popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

TEST32.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 4, 2023, 10:49 a.m. Nov. 4, 2023, 10:51 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 993c85b5b1c94bfa3b7f45117f567d09
SHA256 cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37
CRC32 DFD326B1
ssdeep 12288:1SCFweWT8xCrC9ihr40AZWUBmEYvWe0kRUj8apA331/ZLGpn2OZ4H3ro:1lFweWT8x/9Ir40O8FvWeEJy3JZY63r
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
api.ipify.org
A 173.231.16.77
A 64.185.227.156
CNAME api4.ipify.org
A 104.237.62.212
64.185.227.156
IP Address Status Action
149.40.62.171 Active Moloch
164.124.101.2 Active Moloch
64.185.227.156 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2047702 ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup Misc activity
TCP 192.168.56.103:49163 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 192.168.56.103:49164 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 192.168.56.103:49163 -> 64.185.227.156:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 64.185.227.156:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49163 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 192.168.56.103:49164 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
UDP 192.168.56.103:52760 -> 8.8.8.8:53 2047702 ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup Misc activity
TCP 64.185.227.156:443 -> 192.168.56.103:49165 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 149.40.62.171:15666 -> 192.168.56.103:49161 2260003 SURICATA Applayer Protocol detection skipped Generic Protocol Command Decode
TCP 192.168.56.103:49163 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 192.168.56.103:49164 -> 64.185.227.156:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
file C:\Program Files\Mozilla Firefox\nss3.dll
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\igkpcodhieompeloncfnbekccinhapdb
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dfmbcapkkeejcpmfhpnglndfkgmalhik
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bocpokimicclpaiekenaeelehdjllofo
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gehmmocbbkpblljhkekmfhjpfbkclbph
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ldinpeekobnhjjdofggfgjlcehhmanlj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhhldecdfagpbfggphklkaeiocfnaafm
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Ya Passman Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\apnehcjmnengpnmccpaibjmhhoadaico
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\UC Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\dppgmdbiimibapkepcbdbmkaabgiofem
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\mfgccjchihfkkindfppnaooecgfneiii
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\nhhldecdfagpbfggphklkaeiocfnaafm
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\naepdomgkenhinolocfifgehidddafch
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
domain api.ipify.org
section {u'size_of_data': u'0x0000f200', u'virtual_address': u'0x00107000', u'entropy': 6.832130813055755, u'name': u'.reloc', u'virtual_size': u'0x0000f15c'} entropy 6.83213081306 description A section with a high entropy has been found
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1
2 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4A4AE8F-B9F7-4CC7-8A6C-BF7EEE87ACA5}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4A4AE8F-B9F7-4CC7-8A6C-BF7EEE87ACA5}_is1
2 0
host 149.40.62.171
file C:\Users\test22\AppData\Local\AVAST Software\Browser
file C:\Users\test22\AppData\Roaming\AVAST Software\Browser
file C:\Users\test22\AppData\Local\AVG\Browser
file C:\Users\test22\AppData\Roaming\AVG\Browser
file C:\ProgramData\Microsoft\Microsoft Antimalware
file C:\Windows\Sandboxie.ini
file C:\ProgramData\Microsoft\Microsoft Security Client
file C:\Users\test22\AppData\Roaming\Electrum\config
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Python27\agent.pyw
file C:\tmpvmqcut\analyzer.py
file C:\tmp6o6lvv\analyzer.py
file C:\Windows\debug\PASSWD.LOG
file C:\Windows\SysWOW64\mfcsubs.dll
file C:\Windows\bootstat.dat
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default
registry HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\HTTPMail Password
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\IMAP User Name
file C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet
file C:\Windows\System32\qcap.dll
file C:\Windows\SysWOW64\VBoxOGL.dll
file C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf
dead_host 192.168.56.103:49161
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealer.12!c
MicroWorld-eScan Gen:Variant.Lazy.410140
FireEye Generic.mg.993c85b5b1c94bfa
CAT-QuickHeal TrojanPWS.Stealer
Skyhigh BehavesLike.Win32.Generic.th
ALYac Gen:Variant.Lazy.410140
Malwarebytes Trojan.Injector.RND
Zillya Trojan.Injector.Win32.1713955
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 005361961 )
BitDefender Gen:Variant.Lazy.410140
K7GW Trojan ( 005361961 )
Cybereason malicious.d65621
BitDefenderTheta Gen:NN.ZexaF.36792.evW@auZunKki
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.DYZI
APEX Malicious
Kaspersky HEUR:Trojan-PSW.Win32.Stealer.gen
Alibaba TrojanPSW:Win32/Stealer.e5a0ac4c
NANO-Antivirus Trojan.Win32.Bobik.kcmzgg
ViRobot Trojan.Win.Z.Injector.1116160
Tencent Malware.Win32.Gencirc.11b7b02d
Sophos Mal/Generic-S
F-Secure Trojan.TR/Injector.llsbr
VIPRE Gen:Variant.Lazy.410140
TrendMicro Trojan.Win32.SMOKELOADER.YXDJ3Z
Trapmine suspicious.low.ml.score
Emsisoft Gen:Variant.Lazy.410140 (B)
Ikarus Trojan.Win32.Injector
GData Gen:Variant.Lazy.410140
Google Detected
Avira TR/Injector.llsbr
Varist W32/ABRisk.NVSZ-4091
Antiy-AVL Trojan/Win32.Injector
Kingsoft Win32.Trojan-PSW.Stealer.gen
Gridinsoft Ransom.Win32.Sabsik.ca
Arcabit Trojan.Lazy.D6421C
ZoneAlarm HEUR:Trojan-PSW.Win32.Stealer.gen
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C5518247
McAfee Artemis!993C85B5B1C9
MAX malware (ai score=87)
DeepInstinct MALICIOUS
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXDJ3Z
Rising Stealer.Meduza!8.186B4 (TFE:5:q6bwEsZ7J7M)