popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Installer.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 2, 2024, 7:37 a.m. Aug. 2, 2024, 7:39 a.m.
Size 5.6MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 b4ac185a10fae02495def73d10960453
SHA256 ce1df5c0b5636f4a1b5f6a3f9903c7a98179b5fcb77f5a53377b0b8b0d94ef9b
CRC32 7EAD58F6
ssdeep 49152:z8PeGlV0WPGcFxG/ejKsmDclbGR5kSfIrKd2kQz8hjkFfdDOKBCWxpGdnCRCCfhJ:GG7euQlTmd2kW7140gQ51obC/LGU
PDB Path C:\Users\admin\Desktop\C井压缩包\obj\Release\Chrome.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path C:\Users\admin\Desktop\C井压缩包\obj\Release\Chrome.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02800000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00862000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00895000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0089b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00897000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0087c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
name RT_VERSION language None filetype data sublanguage SUBLANG_ARABIC_YEMEN offset 0x005a0af4 size 0x00000398
Bkav W32.AIDetectMalware.CS
Elastic malicious (moderate confidence)
VIPRE Gen:Variant.Jalapeno.15969
BitDefender Gen:Variant.Jalapeno.15969
Arcabit Trojan.Marsilia.D22913
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.QVF.gen
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan-Downloader.MSIL.Agent.gen
MicroWorld-eScan Gen:Variant.Jalapeno.15969
Emsisoft Gen:Variant.Jalapeno.15969 (B)
FireEye Gen:Variant.Jalapeno.15969
SentinelOne Static AI - Malicious PE
Google Detected
MAX malware (ai score=88)
ZoneAlarm HEUR:Trojan-Downloader.MSIL.Agent.gen
GData Gen:Variant.Jalapeno.15969
AhnLab-V3 Trojan/Win.Generic.C5650839
BitDefenderTheta Gen:NN.ZemsilF.36810.@p2@amljiLAP
DeepInstinct MALICIOUS
VBA32 Downloader.MSIL.gen.rexp
Malwarebytes PUP.Optional.AVBDiskSoft
Ikarus Trojan.Win32.Malgent
huorong TrojanDownloader/Agent.bax
AVG Win32:TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_70% (D)