popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pc9.chm

JPEG Format AntiVM PNG Format AntiDebug CHM Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 8, 2024, 4:58 p.m. July 8, 2024, 5 p.m.
Size 12.0KB
Type MS Windows HtmlHelp Data
MD5 7d101e683e7dbdfb83788c109c7b7de3
SHA256 78eeed270b399bc426ca67b22bf89e5e41d3abb7403a0a1dfa966fac627ca8b0
CRC32 3F19C99C
ssdeep 96:Sb4YB5BIaAXZNQ3Tq/xW6oUop3hTpABlsOhR25OwjHg0:Sb4YVeZu3m/xdoUWTpABlI5VH
Yara
  • chm_file_format - chm file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0
ESET-NOD32 HTML/TrojanDropper.Agent.R
Rising Trojan.MouseJack/HTML!1.BE26 (CLASSIC)
AhnLab-V3 Dropper/HTML.Generic.S2418
Fortinet JS/Kimsuky.GOSU!tr
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1780
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff90000
process_handle: 0xffffffffffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 3068 resumed a thread in remote process 1780
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 1780
1 0 0