popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspub1.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 19, 2023, 10:32 a.m. Oct. 19, 2023, 10:34 a.m.
Size 259.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d29b29f543a8e7145d225a7a81818308
SHA256 b91406036d01a7749bf1b64e2160ed50215f4b0167f401fc66c3d6d5e090a1cd
CRC32 D630E32C
ssdeep 3072:RABNMvnyIjLnGlFSmCaPvAlDTM3nmB6zDacIVRLu1T8FE7TO:iayIj7GLSmCaPvA9cnmiDuM10EG
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c4e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1804
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000009c
1 0 0
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1804
process_handle: 0x0000009c
1 1 0
Process injection Process 1072 called NtSetContextThread to modify thread in remote process 1804
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000098
process_identifier: 1804
1 0 0
Process injection Process 1072 resumed a thread in remote process 1804
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000098
suspend_count: 1
process_identifier: 1804
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 840
thread_handle: 0x00000098
process_identifier: 1804
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\toolspub1.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\toolspub1.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\toolspub1.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000009c
1 1 0

NtGetContextThread

 thread_handle: 0x00000098
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 1804
process_handle: 0x0000009c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1804
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000009c
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1804
process_handle: 0x0000009c
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4206040
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000098
process_identifier: 1804
1 0 0

NtResumeThread

 thread_handle: 0x00000098
suspend_count: 1
process_identifier: 1804
1 0 0
Bkav W32.AIDetectMalware
FireEye Generic.mg.d29b29f543a8e714
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.dm
Cylance unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00516fdf1 )
K7GW Trojan ( 005a15901 )
Cybereason malicious.b66af7
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan.Win32.Agent.gen
Avast PWSX-gen [Trj]
Tencent Trojan.Win32.Obfuscated.gen
Trapmine malicious.high.ml.score
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
Google Detected
Kingsoft malware.kb.a.1000
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:Trojan.Win32.Agent.gen
Acronis suspicious
VBA32 Malware-Cryptor.Azorult.gen
Rising Trojan.Generic@AI.100 (RDML:Gg+p4Ljy5kgOih7EHlcBsQ)
Ikarus Trojan.Win32.Crypt
AVG PWSX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)