popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

coder.jpg.ps1

Generic Malware Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 24, 2023, 9:12 a.m. Aug. 24, 2023, 9:14 a.m.
Size 1.6MB
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 9fd5e336e107dff7b6636e4d3c59ab87
SHA256 1cc0b3adcf389ebff07291223e8f2c9a9b7091de96baaaf583d1444bc769fb48
CRC32 42E93227
ssdeep 6144:tFmg2/a9VcVGAPJazeU3tDbg5/snTh+/3YiIVeGgHa14CrqjXxn6qCMcteWKh4k+:20
Yara
  • Antivirus - Contains references to security software

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Name : MicrosoftEdgeUpdate
console_handle: 0x0000001f
1 1 0

WriteConsoleW

 buffer: Path : \MicrosoftEdgeUpdate
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: State : 3
console_handle: 0x00000027
1 1 0

WriteConsoleW

 buffer: Enabled : True
console_handle: 0x0000002b
1 1 0

WriteConsoleW

 buffer: LastRunTime : 1899-12-30 오전 12:00:00
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: LastTaskResult : 1
console_handle: 0x00000033
1 1 0

WriteConsoleW

 buffer: NumberOfMissedRuns : 0
console_handle: 0x00000037
1 1 0

WriteConsoleW

 buffer: NextRunTime : 2023-08-24 오후 12:14:10
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: Definition : System.__ComObject
console_handle: 0x0000003f
1 1 0

WriteConsoleW

 buffer: Xml : <?xml version="1.0" encoding="UTF-16"?>
console_handle: 0x00000043
1 1 0

WriteConsoleW

 buffer: <Task version="1.2" xmlns="http://schemas.microsoft.com/wi
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: ndows/2004/02/mit/task">
console_handle: 0x0000004b
1 1 0

WriteConsoleW

 buffer: <RegistrationInfo>
console_handle: 0x0000004f
1 1 0

WriteConsoleW

 buffer: <Description>Runs a script every 2 minutes</Descriptio
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: n>
console_handle: 0x00000057
1 1 0

WriteConsoleW

 buffer: </RegistrationInfo>
console_handle: 0x0000005b
1 1 0

WriteConsoleW

 buffer: <Triggers>
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: <TimeTrigger>
console_handle: 0x00000063
1 1 0

WriteConsoleW

 buffer: <Repetition>
console_handle: 0x00000067
1 1 0

WriteConsoleW

 buffer: <Interval>PT2M</Interval>
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: <StopAtDurationEnd>false</StopAtDurationEnd>
console_handle: 0x0000006f
1 1 0

WriteConsoleW

 buffer: </Repetition>
console_handle: 0x00000073
1 1 0

WriteConsoleW

 buffer: <StartBoundary>2023-08-24T12:12:10</StartBoundary>
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: <Enabled>true</Enabled>
console_handle: 0x0000007b
1 1 0

WriteConsoleW

 buffer: </TimeTrigger>
console_handle: 0x0000007f
1 1 0

WriteConsoleW

 buffer: </Triggers>
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: <Settings>
console_handle: 0x00000087
1 1 0

WriteConsoleW

 buffer: <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesP
console_handle: 0x0000008b
1 1 0

WriteConsoleW

 buffer: olicy>
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: <DisallowStartIfOnBatteries>false</DisallowStartIfOnBa
console_handle: 0x00000093
1 1 0

WriteConsoleW

 buffer: tteries>
console_handle: 0x00000097
1 1 0

WriteConsoleW

 buffer: <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: <AllowHardTerminate>true</AllowHardTerminate>
console_handle: 0x0000009f
1 1 0

WriteConsoleW

 buffer: <StartWhenAvailable>false</StartWhenAvailable>
console_handle: 0x000000a3
1 1 0

WriteConsoleW

 buffer: <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvai
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: lable>
console_handle: 0x000000ab
1 1 0

WriteConsoleW

 buffer: <IdleSettings>
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: <Duration>PT10M</Duration>
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: <WaitTimeout>PT1H</WaitTimeout>
console_handle: 0x000000b7
1 1 0

WriteConsoleW

 buffer: <StopOnIdleEnd>true</StopOnIdleEnd>
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: <RestartOnIdle>false</RestartOnIdle>
console_handle: 0x000000bf
1 1 0

WriteConsoleW

 buffer: </IdleSettings>
console_handle: 0x000000c3
1 1 0

WriteConsoleW

 buffer: <AllowStartOnDemand>true</AllowStartOnDemand>
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: <Enabled>true</Enabled>
console_handle: 0x000000cb
1 1 0

WriteConsoleW

 buffer: <Hidden>false</Hidden>
console_handle: 0x000000cf
1 1 0

WriteConsoleW

 buffer: <RunOnlyIfIdle>false</RunOnlyIfIdle>
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: <WakeToRun>false</WakeToRun>
console_handle: 0x000000d7
1 1 0

WriteConsoleW

 buffer: <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
console_handle: 0x000000db
1 1 0

WriteConsoleW

 buffer: <Priority>7</Priority>
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: </Settings>
console_handle: 0x000000e3
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027af000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x060e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\Public\BTXQJSSA.ps1
file C:\Users\Public\BTXQJSSA.bat
file C:\Users\Public\BTXQJSSA.vbs