popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

324hj23k4jh423kjh4g423.exe

Malicious Library Downloader UPX PE32 PE File OS Processor Check MZP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 17, 2024, 7:27 a.m. May 17, 2024, 7:29 a.m.
Size 2.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 348bce7a46271aa5ff25de5e15e291d4
SHA256 df627184bb78e33980b55662e826fb3b6f4550efa2dc0eb20260f348cb150251
CRC32 D48D845D
ssdeep 49152:QPQ55rlkqcQyXKMT0lZvZQ8zOQb/7RczMN:Q45NlkdR6MiZ5V
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x35fa580
0x35fb1e0
0x10b400
324hj23k4jh423kjh4g423+0x504cf @ 0x4504cf
324hj23k4jh423kjh4g423+0x501af @ 0x4501af
324hj23k4jh423kjh4g423+0x57808 @ 0x457808
324hj23k4jh423kjh4g423+0xccb37 @ 0x4ccb37
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 88 08 eb e2 8b e5 5d c3 cc cc cc cc cc cc cc cc
exception.instruction: mov byte ptr [eax], cl
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x35fa13f
registers.esp: 1636056
registers.edi: 5030232
registers.eax: 0
registers.ebp: 1636064
registers.edx: 0
registers.ebx: 1673669
registers.esi: 32708536
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ad0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73662000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 1691648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02440000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 1691648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x034f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02040000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Elastic malicious (high confidence)
Cylance unsafe
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast PWSX-gen [Trj]
Kaspersky UDS:Trojan.Win32.Injuke.gen
Rising Backdoor.Androm!8.113 (TFE:3:eMaZ7QYfXnK)
Ikarus Backdoor.QBot
Google Detected
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm UDS:Trojan.Win32.Injuke.gen
BitDefenderTheta Gen:NN.ZelphiF.36804.LIW@aehc1chi
DeepInstinct MALICIOUS
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GLYS!tr
AVG PWSX-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:Win/Injector