popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

x86_0729_1.exe

Generic Malware Malicious Library Downloader UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 16, 2024, 9:56 a.m. June 16, 2024, 10:26 a.m.
Size 519.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 5fd66ba54fdd540072eeea86213c351b
SHA256 8eea7b6443751748fac6be47352a2bf7cbf13c15a30b0eb98d60bf7e352b3e2b
CRC32 B78F92A9
ssdeep 12288:UVHdcFw5xizRz3GLsuuKzHSdQ7faQ0CwgTZ+NPn71:UV9cFw5xizRzVYydQqraYN
PDB Path C:\Users\Clive\source\repos\x86_driver\Release\x86.pdb
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
149.129.37.78 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: ÅX°Ê¥[¸ü¦¨¥\
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: error open url
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: error open url
console_handle: 0x00000007
1 1 0
pdb_path C:\Users\Clive\source\repos\x86_driver\Release\x86.pdb
resource name SYS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
x86_0729_1+0x67d1 @ 0xbc67d1
x86_0729_1+0x5fbe @ 0xbc5fbe
x86_0729_1+0x7462 @ 0xbc7462
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 0f 6f 66 40 66 0f 6f 6e 50 66 0f 6f 76 60 66
exception.symbol: x86_0729_1+0x21a16
exception.address: 0xbe1a16
exception.module: x86_0729_1.exe
exception.exception_code: 0xc0000005
exception.offset: 137750
registers.esp: 3535080
registers.edi: 54939840
registers.eax: 0
registers.ebp: 3535128
registers.edx: 30710
registers.ebx: 4082623
registers.esi: 4317120
registers.ecx: 48
1 0 0
name SYS language LANG_CHINESE filetype PE32+ executable (native) x86-64, for MS Windows sublanguage SUBLANG_CHINESE_TRADITIONAL offset 0x000710b0 size 0x00028618
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000010c
process_name: sdclt.exe
process_identifier: 872
1 1 0

Process32NextW

 snapshot_handle: 0x0000010c
process_name: cmd.exe
process_identifier: 1440
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeLoadDriverPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeLoadDriverPrivilege
1 1 0
host 149.129.37.78
reg_key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EvilDriver\ImagePath reg_value \??\C:\Driver2030.sys
Time & API Arguments Status Return Repeated

NtLoadDriver

 driver_service_name: \Registry\Machine\System\CurrentControlSet\Services\EvilDriver
3221225473 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 76 (SystemFirmwareTableInformation)
3221225474 0
service EvilDriver (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EvilDriver\Start)
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.hh
McAfee Artemis!5FD66BA54FDD
Cylance Unsafe
VIPRE Gen:Trojan.Heur.RP.GuW@b44bHIcj
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Trojan.Heur.RP.GuW@b44bHIcj
Cybereason malicious.54fdd5
Arcabit Trojan.Heur.RP.E3A58E
Symantec ML.Attribute.HighConfidence
Avast Win32:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/MalwareX.0144f00b
MicroWorld-eScan Gen:Trojan.Heur.RP.GuW@b44bHIcj
Rising Trojan.Generic@AI.87 (RDMK:cmRtazoZDhJ39uPQZ/D2osunxCE5)
Emsisoft Gen:Trojan.Heur.RP.GuW@b44bHIcj (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen7
TrendMicro TROJ_GEN.R002C0XFE24
McAfeeD Real Protect-LS!5FD66BA54FDD
FireEye Generic.mg.5fd66ba54fdd5400
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Jiangmin TrojanSpy.Stealer.cga
Google Detected
Avira TR/Crypt.XPACK.Gen7
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Sabsik
Kingsoft malware.kb.a.716
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Gen:Trojan.Heur.RP.GuW@b44bHIcj
Varist W32/ABRisk.HCTI-6432
AhnLab-V3 Trojan/Win.Generic.C5641369
BitDefenderTheta AI:Packer.944428AF1F
DeepInstinct MALICIOUS
VBA32 suspected of Trojan.Downloader.gen
Malwarebytes Malware.AI.2420482668
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0XFE24
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.218110627.susgen
Fortinet W32/PossibleThreat
AVG Win32:MalwareX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (W)
alibabacloud Suspicious
dead_host 192.168.56.103:49164
dead_host 192.168.56.103:49162
dead_host 149.129.37.78:22556