Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 27, 2023, 10:19 a.m.	March 27, 2023, 10:40 a.m.

Size	108.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`40528a8ce542af784cb9958552f7798d`
SHA256	`46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc`
CRC32	`A0314578`
ssdeep	`1536:tR9oCsF5QIhH12yXZgo98bFgZneBwNeqDSz/JWL50AUfozmmPV:5oCsF5T1Q+Zgoq6EBwNt+7O0Avz9`
Yara	ConfuserEx_Zero - Confuser .NET Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

Windowsfig.exe "C:\Users\test22\AppData\Local\Temp\Windowsfig.exe"
2632

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 27, 2023, 10:19 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 27, 2023, 10:19 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 27, 2023, 10:19 a.m.			0	0
IsDebuggerPresent March 27, 2023, 10:19 a.m.			0	0
IsDebuggerPresent March 27, 2023, 10:19 a.m.			0	0
IsDebuggerPresent March 27, 2023, 10:19 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 27, 2023, 10:19 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (44 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24064 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020401a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020401c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020401f0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040218 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046ace process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046ac2 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046200 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046adc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046afc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b04 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b08 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b10 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b14 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b18 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b1c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b24 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b28 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b2c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b34 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02046b38 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 27, 2023, 10:19 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00011a00', u'virtual_address': u'0x00002000', u'entropy': 7.877904043642601, u'name': u'.text', u'virtual_size': u'0x000118f4'}

entropy

7.87790404364

description

A section with a high entropy has been found

entropy

0.655813953488

description

Overall entropy of this PE file is high

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.66066090
FireEye	Generic.mg.40528a8ce542af78
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
ALYac	Trojan.GenericKD.66066090
Cylance	unsafe
VIPRE	Trojan.GenericKD.66066090
Sangfor	Suspicious.Win32.Save.a
BitDefender	Trojan.GenericKD.66066090
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Generic.D3F016AA
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:rtkXl/djlcNeTpHDEwCgVA)
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.66066090 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1311777
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Wacatac
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:MSIL/Malgent!MSR
GData	Trojan.GenericKD.66066090
Google	Detected
McAfee	Artemis!40528A8CE542
Malwarebytes	Malware.AI.3973108146
TrendMicro-HouseCall	TROJ_GEN.R03BH0CCP23
Ikarus	Trojan.MSIL.PSW
Fortinet	PossibleThreat
BitDefenderTheta	Gen:NN.ZemsilF.36344.gm0@amnzN!j

Windowsfig.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All