popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

test10.exe

Malicious Library UPX Code injection DGA PWS ScreenShot Internet API DNS Http API Socket AntiDebug OS Processor Check PE32 PE File AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 30, 2023, 7:48 a.m. Aug. 30, 2023, 7:50 a.m.
Size 840.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e35f56f0085e9bc842148702e7ba0faf
SHA256 584e30eef839ce1e4b4b796bc8af2de7ea7248141b052a91c910ec8d0bc3a2ac
CRC32 50D5B13F
ssdeep 12288:cVwlbU9NnQYaliI7K850Mc/5k9PU5eAHCbJ8rUkkeA5x5DQRsJ:cow9JOiI7KDjuWeAprFs5xxusJ
PDB Path C:\suve\bimum.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
api.2ip.ua
A 162.0.217.254
162.0.217.254
IP Address Status Action
162.0.217.254 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
pdb_path C:\suve\bimum.pdb
resource name AFX_DIALOG_LAYOUT
section {u'size_of_data': u'0x000ad000', u'virtual_address': u'0x00001000', u'entropy': 7.926004792219778, u'name': u'.text', u'virtual_size': u'0x000aceb6'} entropy 7.92600479222 description A section with a high entropy has been found
entropy 0.824791418355 description Overall entropy of this PE file is high
url http://www.openssl.org/support/faq.html
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications use DNS rule Network_DNS
description Take ScreenShot rule ScreenShot
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper reg_value "C:\Users\test22\AppData\Local\3597f98d-1c0e-40d3-90b2-ca1942d842b6\test10.exe" --AutoStart
Process injection Process 2244 resumed a thread in remote process 2360
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c8
suspend_count: 1
process_identifier: 2360
1 0 0
cmdline icacls "C:\Users\test22\AppData\Local\3597f98d-1c0e-40d3-90b2-ca1942d842b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stop.13!c
tehtris Generic.Malware
MicroWorld-eScan Gen:Heur.Mint.Titirez.0q0@M16p3Vk
FireEye Generic.mg.e35f56f0085e9bc8
CAT-QuickHeal Ransom.Stop.P5
Malwarebytes MachineLearning/Anomalous.96%
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0056f9be1 )
K7GW Trojan ( 0056f9be1 )
Cybereason malicious.eedc51
Arcabit Trojan.Mint.Titirez.EAC8A9
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HUMC
Cynet Malicious (score: 100)
TrendMicro-HouseCall TROJ_GEN.R002H07HT23
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky UDS:Trojan.Win32.Chapak.gen
BitDefender Gen:Heur.Mint.Titirez.0q0@M16p3Vk
Avast Win32:BootkitX-gen [Rtk]
Tencent Trojan.Win32.Obfuscated.gen
Emsisoft Gen:Heur.Mint.Titirez.0q0@M16p3Vk (B)
McAfee-GW-Edition BehavesLike.Win32.Lockbit.cc
Trapmine malicious.moderate.ml.score
Sophos Troj/Krypt-VK
SentinelOne Static AI - Malicious PE
Gridinsoft Ransom.Win32.STOP.bot
Microsoft Trojan:Win32/Amadey.RPQ!MTB
ZoneAlarm UDS:Trojan.Win32.Chapak.gen
GData Gen:Heur.Mint.Titirez.0q0@M16p3Vk
Google Detected
Cylance unsafe
APEX Malicious
Rising Trojan.Kryptik!1.B663 (CLASSIC)
MAX malware (ai score=81)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HFSR!tr
AVG Win32:BootkitX-gen [Rtk]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)