popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

SecurityHealt_20240222070916028.exe

HermeticWiper Emotet Gen1 Generic Malware NSIS ASPack Malicious Library Malicious Packer Downloader Admin Tool (Sysinternals etc ...) UPX Anti_VM OS Processor Check MZP Format CAB ftp dll HWP PE64 PE File DllRegisterServer ActiveXObject PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 3, 2024, 3:21 p.m. March 3, 2024, 3:23 p.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ac5e40b7d8456ff9149d11b3061fea62
SHA256 ac160dc983ce7cada68ba4e7c8ea727661d1ddb3679c1046e3f9f1329b9abb99
CRC32 9C2AC996
ssdeep 24576:qkB1cymwN0rx46Zmx++GvZ2Af0Qn652QO43ue8+OI:q6a/T1fvZtLqj
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
file C:\util\curl\curl.exe
file C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\tmptqb9ww\bin\Procmon.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\Users\test22\AppData\Local\Temp\3582-490\SecurityHealt_20240222070916028.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe
file C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Program Files (x86)\Hnc\HncUtils\KeyLayout\KeyLayout.exe
file C:\util\dotnet4.5.exe
file C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe
file C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe
file C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
file C:\Users\test22\AppData\Local\Temp\3582-490\SecurityHealt_20240222070916028.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Bkav W32.NeshtaB.PE
Lionic Virus.Win32.Neshta.tn9H
Elastic Windows.Virus.Neshta
Cynet Malicious (score: 100)
CAT-QuickHeal W32.Neshta.C8
Skyhigh BehavesLike.Win32.HLLP.th
ALYac Win32.Neshta.A
Malwarebytes Generic.Malware.AI.DDS
VIPRE Win32.Neshta.A
Sangfor Virus.Win32.Neshta.a
K7AntiVirus Virus ( 00556e571 )
BitDefender Win32.Neshta.A
K7GW Virus ( 00556e571 )
Cybereason malicious.b94365
Arcabit Win32.Neshta.A
Baidu Win32.Virus.Neshta.a
VirIT Win32.Delf.FE
Symantec W32.Neshuta
ESET-NOD32 Win32/Neshta.A
APEX Malicious
McAfee W32/HLLP.41472.e
Avast Win32:Apanas [Trj]
ClamAV Win.Trojan.Neshuta-1
Kaspersky Virus.Win32.Neshta.a
NANO-Antivirus Trojan.Win32.Winlock.fmobyw
MicroWorld-eScan Win32.Neshta.A
Rising Virus.Neshta!1.EFA5 (CLASSIC)
Emsisoft Win32.Neshta.A (B)
F-Secure Malware.W32/Neshta.A
DrWeb Win32.HLLP.Neshta
Zillya Virus.Neshta.Win32.1
TrendMicro PE_NESHTA.A
Trapmine malicious.high.ml.score
FireEye Generic.mg.ac5e40b7d8456ff9
Sophos W32/Neshta-D
Ikarus Virus.Win32.Neshta
Jiangmin Virus.Neshta.a
Google Detected
Avira W32/Neshta.A
MAX malware (ai score=82)
Antiy-AVL Virus/Win32.Neshta.a
Kingsoft Win32.Neshta.nl.30720
Gridinsoft Virus.Win32.Neshta.ka!s8
Xcitium Win32.Neshta.A@3ypg
Microsoft Virus:Win32/Neshta.A
ViRobot Win32.Neshta.Gen.A
ZoneAlarm Virus.Win32.Neshta.a
GData Win32.Virus.Neshta.D
Varist W32/Neshta.OBIX-2981
AhnLab-V3 Win32/Neshta.Gen