popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

faman.exe

UPX Malicious Library AntiDebug PE File DLL OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 7, 2023, 9:09 a.m. Aug. 7, 2023, 9:13 a.m.
Size 2.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 aa836df733f834e30eb28e3125b4c927
SHA256 aa5d7726d88db92d8092c76fcc90d114b925cb369c4cf6cd792a976ef4644644
CRC32 8472F92F
ssdeep 49152:acbz6nYKlCg+zewh9XN7ZcuDxKurTeZtj3hucSrDsKtMg5qVgtprWzs4wt:acbyB1+9XcuDxKjVa35jTrWzsbt
PDB Path D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ab1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c61000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2136
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 -s .\POie8R5J.7
cmdline "C:\Windows\System32\regsvr32.exe" -s .\POie8R5J.7
file C:\Users\test22\AppData\Local\Temp\pOie8R5J.7
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 204 resumed a thread in remote process 2136
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 2136
1 0 0