Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 29, 2024, 3:10 p.m.	June 29, 2024, 3:17 p.m.

Size	322.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fc5857b45516cd1decae5dbd68d59924`
SHA256	`09dd0de52154c82e85335ebbaae98e4d8d750d826171da9c7bea2ba9033c4551`
CRC32	`670E4646`
ssdeep	`6144:zaU22ravSWBqQK62sZ4XDPwtLKtr616/Z8xUgK:zaR2raq0p5Z4XziGD/W2gK`
PDB Path	C:\Users\ASUS\Desktop\ç½å é»\19\è®¡åä»»å¡å¯å¨\Release\ffucore.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsDLL - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,CreateUpdateSession
932
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,FreeLibraryMemoryAndExitThread
2096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,InitLog
2192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,NtUnloadDllMemoryAndExitThread
2280
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,SDDnsQuery
2376
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,SDDownloadFile
2472
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ffucore.dll,
2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0
IsDebuggerPresent June 29, 2024, 3:10 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\ASUS\Desktop\ç½å é»\19\è®¡åä»»å¡å¯å¨\Release\ffucore.pdb

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ June 29, 2024, 3:10 p.m.	stacktrace: rundll32+0x1326 @ 0x461326 rundll32+0x1901 @ 0x461901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 1898764 registers.edi: 0 registers.eax: 196648 registers.ebp: 1898880 registers.edx: 4 registers.ebx: 0 registers.esi: 196648 registers.ecx: 0	1
__exception__ June 29, 2024, 3:10 p.m.	stacktrace: rundll32+0x1326 @ 0x461326 rundll32+0x1901 @ 0x461901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 1833636 registers.edi: 0 registers.eax: 65888 registers.ebp: 1833752 registers.edx: 4 registers.ebx: 0 registers.esi: 65888 registers.ecx: 0	1
__exception__ June 29, 2024, 3:10 p.m.	stacktrace: exception.instruction_r: c7 44 24 08 00 00 00 00 8b 7c 24 04 be c4 86 66 exception.instruction: mov dword ptr [esp + 8], 0 exception.exception_code: 0xc0000005 exception.symbol: FreeLibraryMemoryAndExitThread+0xc298 CreateUpdateSession-0x9678 ffucore+0x11068 exception.address: 0x74461068 registers.esp: 2489220 registers.edi: 1950748304 registers.eax: 2005823141 registers.ebp: 1950998518 registers.edx: 235 registers.ebx: 2723675652 registers.esi: 2723738744 registers.ecx: 1172942518	1
__exception__ June 29, 2024, 3:10 p.m.	stacktrace: rundll32+0x1326 @ 0x461326 rundll32+0x1901 @ 0x461901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 2358752 registers.edi: 0 registers.eax: 196966 registers.ebp: 2358868 registers.edx: 4 registers.ebx: 0 registers.esi: 196966 registers.ecx: 0	1
__exception__ June 29, 2024, 3:10 p.m.	stacktrace: rundll32+0x1326 @ 0x461326 rundll32+0x1901 @ 0x461901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 2029840 registers.edi: 0 registers.eax: 65898 registers.ebp: 2029956 registers.edx: 4 registers.ebx: 0 registers.esi: 65898 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 932 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2096 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2192 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2280 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2376 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7448d000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2472 region_size: 4294967295 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff		3221225495
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory June 29, 2024, 3:10 p.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1	0

Moves the original executable to a new location (6 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0
MoveFileWithProgressW June 29, 2024, 3:10 p.m.	newfilepath_r: C:\Users\Public\Documents\ffucore.dll flags: 1 oldfilepath_r: C:\Windows\SysWOW64\ffucore.dll newfilepath: C:\Users\Public\Documents\ffucore.dll oldfilepath: C:\Windows\SysWOW64\ffucore.dll		0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00004600', u'virtual_address': u'0x00049000', u'entropy': 6.8062726366827, u'name': u'.data', u'virtual_size': u'0x000058e8'}

entropy

6.80627263668

description

A section with a high entropy has been found

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Fragtor
Skyhigh	BehavesLike.Win32.Infected.fh
ALYac	Gen:Variant.Fragtor.526305
Cylance	Unsafe
VIPRE	Gen:Variant.Fragtor.526305
Sangfor	Trojan.Win32.SilverFox.swkbu
BitDefender	Gen:Variant.Fragtor.526305
Arcabit	Trojan.Fragtor.D807E1
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ETRZ
APEX	Malicious
McAfee	Artemis!FC5857B45516
Avast	Win32:Evo-gen [Trj]
Alibaba	Trojan:Win32/Injector.8e23b916
MicroWorld-eScan	Gen:Variant.Fragtor.526305
Rising	Trojan.Injector!1.FD65 (CLASSIC)
Emsisoft	Gen:Variant.Fragtor.526305 (B)
F-Secure	Trojan.TR/Injector.dxafd
DrWeb	Trojan.Loader.2072
McAfeeD	ti!09DD0DE52154
Trapmine	malicious.moderate.ml.score
FireEye	Gen:Variant.Fragtor.526305
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Injector
Google	Detected
Avira	TR/Injector.dxafd
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Injector]/Win32.Agent
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Casdet!rfn
GData	Gen:Variant.Fragtor.526305
AhnLab-V3	Trojan/Win.Generic.R656658
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.605676534
TrendMicro-HouseCall	TROJ_GEN.R002H09FP24
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/ETRZ!tr
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan:Win/Fragtor.Gen

ffucore.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All