Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2023, 5:38 p.m.	March 8, 2023, 5:40 p.m.

Size	7.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`9926000294771eb592dd85d1b894b76e`
SHA256	`8c394e93be7bbdd0af7794c7f247e6c87fc35e03615dba0b9f501abd74b2e66f`
CRC32	`D7BE203D`
ssdeep	`196608:91OiFpCxGANsXXTn27YXaYtk/juWqW+T1H0ksf5QvH3w:3OiLCxGesXXTn3KYC/jurW+TijBQPw`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
23.111.184.154	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 8, 2023, 5:38 p.m.	computer_name: TEST22-PC	1	1	0

section

.sxdata

packer

Armadillo v1.71

file	C:\Users\test22\AppData\Local\Temp\7zSC30C.tmp\Install.exe
file	C:\Users\test22\AppData\Local\Temp\7zSC02E.tmp\Install.exe

wmi	<INVALID POINTER>

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 8, 2023, 5:38 p.m.	process_identifier: 2184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 1499136 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

host

23.111.184.154

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion

Time & API	Arguments	Status	Return	Repeated
WNetGetProviderNameW March 8, 2023, 5:38 p.m.	net_type: 0x00250000		1222	0

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Application.Jaik.48175
FireEye	Gen:Variant.Application.Jaik.48175
ALYac	Gen:Variant.Application.Jaik.48175
VIPRE	Gen:Variant.Application.Jaik.48175
Arcabit	Trojan.Application.Jaik.DBC2F
Cyren	W32/Kryptik.IXP.gen!Eldorado
ESET-NOD32	a variant of Win32/Adware.Neoreklami.MS
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-Dropper.Win32.Agent.pef
BitDefender	Gen:Variant.Application.Jaik.48175
Avast	Win32:Adware-gen [Adw]
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Application.Jaik.48175 (B)
Avira	HEUR/AGEN.1224543
Antiy-AVL	GrayWare[AdWare]/Win32.Neoreklami
Microsoft	Trojan:Script/Phonzy.A!ml
ZoneAlarm	HEUR:Trojan-Dropper.Win32.Agent.pef
GData	Gen:Variant.Application.Jaik.48175
Google	Detected
McAfee	Artemis!992600029477
MAX	malware (ai score=75)
Malwarebytes	Neoreklami.Adware.BrowserHijacker.DDS
TrendMicro-HouseCall	TROJ_GEN.R002H0CC723
Rising	Adware.Neoreklami!1.ABC4 (CLASSIC)
Ikarus	PUA.Neoreklami
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Adware/Neoreklami
BitDefenderTheta	Gen:NN.ZexaF.36308.@xW@aORZnub
AVG	Win32:Adware-gen [Adw]

setup.exe