll
file C:\Users\test22\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\Common.dll
file C:\Users\test22\AppData\Local\Temp\nsj8CC1.tmp\System.dll
Lionic Trojan.Win32.Shelsy.4!c
MicroWorld-eScan Gen:Variant.Nemesis.4810
FireEye Gen:Variant.Nemesis.4810
McAfee Artemis!4A039CCF1C33
Cylance Unsafe
Sangfor Trojan.Win32.Injector.ASH
Alibaba Trojan:Win32/Shelsy.672c231c
Arcabit Trojan.Nemesis.D12CA
Cyren W32/NSIS_Injector.A.gen!Eldorado
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
ESET-NOD32 NSIS/Injector.ASH
Kaspersky HEUR:Trojan.Win32.Shelsy.gen
BitDefender Gen:Variant.Nemesis.4810
Avast NSIS:InjectorX-gen [Trj]
Tencent Win32.Trojan.Falsesign.Pbpb
Emsisoft Gen:Variant.Nemesis.4810 (B)
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Ikarus Trojan.Inject
Webroot W32.Trojan.Gen
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Nemesis.4810
ALYac Gen:Variant.Nemesis.4810
MAX malware (ai score=89)
Malwarebytes Trojan.Injector
MaxSecure Trojan.Malware.121218.susgen
AVG NSIS:InjectorX-gen [Trj]