Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

ss.exe

Malicious Library UPX PE32 MZP Format PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 29, 2023, 5:32 p.m.	March 29, 2023, 5:35 p.m.

Size	734.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`efd45307df4754e7facbb561fb091721`
SHA256	`6a2c84aa44e56953f4e2af1e6eb79c80997695ad74db5b80a17e2134feff946a`
CRC32	`0F182783`
ssdeep	`12288:zPDiJJG05qrVujzjkv45nG2JoGhkgGt4z9MqCb4jyKrxo6EbpYx0:rmb3GVsfkv4I2Wi0t4s4jPG6Eb`
Yara	mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature

ss.exe "C:\Users\test22\AppData\Local\Temp\ss.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
206.188.197.143	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 29, 2023, 5:33 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AG

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73662000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 region_size: 299008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 region_size: 299008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 region_size: 241664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 253952 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 29, 2023, 5:32 p.m.	show_type: 0 filepath_r: 111111111111111 parameters: filepath: 111111111111111		0	0

Communicates with host for which no DNS query was performed (1 event)

host

206.188.197.143

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

206.188.197.143:80