popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wowo.exe

UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 7, 2023, 9:25 a.m. Aug. 7, 2023, 9:34 a.m.
Size 631.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c2ca868ecfdd5ee7a6d4143890a29872
SHA256 d440158b91d965693007b539131704b3bdd72e864b5adc1c0e230213acd3d97b
CRC32 BE1CE85C
ssdeep 12288:i23s5mTknITB0mEN/yMNDljDKZn5A2t1CNW:VzTBYKMNJuk2t1CN
Yara
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
aa.imgjeoogbb.com
A 154.221.26.108
154.221.26.108
us.imgjeoigaa.com
A 103.100.211.218
103.100.211.218
IP Address Status Action
103.100.211.218 Active Moloch
154.221.26.108 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 154.221.26.108:80 2045057 ET MALWARE Win32/Fabookie.ek CnC Request M4 (GET) A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header suspicious_request POST http://aa.imgjeoogbb.com/check/?sid=144266&key=9905c940269e74e12bc7b18ce6ca2d14
request GET http://us.imgjeoigaa.com/sts/imagc.jpg
request GET http://aa.imgjeoogbb.com/check/safe
request POST http://aa.imgjeoogbb.com/check/?sid=144266&key=9905c940269e74e12bc7b18ce6ca2d14
request POST http://aa.imgjeoogbb.com/check/?sid=144266&key=9905c940269e74e12bc7b18ce6ca2d14
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ab0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00422000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00455000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00457000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000ff3da000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2128
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002ab0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2128
region_size: 1249280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002c20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 58\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 38\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 81\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 41\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 32\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 30\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 94\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 68\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 90\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 29\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 91\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 96\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 46\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 89\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 100\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 86\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 87\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 43\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 104\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 67\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 33\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 102\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 99\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 71\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 42\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 54\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 60\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 48\Network\Cookies
file C:\Users\test22\AppData\Local\Temp\latestplayer.exe
file C:\Users\test22\AppData\Local\Temp\aafg31.exe
file C:\Users\test22\AppData\Local\Temp\aafg31.exe
file C:\Users\test22\AppData\Local\Temp\latestplayer.exe
file C:\Users\test22\AppData\Local\Temp\latestplayer.exe
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x0009d200', u'virtual_address': u'0x00002000', u'entropy': 7.284221234527371, u'name': u'.text', u'virtual_size': u'0x0009d054'} entropy 7.28422123453 description A section with a high entropy has been found
entropy 0.996827914354 description Overall entropy of this PE file is high
MicroWorld-eScan Trojan.GenericKD.68536382
FireEye Generic.mg.c2ca868ecfdd5ee7
CAT-QuickHeal Trojan.MokesFC.S23223552
McAfee GenericRXOO-YN!C2CA868ECFDD
Malwarebytes Trojan.Crypt.MSIL.Generic
Sangfor Trojan.Win32.Save.a
K7AntiVirus Ransomware ( 005a8b921 )
Alibaba TrojanDownloader:MSIL/Mokes.a53a49e4
K7GW Ransomware ( 005a8b921 )
Cybereason malicious.ea52c1
Arcabit IL:Trojan.MSILZilla.D26A3
BitDefenderTheta Gen:NN.ZemsilF.36348.Nm0@aarpAzd
Cyren W32/MSIL_Kryptik.FFY.gen!Eldorado
Symantec Scr.Malcode!gdn33
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Agent.UZA
Cynet Malicious (score: 100)
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXDHEZ
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
BitDefender Trojan.GenericKD.68536382
Tencent Msil.Trojan-Downloader.Shortloader.Uimw
Sophos Troj/ILAgent-I
F-Secure Trojan.TR/Agent.jgmmb
DrWeb Trojan.MulDropNET.43
VIPRE IL:Trojan.MSILZilla.9891
TrendMicro Trojan.Win32.SMOKELOADER.YXDHEZ
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Trapmine malicious.moderate.ml.score
Emsisoft Trojan.GenericKD.68536382 (B)
Avira TR/Agent.jgmmb
MAX malware (ai score=83)
Gridinsoft Trojan.Win32.Amadey.bot
Microsoft Trojan:MSIL/Mokes.B!MTB
ViRobot Trojan.Win.Z.Agent.646144.AL
ZoneAlarm HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
GData Trojan.GenericKD.68536382
Google Detected
AhnLab-V3 Malware/Win.Generic.C4478643
Acronis suspicious
VBA32 Trojan.MSIL.Injector.gen
Cylance unsafe
Panda Trj/GdSda.A
APEX Malicious
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FFMZ!tr
AVG Win32:DropperX-gen [Drp]
DeepInstinct MALICIOUS