popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vooi.exe

UPX Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 16, 2023, 9:39 a.m. Feb. 16, 2023, 9:41 a.m.
Size 305.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 29fb7632d7e495f0f9f23524d130fd81
SHA256 da5007b3da914a87cb0b8cb4540b59d08761aeddf058f09aea3b854c43c69bae
CRC32 E470F6A0
ssdeep 6144:/Ya6H1VsdE/dfnLAthYJpvak1cITgTo+BGms2uOUSgxo/o7LWFfXgwSXbOU0d4wE:/Yl3wgdfLUmJNJqI8NY50ofg4wSKU0WJ
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49173 -> 162.241.217.45:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 104.21.73.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 162.241.217.45:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 104.21.73.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 162.241.217.45:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 104.21.73.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 185.215.4.36:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 185.215.4.36:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 185.215.4.36:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 199.59.243.222:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 35.244.144.199:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 199.59.243.222:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 35.244.144.199:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 199.59.243.222:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 35.244.144.199:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49185 -> 103.221.223.104:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 199.192.30.193:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49185 -> 103.221.223.104:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 199.192.30.193:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49185 -> 103.221.223.104:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 199.192.30.193:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 194.58.112.174:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 194.58.112.174:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 194.58.112.174:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 89.163.135.184:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 89.163.135.184:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 89.163.135.184:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 81.88.48.71:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 81.88.48.71:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 81.88.48.71:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.adasoft.info/g8zi/?JEaL=AjThibsiKHEzMap5+Vb1YatjExSsvvxZcrBupw4ZBG4WRQVp136auGb9quzXsBzaGyepbYm2IRG+aRDhPY6xv0UHc7irYlLkFg/xdwc=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.roofing-services-jp.click/g8zi/?JEaL=gTlFRVzTQHY+4EgrNO5awQa8RWZgVCjJOwNNvloWYAeZ2YNPVdJ0JDTSYybnPjzpnRJAw1yAloqncvuNrvOysTzLgSLmOoxM4SS5trI=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.gargaloid.ru/g8zi/?JEaL=DkLLWxis2E1HUQHLgvf0rwReE860J9T9JCUYJKAUGGGLEJ+tSm+r/8GD6x7i7OBqP6FTrmIabcF+CcJqeR0FKekLXyINHVeG/YqS6OE=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.glenwoodstudiocrafts.com/g8zi/?JEaL=gbuUsdMFgAKo+NdGlyvkSKYNRqirfVQ89Bp33XaDA2X8lfWerQUcV5LlbkaQmw5VxTa6UNcaUaTY77vs7V20eR3+7cVD7zKEEkhMbDQ=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.toporsche.online/g8zi/?JEaL=Bw9a0uuo3rzhwumdM7nrjI14X+BCr6LihBT+/rKJp3efzvxic1aH+RBRhAXvIyjDStl1Up5h0HNoWXDtP9lq1bQZPtqPn36pZK/YgBg=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.kitmake.site/g8zi/?JEaL=xsrS/voV1B9CoCwWjknnidlVFWFjHTCHzTQPpqEBQEqvnN6OKGA2mnHVlaVl91DOqShwtJOPyPE8TrZpP8AQoalCMd0Ga+zcmwYW8Yo=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.gulyapipimapen.com/g8zi/?JEaL=VuLYQfvlBUqfT2McKuawAjaDBjX0t9mr1J6uyY3ZF4LXs8N5wdxwFreC8pgW3C9k+M7S0vPJnt4Nr2VoSdFZmL0o42Ux3LoeA6EoHiQ=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.duloxetine.best/g8zi/?JEaL=rHOc5/Qta46Ekd5uFeqEdtxA4UdExyq8BvUDkLx0j/YVdOkc4qLNTxLHCgQnAeZZAyqTB51wb5QplN8VpPuQtjYwQCy3R2e8IKIo0q8=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.888h8.club/g8zi/?JEaL=Ks12YypKabo5FdLXnvxM/Qpm/Gn9v2zY1zgFJmYNxzzlsbG0b/LOSxPj/TZ+035nj0ULeNoalWyc8wPdZlbp7l9sjPbRLD9hV7Rdk3c=&4PPPYg=wkg1XDgwksv
suspicious_features GET method with no useragent header suspicious_request GET http://www.suachuadienlanh247.com/g8zi/?JEaL=1kj8Fq4L6TnfCmx99eO1afxEcD46BTaHG7EMr4gibJ+l1xb+1zvKeyGogpKzQDyXb90/ei3szzlZtvNifGH4bJQgs5x5EHn9neAPCZE=&4PPPYg=wkg1XDgwksv
