Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 6, 2023, 1:04 p.m.	Feb. 6, 2023, 1:06 p.m.

Size	570.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ed0be56461eb04e1eccc0c4c69995381`
SHA256	`0d6ea7460a8cd101cdc638e2ffd0e3056c07a0eca3930264ac0a56bf3b66542c`
CRC32	`9E677988`
ssdeep	`12288:Lvw0RIxRzdK2PFx6Qc/cCODc+meJnBx/8mueUNuyIuTW4NW:7wweuzWH`
Yara	IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

poweroff.exe "C:\Users\test22\AppData\Local\Temp\poweroff.exe"
804

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 6, 2023, 1:04 p.m.			0	0
IsDebuggerPresent Feb. 6, 2023, 1:04 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 6, 2023, 1:04 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (44 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3601000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c9b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f98000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Feb. 6, 2023, 1:04 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f99000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00044400', u'virtual_address': u'0x00002000', u'entropy': 6.961885656193124, u'name': u'.text', u'virtual_size': u'0x00044394'}

entropy

6.96188565619

description

A section with a high entropy has been found

entropy

0.47936786655

description

Overall entropy of this PE file is high

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Csdi.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Strictor.266661
McAfee	Artemis!ED0BE56461EB
Cylance	Unsafe
Zillya	Adware.Csdi.Win32.580
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Adware ( 005684bb1 )
BitDefender	Trojan.GenericKD.65328686
K7GW	Adware ( 005684bb1 )
Cybereason	malicious.712fbf
BitDefenderTheta	Gen:NN.ZemsilF.36252.Jm0@a8B!CU
VirIT	Adware.Win32.Genus.HU
Cyren	W32/ABRisk.TPAB-4227
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.BC
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Downloader.MSIL.Csdi.gen
Alibaba	TrojanDownloader:MSIL/CsdiMonetize.9ffffbc0
NANO-Antivirus	Trojan.Win32.Csdi.jumjnp
Tencent	Msil.AdWare.Csdi.Cdhl
Sophos	Generic ML PUA (PUA)
DrWeb	Adware.WizzMonetize.1
VIPRE	Gen:Variant.Strictor.266661
TrendMicro	Trojan.Win32.PRIVATELOADER.YXDBAZ
McAfee-GW-Edition	Artemis!PUP
FireEye	Generic.mg.ed0be56461eb04e1
Emsisoft	Gen:Variant.Strictor.266661 (B)
SentinelOne	Static AI - Malicious PE
GData	Gen:Variant.Strictor.266661
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1255496
MAX	malware (ai score=88)
Antiy-AVL	GrayWare[AdWare]/MSIL.CsdiMonetize
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Strictor.D411A5
ZoneAlarm	not-a-virus:HEUR:AdWare.MSIL.Csdi.gen
Microsoft	Trojan:Win32/Casdet!rfn
Google	Detected
AhnLab-V3	Adware/Win.Generic.C5373345
Acronis	suspicious
ALYac	Gen:Variant.Strictor.266661
Malwarebytes	Adware.Csdimonetize
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.PRIVATELOADER.YXDBAZ

poweroff.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All