Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 11, 2023, 10:52 p.m.	June 11, 2023, 11:03 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`055e1dcecd2c329e5aa4e9ae798c8a6c`
SHA256	`752bb1473394caf8c3dd0b309317b4785dd17d9cfed335f8c5d498dbdc751d69`
CRC32	`B0CD39BF`
ssdeep	`24576:01iewlqB6p4INSO1cG5hgIJNRRjm03DZEj2rw2/IwC:0Qe2q8p5M0cG3g0PRj9Eje/I`
PDB Path	mUuD.pdb
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

wininit.exe "C:\Users\test22\AppData\Local\Temp\wininit.exe"
1836

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 11, 2023, 10:22 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 11, 2023, 10:22 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 11, 2023, 10:22 p.m.			0	0
IsDebuggerPresent June 11, 2023, 10:22 p.m.			0	0
IsDebuggerPresent June 11, 2023, 10:22 p.m.			0	0
IsDebuggerPresent June 11, 2023, 10:22 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

mUuD.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 11, 2023, 10:22 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00635000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00637000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 11, 2023, 10:22 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00416000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00109000', u'virtual_address': u'0x00002000', u'entropy': 7.856778316412906, u'name': u'.text', u'virtual_size': u'0x00108f3c'}

entropy

7.85677831641

description

A section with a high entropy has been found

entropy

0.998116760829

description

Overall entropy of this PE file is high

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Zbot.1e!c
MicroWorld-eScan	Trojan.GenericKD.67413531
FireEye	Trojan.GenericKD.67413531
ALYac	Trojan.GenericKD.67413531
Malwarebytes	Trojan.MalPack.PNG
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005a6b3d1 )
Alibaba	Trojan:MSIL/Kryptik.3d62e44c
K7GW	Trojan ( 005a6b3d1 )
Cyren	W32/MSIL_Kryptik.JLG.gen!Eldorado
Symantec	Scr.Malcode!gdn34
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AJAE
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	VHO:Trojan.MSIL.Agentb.gen
BitDefender	Trojan.GenericKD.67413531
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Redcap.Nqil
Emsisoft	Trojan.GenericKD.67413531 (B)
F-Secure	Trojan.TR/Redcap.syiyb
DrWeb	Trojan.PackedNET.392
VIPRE	Trojan.GenericKD.67413531
TrendMicro	TROJ_GEN.R03BC0DF923
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Trapmine	malicious.moderate.ml.score
Sophos	Troj/Krypt-YZ
Ikarus	Trojan-Spy.SnakeKeylogger
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.syiyb
Antiy-AVL	Trojan/MSIL.Kryptik
Microsoft	Trojan:MSIL/LokiBot.CXIS!MTB
Arcabit	Trojan.Generic.D404A61B
ZoneAlarm	VHO:Trojan.MSIL.Agentb.gen
GData	Trojan.GenericKD.67413531
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5437941
McAfee	Artemis!055E1DCECD2C
MAX	malware (ai score=81)
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R03BC0DF923
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:u3TJBZ92X2Ntqmv5z5GpkA)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AGUH!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

wininit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All