popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Managing.ps1

Generic Malware Antivirus
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 18, 2023, 9:55 a.m. Oct. 18, 2023, 9:57 a.m.
Size 176.7KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 7bbd630da159177a21f5ce10f73fb571
SHA256 9eda35e91f387f1ab2897a6f43eee586cfb348a3e73d62fefc986fb3b1e46121
CRC32 A7E9D7C2
ssdeep 3072:cMjrW/NRpFvoHmd6SIr9zpnUlUDJfQgprLNGcvRtFp0I11:bnWHpFv6y6SIr9zpnUlUDJx7RWQ1
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0504c060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0504c060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0504c060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0504c060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0225b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025af000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x062d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06351000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06352000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x06353000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
MicroWorld-eScan Trojan.GenericKD.69823156
VIPRE Trojan.GenericKD.69823156
Arcabit Trojan.Generic.D4296AB4
Symantec Backdoor.ASync!gm
ESET-NOD32 PowerShell/Agent.BEA
Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.PowerShell.Kryptik.gen
BitDefender Trojan.GenericKD.69823156
Tencent Win32.Trojan.Kryptik.Tnkl
Emsisoft Trojan.GenericKD.69823156 (B)
FireEye Trojan.GenericKD.69823156
Ikarus Trojan.MSIL.Agent
Gridinsoft Trojan.U.AsyncRAT.bot
Microsoft Trojan:Win32/Znyonm
ZoneAlarm HEUR:Trojan.PowerShell.Kryptik.gen
GData Trojan.GenericKD.69823156
ALYac Trojan.PowerShell.Agent
MAX malware (ai score=81)
AVG Script:SNH-gen [Trj]