popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sunor.exe

Malicious Library UPX AntiDebug PE File DLL OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 22, 2023, 7:47 a.m. Sept. 22, 2023, 7:51 a.m.
Size 1.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a7e4eb402115dec3547194a610da7760
SHA256 5e3925f4329916d60714a96798a25e5d680d36f0cfa1a9d69879b7b39cec689d
CRC32 E84248A2
ssdeep 49152:CvxfXTf9aIY41N9WGdqcDqnFwWTXwBIq+eP4zMD:Cvxr9aMXqcCr7bz6
PDB Path D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d62000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75591000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x723b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72281000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72261000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72231000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2780
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 gE4xMTP.S -u /S
cmdline "C:\Windows\System32\regsvr32.exe" gE4xMTP.S -u /S
file C:\Users\test22\AppData\Local\Temp\gE4xMtP.S
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 2660 resumed a thread in remote process 2780
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c0
suspend_count: 1
process_identifier: 2780
1 0 0
Bkav W32.AIDetectMalware
MicroWorld-eScan Trojan.Uztuby.4
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
Arcabit Trojan.Uztuby.4
Cyren W32/Kryptik.KQH.gen!Eldorado
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Packed.Uztuby-10007804-0
BitDefender Trojan.Uztuby.4
NANO-Antivirus Virus.Win32.Gen.ccmw
Avast Win32:Evo-gen [Trj]
Emsisoft Trojan.Uztuby.4 (B)
VIPRE Trojan.Uztuby.4
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
FireEye Generic.mg.a7e4eb402115dec3
Sophos Mal/Dropper-AU
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=81)
Microsoft Trojan:Win32/Zenpak.GPB!MTB
GData Trojan.Uztuby.4
Google Detected
ALYac Trojan.Uztuby.4
Cylance unsafe
Rising Trojan.Generic@AI.100 (RDML:u9L5bNXUwmrpg8e1i1/tsQ)
Fortinet W32/Kryptik.HUEI!tr
AVG Win32:Evo-gen [Trj]
Cybereason malicious.edb1c8