Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 14, 2023, 6:49 p.m.	Dec. 14, 2023, 6:58 p.m.

Size	1011.6KB
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`448c002a1a5246c0ab3231d507c9bb8d`
SHA256	`a9180fb79d272c7f05692d692beb8436aa131fde1c4390e6942c502b6333e6c6`
CRC32	`CD2D015A`
ssdeep	`24576:ntFiVP1PH+UqAb2nDFhRhfhJhhKh1hhhhSehhFhhhUhgzA:ntFiVP1PH+qkFhczA`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE64 - (no description)

zil5.exe "C:\Users\test22\AppData\Local\Temp\zil5.exe"
2560

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
113.52.134.114	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Dec. 14, 2023, 6:42 p.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 106496 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000005d0000 process_handle: 0xffffffffffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Dec. 14, 2023, 6:42 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0001c600', u'virtual_address': u'0x000b1000', u'entropy': 7.6308139641714945, u'name': u'.data', u'virtual_size': u'0x0001c5d0'}

entropy

7.63081396417

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 event)

host

113.52.134.114

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Bkav	W64.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Sangfor	Backdoor.Win32.Havoc.Vr7h
Cybereason	malicious.e7dbc3
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	Backdoor.Win64.Havoc.bmv
Rising	Backdoor.Havoc!8.970A (TFE:5:FmKscZQWeQD)
FireEye	Generic.mg.448c002a1a5246c0
Sophos	Mal/Generic-S
Ikarus	Trojan.Win64.Shellcoderunner
Google	Detected
Antiy-AVL	Trojan[Backdoor]/Win64.Havoc
Microsoft	Trojan:Win32/ScarletFlash.A
ZoneAlarm	Backdoor.Win64.Havoc.bmv
DeepInstinct	MALICIOUS
Panda	Trj/Chgt.AD
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/PossibleThreat
CrowdStrike	win/malicious_confidence_100% (W)

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

113.52.134.114:443

zil5.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All