Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 28, 2023, 7:42 a.m.	June 28, 2023, 7:57 a.m.

Size	215.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`614a31f01a52c3c9a5819a7962e45c12`
SHA256	`0b19cf5539a01f2726205aa1e54d0ccfffddf89e64646ea497259f97379117e9`
CRC32	`31A29A16`
ssdeep	`6144:df2LhlbEyEXoFLq1qrSOyoVkeL5T+pwe8watWUjtWU:dfMhd5Zq1qrXyoPL5TQUYU`
PDB Path	c:\Users\VICTOR\source\repos\new_project\new_project\obj\Debug\new_project.pdb
Yara	Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

new_project.exe "C:\Users\test22\AppData\Local\Temp\new_project.exe"
536

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
45.33.6.223	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (19 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 28, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 28, 2023, 7:42 a.m.			0	0
IsDebuggerPresent June 28, 2023, 7:42 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

c:\Users\VICTOR\source\repos\new_project\new_project\obj\Debug\new_project.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 28, 2023, 7:42 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x077f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 28, 2023, 7:42 a.m.	process_identifier: 536 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (3 events)

file	C:\Users\test22\Links\Desktop.lnk
file	C:\Users\test22\Links\RecentPlaces.lnk
file	C:\Users\test22\Links\Downloads.lnk

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

Cynet	Malicious (score: 100)
APEX	Malicious
MaxSecure	Trojan.Malware.300983.susgen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00030e00', u'virtual_address': u'0x00002000', u'entropy': 7.772816092397277, u'name': u'.text', u'virtual_size': u'0x00030cf4'}

entropy

7.7728160924

description

A section with a high entropy has been found

entropy

0.911421911422

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

45.33.6.223

new_project.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All