Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 27, 2024, 4:01 p.m.	Jan. 27, 2024, 4:18 p.m.

Size	3.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`daa0de1a869a8aec7fffbf84305d28ef`
SHA256	`09bb745832268d4d8e9813ee0b91a3a5d9dcb72e4a0f1437167fa51c060acad5`
CRC32	`35ABF814`
ssdeep	`98304:8i++qX8iuivYw7Kx0tJI7dKeZICu5t682vOvrAYg:/cNuyYw7RtJI7ZZhGDAT`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Jan. 27, 2024, 4:01 p.m.	computer_name: TEST22-PC	1	1	0

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 27, 2024, 4:01 p.m.			0	0

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 27, 2024, 4:01 p.m.		1	1	0

section

.ndata

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 27, 2024, 4:01 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02db0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 4:01 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:54 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SumatraPDF\SumatraPDF.lnk
file	C:\Users\test22\AppData\Local\Temp\nstBF64.tmp\Zip.dll
file	C:\Program Files (x86)\ClocX\uninst.exe
file	C:\Program Files (x86)\ClocX\SumatraPDF.exe
file	C:\Users\test22\AppData\Local\Temp\nstBF64.tmp\Checker.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SumatraPDF\Uninstall.lnk

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SumatraPDF\Uninstall.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SumatraPDF\SumatraPDF.lnk

file	C:\Users\test22\AppData\Local\Temp\nstBF64.tmp\Checker.dll
file	C:\Users\test22\AppData\Local\Temp\nstBF64.tmp\Zip.dll

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 27, 2024, 4:01 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 61440 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Jan. 27, 2024, 4:01 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Dropper.wc
ALYac	Gen:Variant.Jaik.207263
VIPRE	Gen:Variant.Jaik.207263
BitDefender	Gen:Variant.Jaik.207263
Arcabit	Trojan.Jaik.D3299F
APEX	Malicious
McAfee	Artemis!DAA0DE1A869A
Kaspersky	HEUR:Trojan.Win32.Agent.gen
MicroWorld-eScan	Gen:Variant.Jaik.207263
Rising	Trojan.Generic@AI.80 (RDML:NB0eYDTam55CkIVhSxcQbQ)
Emsisoft	Gen:Variant.Jaik.207263 (B)
FireEye	Gen:Variant.Jaik.207263
MAX	malware (ai score=88)
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Jaik.207263
BitDefenderTheta	Gen:NN.ZedlaF.36680.eu4@aydFEgci

12026.exe