popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

instrumentMAIN.exe

Generic Malware .NET framework(MSIL) Admin Tool (Sysinternals etc ...) UPX PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 29, 2024, 7:46 a.m. March 29, 2024, 7:50 a.m.
Size 4.5MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c66b1f6942762649c44bca726995a227
SHA256 859f296afcad7531a5e2ee4b5b8346da0d5ac0ba33700804216aa7365920f7cb
CRC32 AAF8B906
ssdeep 98304:AaHg3Vqv+AigbRik7kZ3srMw2FX+qK60L:AaH0VqhiKj7kZ3U+FuqA
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
104.26.4.15 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00510000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02490000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a61000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00425600', u'virtual_address': u'0x00002000', u'entropy': 7.152343971086566, u'name': u'.text', u'virtual_size': u'0x00425534'} entropy 7.15234397109 description A section with a high entropy has been found
entropy 0.928993435449 description Overall entropy of this PE file is high
host 104.26.4.15
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Injuke.16!c
Elastic malicious (high confidence)
Skyhigh Artemis
ALYac Gen:Variant.MSILHeracles.156128
Cylance unsafe
VIPRE Gen:Variant.MSILHeracles.156128
Sangfor Trojan.Msil.Kryptik.Vic9
K7AntiVirus Trojan ( 005b1f491 )
BitDefender Gen:Variant.MSILHeracles.156128
K7GW Trojan ( 005b1f491 )
Arcabit Trojan.MSILHeracles.D261E0
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.ALGT
McAfee Artemis!C66B1F694276
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan.MSIL.Injuke.gen
Alibaba Trojan:MSIL/Kryptik.7063db12
MicroWorld-eScan Gen:Variant.MSILHeracles.156128
Rising Malware.Obfus/MSIL@AI.85 (RDM.MSIL2:Ll9fDNI0Xco1VfRxR0rN9w)
Emsisoft Gen:Variant.MSILHeracles.156128 (B)
F-Secure Trojan.TR/AVI.Agent.xtzao
TrendMicro Trojan.Win32.SMOKELOADER.YXEC2Z
FireEye Generic.mg.c66b1f6942762649
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Crypt
Google Detected
Avira TR/AVI.Agent.xtzao
MAX malware (ai score=85)
Kingsoft MSIL.Trojan.Injuke.gen
Gridinsoft Malware.Win32.ZgRAT.tr
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan.MSIL.Injuke.gen
GData Gen:Variant.MSILHeracles.156128
Varist W32/ABRisk.XTIY-6936
DeepInstinct MALICIOUS
VBA32 Malware-Cryptor.MSIL.AgentTesla.Heur
Malwarebytes Trojan.CRTCrypt.MSIL.Generic
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXEC2Z
Tencent Malware.Win32.Gencirc.1406cdac
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Kryptik.AJDT!tr
AVG Win32:TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_90% (W)
alibabacloud Trojan:MSIL/Injuke.gen