Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 23, 2023, 8:06 p.m.	Sept. 23, 2023, 8:08 p.m.

Size	3.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`823b5fcdef282c5318b670008b9e6922`
SHA256	`712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d`
CRC32	`F3ED3349`
ssdeep	`49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd`
PDB Path	C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware

download.exe "C:\Users\test22\AppData\Local\Temp\download.exe"
2576

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 23, 2023, 8:06 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 23, 2023, 8:06 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 23, 2023, 8:05 p.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 8:05 p.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 8:06 p.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 8:06 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2023, 8:05 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:05 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:06 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 8:06 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00312200', u'virtual_address': u'0x00002000', u'entropy': 7.987465329789692, u'name': u'.text', u'virtual_size': u'0x00312138'}

entropy

7.98746532979

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00003200', u'virtual_address': u'0x00316000', u'entropy': 7.3571597426144395, u'name': u'.rsrc', u'virtual_size': u'0x00003030'}

entropy

7.35715974261

description

A section with a high entropy has been found

entropy

0.999841646873

description

Overall entropy of this PE file is high

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Lionic	Trojan.Win32.Stealer.12!c
MicroWorld-eScan	Gen:Variant.Zusy.473064
ALYac	Gen:Variant.Zusy.473064
Cylance	unsafe
Zillya	Trojan.Stealer.Win32.123939
Sangfor	Spyware.Win32.Zusy.Vgeh
Alibaba	TrojanSpy:MSIL/Stealer.390b2c03
Cyren	W32/MSIL_Troj.CRP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.MSIL.Stealer.evy
BitDefender	Gen:Variant.Zusy.473064
Avast	Win32:SpywareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13e9ecdc
Emsisoft	Gen:Variant.Zusy.473064 (B)
F-Secure	Trojan.TR/Spy.Stealer.hpqrg
VIPRE	Gen:Variant.Zusy.473064
TrendMicro	TROJ_GEN.R002C0XGK23
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
FireEye	Gen:Variant.Zusy.473064
Sophos	Mal/Generic-S
Ikarus	Trojan.Spy.Stealer
GData	Gen:Variant.Zusy.473064
Avira	TR/Spy.Stealer.hpqrg
Antiy-AVL	Trojan[Spy]/MSIL.Stealer
Gridinsoft	Ransom.Win32.Sabsik.cl
Arcabit	Trojan.Zusy.D737E8
ZoneAlarm	Trojan-Spy.MSIL.Stealer.evy
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5442767
McAfee	Artemis!823B5FCDEF28
MAX	malware (ai score=87)
Malwarebytes	Malware.AI.1902644105
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0XGK23
Rising	Stealer.Agent!8.C2 (CLOUD)
MaxSecure	Trojan.Malware.214591709.susgen
Fortinet	PossibleThreat
BitDefenderTheta	Gen:NN.ZemsilF.36662.fp0@aiBxxmg
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (W)

download

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All