Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 5, 2023, 2:20 p.m.	March 5, 2023, 2:22 p.m.

Size	89.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`f7ab2172748e041ae595f162af6b10e4`
SHA256	`cc58a99b6e68b6999e9f18192fa460aae6ec12794200ca3d98bcd24d2422f7cf`
CRC32	`ACD506C3`
ssdeep	`1536:euON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJU7aI89p:euhVZbtvbpxLHoUsYuNhV25LJU7aI89p`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE32 - (no description) PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2724
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2812

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 5, 2023, 2:20 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:20 p.m.			0	0
IsDebuggerPresent March 5, 2023, 2:20 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 5, 2023, 2:20 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.NataDecoAAT.Trojan
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.446682
FireEye	Gen:Variant.Zusy.446682
CAT-QuickHeal	Trojan.GenericPMF.S29595454
McAfee	Trojan-FUUW!F7AB2172748E
Zillya	Trojan.Sdum.Win32.9748
Sangfor	Trojan.Win32.Zusy.V4nf
Alibaba	Trojan:Win32/Amadey.2b696f65
K7GW	Riskware ( 00584baa1 )
K7AntiVirus	Riskware ( 00584baa1 )
BitDefenderTheta	Gen:NN.ZedlaF.36308.fu4@ayrKMhji
VirIT	Trojan.Win32.Genus.NMA
Cyren	W32/Agent.GPBN-4848
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Agent.AFGA
Cynet	Malicious (score: 99)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.446682
NANO-Antivirus	Trojan.Win32.Clipper.juivsg
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Avast	Win32:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.117b16a5
Emsisoft	Gen:Variant.Zusy.446682 (B)
VIPRE	Gen:Variant.Zusy.446682
TrendMicro	TROJ_GEN.R002C0DC423
McAfee-GW-Edition	Trojan-FUUW!F7AB2172748E
Sophos	Troj/Amadey-K
Jiangmin	Trojan.Agent.ejvu
Avira	TR/Agent.yzjor
Antiy-AVL	Trojan[Backdoor]/Win32.Convagent
Microsoft	Trojan:Win32/Amadey.MA!MTB
Gridinsoft	Trojan.Win32.Agent.cl
Arcabit	Trojan.Zusy.D6D0DA
ViRobot	Trojan.Win.Z.Zusy.91136.I
GData	Gen:Variant.Zusy.446682
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5355012
VBA32	Trojan.Sdum
MAX	malware (ai score=83)
TrendMicro-HouseCall	TROJ_GEN.R002C0DC423
Rising	Trojan.Generic@AI.90 (RDML:UOvjVOFWo3+5kBV55m4AZg)
Yandex	Trojan.Agent!L35ilSkswbw
Ikarus	Win32.Outbreak
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.AFGA!tr
AVG	Win32:TrojanX-gen [Trj]

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All