request GET http://www.adasoft.info/g8zi/?JEaL=AjThibsiKHEzMap5+Vb1YatjExSsvvxZcrBupw4ZBG4WRQVp136auGb9quzXsBzaGyepbYm2IRG+aRDhPY6xv0UHc7irYlLkFg/xdwc=&4PPPYg=wkg1XDgwksv
request GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3150000.zip
request POST http://www.roofing-services-jp.click/g8zi/
request GET http://www.roofing-services-jp.click/g8zi/?JEaL=gTlFRVzTQHY+4EgrNO5awQa8RWZgVCjJOwNNvloWYAeZ2YNPVdJ0JDTSYybnPjzpnRJAw1yAloqncvuNrvOysTzLgSLmOoxM4SS5trI=&4PPPYg=wkg1XDgwksv
request POST http://www.gargaloid.ru/g8zi/
request GET http://www.gargaloid.ru/g8zi/?JEaL=DkLLWxis2E1HUQHLgvf0rwReE860J9T9JCUYJKAUGGGLEJ+tSm+r/8GD6x7i7OBqP6FTrmIabcF+CcJqeR0FKekLXyINHVeG/YqS6OE=&4PPPYg=wkg1XDgwksv
request POST http://www.glenwoodstudiocrafts.com/g8zi/
request GET http://www.glenwoodstudiocrafts.com/g8zi/?JEaL=gbuUsdMFgAKo+NdGlyvkSKYNRqirfVQ89Bp33XaDA2X8lfWerQUcV5LlbkaQmw5VxTa6UNcaUaTY77vs7V20eR3+7cVD7zKEEkhMbDQ=&4PPPYg=wkg1XDgwksv
request POST http://www.toporsche.online/g8zi/
request GET http://www.toporsche.online/g8zi/?JEaL=Bw9a0uuo3rzhwumdM7nrjI14X+BCr6LihBT+/rKJp3efzvxic1aH+RBRhAXvIyjDStl1Up5h0HNoWXDtP9lq1bQZPtqPn36pZK/YgBg=&4PPPYg=wkg1XDgwksv
request POST http://www.kitmake.site/g8zi/
request GET http://www.kitmake.site/g8zi/?JEaL=xsrS/voV1B9CoCwWjknnidlVFWFjHTCHzTQPpqEBQEqvnN6OKGA2mnHVlaVl91DOqShwtJOPyPE8TrZpP8AQoalCMd0Ga+zcmwYW8Yo=&4PPPYg=wkg1XDgwksv
request POST http://www.gulyapipimapen.com/g8zi/
request GET http://www.gulyapipimapen.com/g8zi/?JEaL=VuLYQfvlBUqfT2McKuawAjaDBjX0t9mr1J6uyY3ZF4LXs8N5wdxwFreC8pgW3C9k+M7S0vPJnt4Nr2VoSdFZmL0o42Ux3LoeA6EoHiQ=&4PPPYg=wkg1XDgwksv
request POST http://www.duloxetine.best/g8zi/
request GET http://www.duloxetine.best/g8zi/?JEaL=rHOc5/Qta46Ekd5uFeqEdtxA4UdExyq8BvUDkLx0j/YVdOkc4qLNTxLHCgQnAeZZAyqTB51wb5QplN8VpPuQtjYwQCy3R2e8IKIo0q8=&4PPPYg=wkg1XDgwksv
request POST http://www.888h8.club/g8zi/
request GET http://www.888h8.club/g8zi/?JEaL=Ks12YypKabo5FdLXnvxM/Qpm/Gn9v2zY1zgFJmYNxzzlsbG0b/LOSxPj/TZ+035nj0ULeNoalWyc8wPdZlbp7l9sjPbRLD9hV7Rdk3c=&4PPPYg=wkg1XDgwksv
request POST http://www.suachuadienlanh247.com/g8zi/
request GET http://www.suachuadienlanh247.com/g8zi/?JEaL=1kj8Fq4L6TnfCmx99eO1afxEcD46BTaHG7EMr4gibJ+l1xb+1zvKeyGogpKzQDyXb90/ei3szzlZtvNifGH4bJQgs5x5EHn9neAPCZE=&4PPPYg=wkg1XDgwksv
request POST http://www.jvrsoft.online/g8zi/
request POST http://www.roofing-services-jp.click/g8zi/
request POST http://www.gargaloid.ru/g8zi/
request POST http://www.glenwoodstudiocrafts.com/g8zi/
request POST http://www.toporsche.online/g8zi/
request POST http://www.kitmake.site/g8zi/
request POST http://www.gulyapipimapen.com/g8zi/
request POST http://www.duloxetine.best/g8zi/
request POST http://www.888h8.club/g8zi/
request POST http://www.suachuadienlanh247.com/g8zi/
request POST http://www.jvrsoft.online/g8zi/
domain www.gargaloid.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b10000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\lsmlekitre.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2664 called NtSetContextThread to modify thread in remote process 2708
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2161448
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000f4
process_identifier: 2708
1 0 0
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.24
McAfee RDN/Generic PWS.y
Cylance Unsafe
VIPRE Trojan.NSISX.Spy.Gen.24
Sangfor Suspicious.Win32.Save.ins
Cybereason malicious.ec1df3
Arcabit Trojan.NSISX.Spy.Gen.24
ESET-NOD32 a variant of Win32/Injector.ESRN
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.NSISX.Spy.Gen.24
NANO-Antivirus Riskware.Nsis.Adw.dpxyts
Avast Win32:Malware-gen
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.GenShell.rjbkn
McAfee-GW-Edition BehavesLike.Win32.Dropper.fc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.29fb7632d7e495f0
Emsisoft Trojan.NSISX.Spy.Gen.24 (B)
SentinelOne Static AI - Suspicious PE
Avira TR/AD.GenShell.rjbkn
MAX malware (ai score=81)
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft Trojan:Win32/Formbook!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.NSISX.Spy.Gen.24
Google Detected
AhnLab-V3 Trojan/Win.Agent.C5382526
ALYac Trojan.NSISX.Spy.Gen.24
Rising Trojan.Generic@AI.98 (RDML:Dt414YZqFrXmNGOhbmlShw)
Ikarus Trojan.Inject
Fortinet W32/Injector.NSAY!tr
AVG Win32:Malware-gen
Panda Trj/RnkBend.A
CrowdStrike win/malicious_confidence_100% (D)