Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 19, 2024, 1:03 p.m.	July 19, 2024, 1:05 p.m.

Size	3.3MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`177dba5455e57afe9da6cfa0dda3d61d`
SHA256	`89ffb715e0a02eb089269f055f3104aecf648cd88366bf3ed49fb318ee257588`
CRC32	`48F11625`
ssdeep	`49152:bKtwpvY+YghJRswm0JWGTfq0/FmOOWx3mn5Dq5rDt0s7OYID3HtHINjPKGNzR:bQw2/ghJRU0JWuz4nZqJbi/rtH0KE`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques

do0ntworryx1.exe "C:\Users\test22\AppData\Local\Temp\do0ntworryx1.exe"
1372

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 19, 2024, 12:50 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	\xe0\xff\xe0\xff
section	\xff\xe0\xff\xbb

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 19, 2024, 12:50 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d do0ntworryx1+0x12906 @ 0x412906 do0ntworryx1+0xb4f85 @ 0x4b4f85 do0ntworryx1+0xb5212 @ 0x4b5212 do0ntworryx1+0x13c7 @ 0x4013c7 do0ntworryx1+0x14cb @ 0x4014cb BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x20474343 exception.offset: 42141 exception.address: 0x7fefdbfa49d registers.r14: 0 registers.r15: 0 registers.rcx: 2291424 registers.rsi: 0 registers.r10: 93 registers.rbx: 0 registers.rsp: 2293728 registers.r11: 2293040 registers.r8: 0 registers.r9: 0 registers.rdx: 192 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 2002575644 registers.r13: 0	1	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: pw.exe process_identifier: 2000	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: wsqmcons.exe process_identifier: 1156	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: cmd.exe process_identifier: 1256	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: conhost.exe process_identifier: 1504	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: pw.exe process_identifier: 1696	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: SearchFilterHost.exe process_identifier: 1280	1	1
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372	1	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Bkav	W64.AIDetectMalware
APEX	Malicious
McAfeeD	ti!89FFB715E0A0
Trapmine	malicious.moderate.ml.score
Gridinsoft	Trojan.Heur!.032126C3
Microsoft	Program:Win32/Wacapew.C!ml
SentinelOne	Static AI - Suspicious PE
CrowdStrike	win/malicious_confidence_70% (D)

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00330e00', u'virtual_address': u'0x0040f000', u'entropy': 7.942789229968773, u'name': u'\\xff\\xe0\\xff\\xbb', u'virtual_size': u'0x00331000'}

entropy

7.94278922997

description

A section with a high entropy has been found

entropy

0.969728446357

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (16 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0
Process32NextW July 19, 2024, 12:50 p.m.	snapshot_handle: 0x000000000000009c process_name: do0ntworryx1.exe process_identifier: 1372		0	0

do0ntworryx1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All