popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rofl.exe

UPX Malicious Library ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 18, 2023, 7:16 a.m. July 18, 2023, 7:20 a.m.
Size 1016.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 2ee4b1df29fe85c016c84d5855b0ec9f
SHA256 686f9d8e29ba0fd3e4285ecd2f85716bea5be6c3b6571c955c9f6ea9274dc9cf
CRC32 B2D25665
ssdeep 12288:aExUboCrf3E1zPXkbaEGJmtNjVu2q8OqdCB5GDdSUHrCAZWgAYhaoa6Wn4jfHh1:a3skbXG+NlOqFeA/BO6W4jp
PDB Path C:\A10\y8weofy87n\output.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
pdb_path C:\A10\y8weofy87n\output.pdb
section .HAWKe
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
rofl+0xb521 @ 0x8fb521
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 2751548
registers.edi: 5632000
registers.eax: 2704
registers.ebp: 2751572
registers.edx: 2130566132
registers.ebx: 8192
registers.esi: 10309656
registers.ecx: 2564
1 0 0

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895
stacktrace+0x84 memdup-0x1af @ 0x73980470
hook_in_monitor+0x45 lde-0x133 @ 0x739742ea
New_ntdll_RtlAddVectoredExceptionHandler+0x20 New_ntdll_RtlCompressBuffer-0xed @ 0x73996340
0x920ee
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1
0x1

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x76d80895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 1635384
registers.rsi: 20
registers.r10: 0
registers.rbx: 1
registers.rsp: 1637408
registers.r11: 596580
registers.r8: 64
registers.r9: 4284129280
registers.rdx: 1636728
registers.r12: 599640
registers.rbp: 4284129280
registers.rdi: 4283830288
registers.rax: 1635064
registers.r13: 591256
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009d7000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 462848
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 53248
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4141056
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bbd000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f70000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76281000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75d21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fa1000
process_handle: 0xffffffff
1 0 0
description AppLaunch.exe tried to sleep 167 seconds, actually delayed analysis time by 167 seconds
wmi SELECT * FROM Win32_Processor
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 28672
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003d0000
process_handle: 0xffffffff
1 0 0
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
wmi SELECT * FROM Win32_Processor
buffer Buffer with sha1: d57b4651cc02a0e98d909fc6d0696a7a409ed9d3
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2704
region_size: 462848
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk.dll
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2704
process_handle: 0x0000002c
1 1 0
Process injection Process 2560 called NtSetContextThread to modify thread in remote process 2704
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3800264
registers.edi: 0
registers.eax: 4281334
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2704
1 0 0
Process injection Process 2560 resumed a thread in remote process 2704
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2704
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2708
thread_handle: 0x00000020
process_identifier: 2704
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2704
region_size: 462848
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0

WriteProcessMemory

 buffer:
base_address: 0x00400000
process_identifier: 2704
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2704
process_handle: 0x0000002c
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3800264
registers.edi: 0
registers.eax: 4281334
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2704
1 0 0

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2704
1 0 0

CreateProcessInternalW

 thread_identifier: 2872
thread_handle: 0x000001e8
process_identifier: 2868
current_directory:
filepath: C:\Windows\System32\certreq.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\certreq.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001b0
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Strab.4!c
MicroWorld-eScan Gen:Trojan.Heur.@GW@I9114hei
ALYac Gen:Trojan.Heur.@GW@I9114hei
VIPRE Gen:Trojan.Heur.@GW@I9114hei
Sangfor Trojan.Win32.Agent.Vvsj
Cybereason malicious.f29fe8
BitDefenderTheta AI:Packer.EC64F15F1C
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.GLWW
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Trojan.Heur.@GW@I9114hei
Avast Win32:Evo-gen [Trj]
Rising Trojan.Generic@AI.90 (RDML:l2PQivzRvxuRaZmmjyC57g)
Emsisoft Gen:Trojan.Heur.@GW@I9114hei (B)
F-Secure Trojan.TR/AD.Nekark.wwrgd
DrWeb Trojan.PWS.Siggen3.31435
McAfee-GW-Edition Artemis!Trojan
FireEye Gen:Trojan.Heur.@GW@I9114hei
Sophos Mal/Generic-S
GData Gen:Trojan.Heur.@GW@I9114hei
Webroot W32.Trojan.Gen
Avira TR/AD.Nekark.wwrgd
Gridinsoft Malware.Win32.Gen.bot
Arcabit Trojan.Heur.E3B8AA
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Sabsik.FL.B!ml
McAfee GenericRXVT-WS!2EE4B1DF29FE
MAX malware (ai score=85)
Cylance unsafe
Panda Trj/Chgt.AD
MaxSecure Trojan.Malware.121218.susgen
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)