Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 25, 2024, 7:41 a.m.	June 25, 2024, 7:52 a.m.

Size	3.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7e9e5a3bb475784e3fd62cd8ec68901b`
SHA256	`997168ff6f969fd612eff93901e67726f13930bdfe473ecf1dc3ec1a1ab7ba21`
CRC32	`171AC16C`
ssdeep	`49152:zx97H3v5ACEVJLHFT2Grz9syrUNFtAGUv+CBjCNbr5Gl6tyvBOZJjBLJqk7+2:zT/5APLoGrzaxteZjurftyvBOv7+`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

chromedriver.exe "C:\Users\test22\AppData\Local\Temp\chromedriver.exe"
2040

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 25, 2024, 7:41 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 25, 2024, 7:41 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2024, 7:41 a.m.			0	0
IsDebuggerPresent June 25, 2024, 7:41 a.m.			0	0
IsDebuggerPresent June 25, 2024, 7:41 a.m.			0	0
IsDebuggerPresent June 25, 2024, 7:41 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 25, 2024, 7:41 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2024, 7:41 a.m.	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00384800', u'virtual_address': u'0x00002000', u'entropy': 7.722843579414291, u'name': u'.text', u'virtual_size': u'0x00384654'}

entropy

7.72284357941

description

A section with a high entropy has been found

entropy

0.999445061043

description

Overall entropy of this PE file is high

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Blocker.V!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Trojan.GenericKD.73221816
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73221816
Sangfor	Ransom.Msil.Blocker.Vpik
K7AntiVirus	Trojan ( 005af1f71 )
BitDefender	Trojan.GenericKD.73221816
K7GW	Trojan ( 005af1f71 )
Cybereason	malicious.bb4757
Arcabit	Trojan.Generic.D45D46B8
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AKIW
APEX	Malicious
McAfee	Artemis!7E9E5A3BB475
Avast	Win32:CrypterX-gen [Trj]
ClamAV	Win.Packed.Msilheracles-10017859-0
Kaspersky	HEUR:Trojan-Ransom.MSIL.Blocker.gen
Alibaba	Ransom:MSIL/Blocker.36dc564d
MicroWorld-eScan	Trojan.GenericKD.73221816
Rising	Ransom.Blocker!8.12A (CLOUD)
Emsisoft	Trojan.GenericKD.73221816 (B)
F-Secure	Trojan.TR/AD.Coroxy.bpkxb
TrendMicro	Trojan.Win32.AMADEY.YXEFUZ
McAfeeD	ti!997168FF6F96
Trapmine	malicious.moderate.ml.score
FireEye	Trojan.GenericKD.73221816
Sophos	Mal/Generic-S
Ikarus	Malware.Win32.Injector
Google	Detected
Avira	TR/AD.Coroxy.bpkxb
Antiy-AVL	Trojan[Ransom]/MSIL.Blocker
Kingsoft	Win32.Trojan.Generic.a
Gridinsoft	Ransom.Win32.Wacatac.ca
Microsoft	Backdoor:Win32/Coroxy.E
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Blocker.gen
GData	Trojan.GenericKD.73221816
Varist	W32/MSIL_Kryptik.KLQ.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5643200
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL.Generic
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEFUZ
Tencent	Malware.Win32.Gencirc.140fa76a
MAX	malware (ai score=81)
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	MSIL/GenKryptik.FYVI!tr
AVG	Win32:CrypterX-gen [Trj]

chromedriver.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All