Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 6, 2023, 4:52 p.m.	Sept. 6, 2023, 4:54 p.m.

Size	453.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`14d292bf807057abe213a87a80b25f21`
SHA256	`adacbcb347d5e73a7a2d1b2601d0113920d390bd6deb02f689122af81cc60611`
CRC32	`53138E53`
ssdeep	`6144:2Ya62XMMl7ssvNDoTgsXhApQOg4q2S8BpUKzTW7e+Fhu2Y9UUPqpe4RBxAWOH8qE:2YYrl77CvUQOg4kypa7e+pUj47ic3`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer IsPE32 - (no description)

ORo0LtlX0gmac.exe "C:\Users\test22\AppData\Local\Temp\ORo0LtlX0gmac.exe"
1440
- gdugzcy.exe "C:\Users\test22\AppData\Local\Temp\gdugzcy.exe"
  516

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 6, 2023, 4:52 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 516 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 6, 2023, 4:52 p.m.	process_identifier: 516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ca0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdugzcy.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdugzcy.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\gdugzcy.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000d200', u'virtual_address': u'0x0003b000', u'entropy': 6.891034331346553, u'name': u'.rsrc', u'virtual_size': u'0x0000d1a0'}

entropy

6.89103433135

description

A section with a high entropy has been found

entropy

0.617647058824

description

Overall entropy of this PE file is high

Terminates another process (50 out of 18292 events)

Time & API	Arguments	Status
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2112 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2112 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2148 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2148 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2184 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2184 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2220 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2220 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2256 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2256 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2308 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2308 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2352 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2352 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2388 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2388 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2424 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2424 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2464 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2464 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2500 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2500 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2536 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2536 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2572 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2572 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2608 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2608 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2644 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2644 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2680 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2680 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2716 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2716 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2752 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2752 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2788 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2788 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2824 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2824 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2860 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2860 process_handle: 0x000000b8	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2896 process_handle: 0x000000b4
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2896 process_handle: 0x000000b4	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2932 process_handle: 0x000000c0
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2932 process_handle: 0x000000c0	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2968 process_handle: 0x000000bc
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 2968 process_handle: 0x000000bc	1
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 3004 process_handle: 0x000000b8
NtTerminateProcess Sept. 6, 2023, 4:52 p.m.	status_code: 0x00000000 process_identifier: 3004 process_handle: 0x000000b8	1

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Strab.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Strictor.281873
McAfee	Artemis!14D292BF8070
Cylance	unsafe
VIPRE	Trojan.NSISX.Spy.Gen.24
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ETGQ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Strab.gen
BitDefender	Gen:Variant.Strictor.281873
Avast	Win32:TrojanX-gen [Trj]
Rising	Trojan.Generic@AI.100 (RDML:mRkGIN7FICYaNmz1vc8ndg)
Emsisoft	Gen:Variant.Strictor.281873 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.14d292bf807057ab
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Injector
GData	Gen:Variant.Strictor.281873
Arcabit	Trojan.Strictor.D44D11
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:MSIL/AgentTesla.ASDH!MTB
ALYac	Gen:Variant.Jaik.173806
MAX	malware (ai score=82)
Malwarebytes	Generic.Malware/Suspicious
BitDefenderTheta	Gen:NN.ZexaF.36662.ruW@amzdLWhi
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

ORo0LtlX0gmac.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All