popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rubber.exe

Malicious Packer Malicious Library UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 3, 2023, 1:40 p.m. April 3, 2023, 1:42 p.m.
Size 2.1MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 afac69dd87bbf4bd13adb1180cfd486f
SHA256 186171f3b0b6e53f52e63195368b5f90531c22410b912c828e9b506b0f3429b7
CRC32 C4EB6762
ssdeep 24576:q5KIWGEec6BcadqZODhnQI+zK4DnB2mNLqJ4UPk4a9SKOgst8anFYXF0+xJv3E4a:oS8+HZU+Xnl0ePsuYII1XRL0D
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
161.97.160.16 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: panic:
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: runtime error: invalid memory address or nil pointer dereference
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: [signal
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0xc0000005
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: code=
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x0
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: addr=
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x10
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: pc=
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x45c002
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: goroutine
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: running
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: bufio.(*Reader).fill
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1246df80
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: /usr/lib/go-1.13/src/bufio/bufio.go
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0xc2
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: bufio.(*Reader).ReadSlice
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1246df80
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0xa
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1015700
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x0
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1000
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1247c000
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x56f100
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: /usr/lib/go-1.13/src/bufio/bufio.go
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x32
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: bufio.(*Reader).ReadBytes
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1246df80
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x100a
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1000
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x1247c000
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x0
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x0
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x4eb940
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: /usr/lib/go-1.13/src/bufio/bufio.go
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0x4c
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: bufio.(*Reader).ReadString
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: /usr/lib/go-1.13/src/bufio/bufio.go
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: main.main
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: /root/files/rubber.go
console_handle: 0x0000000b
1 1 0

WriteConsoleA

 buffer: 0xd0
console_handle: 0x0000000b
1 1 0
section .symtab
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        8b 40 10 89 3c 24 29 f5 89 ef 87 dd f7 db 87 dd
        

      
        exception.symbol:
        rubber+0x5c002
        

      
        exception.instruction:
        mov eax, dword ptr [eax + 0x10]
        

      
        exception.module:
        rubber.exe
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.offset:
        376834
        

      
        exception.address:
        0x45c002
        

      
    
  
    
      
        registers.esp:
        306634336
        

      
        registers.edi:
        0
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4096
        

      
        registers.edx:
        306634624
        

      
        registers.ebx:
        306692096
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        4096
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0001a200', u'virtual_address': u'0x00185000', u'entropy': 7.992168818932078, u'name': u'/19', u'virtual_size': u'0x0001a093'}
                                        
                                    
                                        
                                            entropy
                                            7.99216881893
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00006c00', u'virtual_address': u'0x001a0000', u'entropy': 7.969390621453084, u'name': u'/32', u'virtual_size': u'0x00006b17'}
                                        
                                    
                                        
                                            entropy
                                            7.96939062145
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00002200', u'virtual_address': u'0x001a7000', u'entropy': 7.947491312418448, u'name': u'/46', u'virtual_size': u'0x000021a3'}
                                        
                                    
                                        
                                            entropy
                                            7.94749131242
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00004200', u'virtual_address': u'0x001aa000', u'entropy': 7.970682871931988, u'name': u'/63', u'virtual_size': u'0x00004142'}
                                        
                                    
                                        
                                            entropy
                                            7.97068287193
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00032a00', u'virtual_address': u'0x001b0000', u'entropy': 7.996206265129924, u'name': u'/99', u'virtual_size': u'0x000329a6'}
                                        
                                    
                                        
                                            entropy
                                            7.99620626513
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0001bc00', u'virtual_address': u'0x001e3000', u'entropy': 7.988719404284502, u'name': u'/112', u'virtual_size': u'0x0001bb3b'}
                                        
                                    
                                        
                                            entropy
                                            7.98871940428
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00008800', u'virtual_address': u'0x001ff000', u'entropy': 7.923397145124942, u'name': u'/124', u'virtual_size': u'0x000086ec'}
                                        
                                    
                                        
                                            entropy
                                            7.92339714512
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.240171551108
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            161.97.160.16
                                        
                                    
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
LdrGetProcedureAddress

  
  
    
      
    
  


  
    
      ordinal:
      
        
          0
        
      
      
      

    
  
    
      function_address:
      
        
          0x0018fe3d
        
      
      
      

    
  
    
      function_name:
      
        
          wine_get_version
        
      
      
      

    
  
    
      module:
      
        
          ntdll
        
      
      
      

    
  
    
      module_address:
      
        
          0x778a0000
        
      
      
      

    
  


    

3221225785

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Cynet
                                    Malicious (score: 99)
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_60% (D)
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Generic@AI.81 (RDMK:cmRtazrJHWV7KTNq69naZFistF1k)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Gen:Variant.Ursu.800461 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Heuristic.HEUR/AGEN.1318225
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    Jiangmin
                                    Trojan.Gen.aqx
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    HEUR/AGEN.1318225
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Ursu.DC36CD
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Gen:Variant.Ursu.800461
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=81)
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.Backdoor.Gorsh
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan.WinGo.Runner
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    dead_host
                                    161.97.160.16:8089
                                    
                                


                            

                        

                            

                                

                                    dead_host
                                    192.168.56.103:49161