Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

Hack Bold Italic Nerd Font Complete Mono Windows Compatible.ttf

AntiVM AntiDebug

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 16, 2023, 10:27 a.m.	March 16, 2023, 10:29 a.m.

Size	1.6MB
Type	TrueType Font data, digitally signed, 21 tables, 1st "DSIG", name offset 0x189ab0
MD5	`715b054e75bfe030884f63623b3715e7`
SHA256	`cf4705f6aeb6bf7ec9d499547f3da53f8264aab087c8295a3b75afbf6b2e5a08`
CRC32	`F6CE57C9`
ssdeep	`24576:Po44V9glbCDvZ8C/GKn64bQIBknDuAopOCNGtWFTAosci6T5+AZLXF:A4sNuYzhODDCcUrBJtZ5`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "IZFDLWw" "C:\Users\test22\AppData\Local\Temp\Hack Bold Italic Nerd Font Complete Mono Windows Compatible.ttf"
2556
- fontview.exe "C:\Windows\System32\fontview.exe" C:\Users\test22\AppData\Local\Temp\Hack Bold Italic Nerd Font Complete Mono Windows Compatible.ttf
  2664
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 16, 2023, 9:27 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 16, 2023, 9:27 a.m.	process_identifier: 2664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732f2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 16, 2023, 9:28 a.m.	process_identifier: 2664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 16, 2023, 9:29 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep