Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

Apppdfread.msi

Generic Malware Antivirus Malicious Library MSOffice File OS Processor Check CAB

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 11, 2023, 2:59 p.m.	July 11, 2023, 3:01 p.m.

Size	7.5MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {6F462FAD-2B8F-41AD-8B0A-AE47802A304D}, Number of Words: 10, Subject: Firefox 222, Author: Firefox 222, Name of Creating Application: Firefox 222, Template: ;1036, Comments: Cette base de donnes d'installation contient le code et les donnes ncessaires l'installation de Firefox 222., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5	`c328b1c0c6809ae49d020d353bcc843a`
SHA256	`63acfba6c300494eb50cb70323a5ec0af280df40d72f8832cf13dcbc42b4ca00`
CRC32	`CAC36F3D`
ssdeep	`196608:zHAvymVImLDN0+/S+csp/oqvxiKAzWjB2970a+OeSYUotB:DViImJbq4p/oqvxfAzZ5V+jSBot`
Yara	OS_Processor_Check_Zero - OS Processor Check CAB_file_format - CAB archive file Malicious_Library_Zero - Malicious_Library Antivirus - Contains references to security software Microsoft_Office_File_Zero - Microsoft Office File Generic_Malware_Zero - Generic Malware

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\Apppdfread.msi
2556
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.157.162.126	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49166 -> 185.157.162.126:443	906200095	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (BitRAT)	undefined
TCP 185.157.162.126:443 -> 192.168.56.101:49166	2030724	ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)	Domain Observed Used for C2 Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49166 185.157.162.126:443	CN=BitRAT	CN=BitRAT	fb:e2:a7:63:31:a4:36:70:f5:2c:87:7b:ab:0b:4b:f8:e5:9c:9b:7a

Queries for the computername (3 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 11, 2023, 2:59 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA July 11, 2023, 2:59 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 11, 2023, 2:59 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 11, 2023, 2:59 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 11, 2023, 2:59 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736b1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b01000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ac4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b02000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72781000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72761000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726f1000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726e2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x046b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 11, 2023, 2:59 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 11, 2023, 2:53 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 11, 2023, 2:59 p.m.	total_number_of_free_bytes: 13315186688 free_bytes_available: 13315186688 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW July 11, 2023, 2:59 p.m.	number_of_free_clusters: 3250778 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Kaspersky	HEUR:Trojan.OLE2.Alien.gen
ZoneAlarm	HEUR:Trojan.OLE2.Alien.gen

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1	0
LookupPrivilegeValueW July 11, 2023, 2:59 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

185.157.162.126