popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Go.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 15, 2023, 8:25 a.m. Dec. 15, 2023, 8:28 a.m.
Size 2.2MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 dcf8c8ef55fd294027997128de155b9f
SHA256 236c90cde83b3dc403c3c186193b0d2cd14b067f6b4c840d5f0baee57840eba9
CRC32 412F5614
ssdeep 49152:V2JQb0rvdEeF5XsHuCmDKTkB7a1GwvvnE0jVBTs6vUaB:5wHH0kUHZjA6v/B
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49161
43.130.10.102:443 		None None None
TLS 1.3
192.168.56.101:49170
103.143.72.251:443 		None None None
TLS 1.3
192.168.56.101:49169
103.143.72.251:443 		None None None

section .rodata
resource name AFX_DIALOG_LAYOUT
name AFX_DIALOG_LAYOUT language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002337e4 size 0x00000002
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00236488 size 0x0000015e
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00236488 size 0x0000015e
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002375b4 size 0x0000015c
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00239334 size 0x00000068
service_name GotoHTTP service_path C:\Users\test22\AppData\Local\Temp\"C:\Users\test22\AppData\Local\Temp\Go.exe" service
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 2
password:
display_name: TTXN GotoHTTP Agent
filepath: C:\Users\test22\AppData\Local\Temp\"C:\Users\test22\AppData\Local\Temp\Go.exe" service
service_name: GotoHTTP
filepath_r: "C:\Users\test22\AppData\Local\Temp\Go.exe" service
desired_access: 983551
service_handle: 0x000000000043e2a0
error_control: 1
service_type: 16
service_manager_handle: 0x000000000043e270
1 4448928 0