popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

msbuild.exe

Generic Malware Malicious Library UPX GIF Format Lnk Format PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 11, 2024, 1:20 p.m. July 11, 2024, 1:26 p.m.
Size 3.6MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 77b8c18bece02b6cfa33f68c743b3c3c
SHA256 e19de62c82f499f2f3748136c337222c2f67effba91e6252fdc9ece2f20595d9
CRC32 D3C3D2BB
ssdeep 49152:T13hnx0+HdYgtb20mCnChhO+TA/5oGSWxHP+RJcGZ12yP32aVb5S:pG2n1Si+RJcGy82aVE
PDB Path F:\asdasd\x64\Output\Release\teger.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
sexapp.cc
A 43.135.32.151
43.135.32.151
IP Address Status Action
164.124.101.2 Active Moloch
43.135.32.151 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:64894 -> 164.124.101.2:53 2027758 ET DNS Query for .cc TLD Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
pdb_path F:\asdasd\x64\Output\Release\teger.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
domain sexapp.cc description Cocos Islands domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sexaps.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sexaps.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sexaps.lnk
Bkav W64.AIDetectMalware
ESET-NOD32 a variant of Win64/Agent.VV
Rising Trojan.Agent!8.B1E (CLOUD)
McAfeeD ti!E19DE62C82F4
Ikarus Trojan.Win64.Agent
DeepInstinct MALICIOUS
Tencent Win64.Trojan.Agent.Nsmw
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.MU
Paloalto generic.ml
dead_host 192.168.56.103:49171
dead_host 192.168.56.103:49170
dead_host 43.135.32.151:3965
dead_host 192.168.56.103:49181
dead_host 192.168.56.103:49180
dead_host 192.168.56.103:49183
dead_host 192.168.56.103:49173
dead_host 192.168.56.103:49182
dead_host 192.168.56.103:49172
dead_host 192.168.56.103:49177
dead_host 192.168.56.103:49175
dead_host 192.168.56.103:49176
dead_host 192.168.56.103:49165
dead_host 192.168.56.103:49174
dead_host 192.168.56.103:49179
dead_host 192.168.56.103:49164
dead_host 192.168.56.103:49169
dead_host 192.168.56.103:49178
dead_host 192.168.56.103:49168
dead_host 192.168.56.103:49166