popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

setup-lightshot.exe

Generic Malware Malicious Library UPX WinRAR GIF Format Lnk Format PE File DLL OS Processor Check PE32 URL Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 7, 2024, 9:30 a.m. June 7, 2024, 9:49 a.m.
Size 1.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 42d41456f2eccff630138c1ac9d50d1f
SHA256 1184e49148bacb2652d94849149ba98650ce30fb381d65a3b0b1c1a194115651
CRC32 6DEEE263
ssdeep 24576:/6nVMk+HIj90cldHK+xAEsSwI6WnzkVCscpaoORD3KGzDKlz2Ev3rKXC+RYKe1gp:yVz7tXJsKLWl1DzDK8e+S+q58o1Hw7
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000006590000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\ProgramData\Lightshot\Lightshot.exe
file C:\ProgramData\Lightshot\uploader.dll
file C:\ProgramData\Lightshot\sqlite3.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lightshot\Lightshot.lnk
file C:\ProgramData\Lightshot\Lightshot.dll
file C:\ProgramData\Lightshot\Lightbase.dll
file C:\ProgramData\Lightshot\DXGIODScreenshot.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lightshot\Lightshot.lnk
file C:\ProgramData\Lightshot\Lightshot.exe
Lionic Trojan.Win32.Generic.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.CoinMiner.tc
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Symantec Trojan.Gen.MBT
Elastic malicious (moderate confidence)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Rising Trojan.Generic@AI.94 (RDML:fgfwUXAapHkzJulE3MA42w)
Zillya Trojan.Generic.Win32.1866424
McAfeeD ti!1184E49148BA
FireEye Generic.mg.42d41456f2eccff6
Sophos Generic ML PUA (PUA)
Kingsoft Win32.Troj.Unknown.a
Microsoft Program:Win32/Wacapew.C!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
BitDefenderTheta Gen:NN.ZedlaF.36806.ru8@aeulFink
DeepInstinct MALICIOUS
Paloalto generic.ml