popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ss47.exe

UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 23, 2023, 6:21 p.m. March 23, 2023, 6:35 p.m.
Size 866.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 44d59cf2b7e4700b703e95eaa7fdbdc7
SHA256 43e4574bbe757104766b7299c8ebf76026f0932b079e6a0ecd4325f6c0ddb36f
CRC32 280E3854
ssdeep 24576:6yE8JiMHd/BieyIMZR9ejI21FiWOnoxkNMu4dXxbfat6Z:kCiMHtBiez+Rb21FiWOnoxkNMu4dX9aE
PDB Path E:\build-nrd-vcpkg\vcpkg\buildtrees\sentry-native\x64-windows-mixed-mt-rel\crashpad_build\handler\crashpad_handler.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
bz.bbbeioaag.com
A 45.136.113.107
45.136.113.107
count.iiagjaggg.com
A 45.66.159.179
45.66.159.179
www.facebook.com
CNAME star-mini.c10r.facebook.com
A 31.13.82.36
157.240.31.35
IP Address Status Action
164.124.101.2 Active Moloch
31.13.82.36 Active Moloch
45.136.113.107 Active Moloch
45.66.159.179 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49163 -> 31.13.82.36:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 45.66.159.179:80 2003626 ET HUNTING Double User-Agent (User-Agent User-Agent) Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 45.66.159.179:80 2003626 ET HUNTING Double User-Agent (User-Agent User-Agent) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
31.13.82.36:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 18:07:a5:9b:4c:d8:00:d8:4f:84:a6:46:eb:79:ac:09:29:8e:ec:e1

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path E:\build-nrd-vcpkg\vcpkg\buildtrees\sentry-native\x64-windows-mixed-mt-rel\crashpad_build\handler\crashpad_handler.pdb
section _RDATA
section CPADinfo
resource name MUI
resource name PNG
suspicious_features POST method with no referer header suspicious_request POST http://www.facebook.com/check/?sid=1251809&key=0dcaeaf81593814fe2ahttps://www.facebook.com/d06851037
request GET http://bz.bbbeioaag.com/sts/bimage.jpg
request GET http://count.iiagjaggg.com/check/safe
request POST http://www.facebook.com/check/?sid=1251809&key=0dcaeaf81593814fe2ahttps://www.facebook.com/d06851037
request GET https://www.facebook.com/ads/manager/account_settings/account_billing
request GET https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing
request POST http://www.facebook.com/check/?sid=1251809&key=0dcaeaf81593814fe2ahttps://www.facebook.com/d06851037
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1608
region_size: 1519616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002fb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1608
region_size: 1261568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002790000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 58\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 38\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 81\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 41\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 32\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 30\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 94\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 68\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 90\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 29\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 91\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 96\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 46\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 89\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 100\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 86\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 87\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 43\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 104\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 67\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 33\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 102\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 99\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 71\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 42\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 54\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 60\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 48\Network\Cookies
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00002000', u'virtual_address': u'0x000db000', u'entropy': 7.677669974167185, u'name': u'.rsrc', u'virtual_size': u'0x00002000'} entropy 7.67766997417 description A section with a high entropy has been found
FireEye Trojan.GenericKDZ.98240
ESET-NOD32 a variant of Win64/TrojanDownloader.Agent.ZX
Paloalto generic.ml
Kaspersky VHO:Trojan-Downloader.Win32.Agent.gen
BitDefender Trojan.GenericKDZ.98240
Avast FileRepMalware [Misc]
DrWeb Trojan.PWS.Stealer.35952
McAfee-GW-Edition BehavesLike.Win64.Generic.ch
Ikarus Trojan-Downloader.Win64.Agent
Antiy-AVL Trojan/Win32.Sabsik
Microsoft Program:Win32/Wacapew.C!ml
ZoneAlarm VHO:Trojan-Downloader.Win32.Agent.gen
Google Detected
McAfee Artemis!44D59CF2B7E4
MAX malware (ai score=82)
Rising Downloader.Agent!8.B23 (CLOUD)
AVG FileRepMalware [Misc]
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob