Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 3, 2023, 12:50 p.m.	Oct. 3, 2023, 12:53 p.m.

Size	3.1MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`639dc278f96ff66db8b87de1ea30c4bf`
SHA256	`27ea90cf1f8f3563505a74c1fc7ba830cac87bd035a020484d2107b6d0baff3b`
CRC32	`DC5E13E2`
ssdeep	`49152:o/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:o/FTi++Ql4FEQaxuMBh/DqLdd`
PDB Path	C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware

download.exe "C:\Users\test22\AppData\Local\Temp\download.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Oct. 3, 2023, 12:50 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 3, 2023, 12:50 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 3, 2023, 12:50 p.m.			0	0
IsDebuggerPresent Oct. 3, 2023, 12:50 p.m.			0	0
IsDebuggerPresent Oct. 3, 2023, 12:50 p.m.			0	0
IsDebuggerPresent Oct. 3, 2023, 12:50 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 3, 2023, 12:50 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02310000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00472000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00496000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 3, 2023, 12:50 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00312200', u'virtual_address': u'0x00002000', u'entropy': 7.987464918844316, u'name': u'.text', u'virtual_size': u'0x00312138'}

entropy

7.98746491884

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00003200', u'virtual_address': u'0x00316000', u'entropy': 7.3571597426144395, u'name': u'.rsrc', u'virtual_size': u'0x00003030'}

entropy

7.35715974261

description

A section with a high entropy has been found

entropy

0.999841646873

description

Overall entropy of this PE file is high

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.Win32.Zusy.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.69091187
FireEye	Trojan.GenericKD.69091187
McAfee	Artemis!639DC278F96F
Cylance	unsafe
Sangfor	Spyware.Win32.Zusy.V69d
Arcabit	Trojan.Generic.D41E3F73
BitDefenderTheta	Gen:NN.ZemsilF.36662.fp0@aigquoj
Cyren	W32/MSIL_Troj.CRP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R002C0XI223
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.MSIL.Stealer.fbd
BitDefender	Trojan.GenericKD.69091187
Avast	Win32:SpywareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13e9ecdc
Emsisoft	Trojan.GenericKD.69091187 (B)
F-Secure	Trojan.TR/Spy.Stealer.hpqrg
VIPRE	Trojan.GenericKD.69091187
TrendMicro	TROJ_GEN.R002C0XI223
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Avira	TR/Spy.Stealer.hpqrg
Antiy-AVL	Trojan[Spy]/MSIL.Stealer
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win.Z.Zusy.3233792
ZoneAlarm	Trojan-Spy.MSIL.Stealer.fbd
GData	Trojan.GenericKD.69091187
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5442767
Malwarebytes	Malware.AI.884295271
Panda	Trj/Chgt.AD
APEX	Malicious
Rising	Stealer.Agent!8.C2 (CLOUD)
MAX	malware (ai score=86)
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

download

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All