popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

@Shun2463.txt_.txt

ScreenShot AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 27, 2023, 11:10 a.m. Aug. 27, 2023, 11:12 a.m.
Size 2.0MB
Type ASCII text, with very long lines, with no line terminators
MD5 c3a84146c32893be4d862ccd2e62abb2
SHA256 053d5e1e96bf6c648c1bf0cdef60e4d640628e19ef5ea405e53cacc663477ad7
CRC32 61FC9E15
ssdeep 24576:nzCxwDZepeCDBMS6wdw12YB1mfXo4UB43osGB0t/VYFXglRBFhnI9X27e07oxpN6:YtvYdX+ZVYBaRh8GKmoDGE0tmS
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x733c2000
process_handle: 0xffffffff
1 0 0
FireEye Gen:Variant.Ser.MSILHeracles.2311
Arcabit Trojan.Ser.MSILHeracles.D907
BitDefender Gen:Variant.Ser.MSILHeracles.2311
MicroWorld-eScan Gen:Variant.Ser.MSILHeracles.2311
Emsisoft Gen:Variant.Ser.MSILHeracles.2311 (B)
VIPRE Gen:Variant.Ser.MSILHeracles.2311
MAX malware (ai score=84)
GData Gen:Variant.Ser.MSILHeracles.2311
ALYac Gen:Variant.Ser.MSILHeracles.2311
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep