Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 10, 2024, 12:29 p.m.	Aug. 10, 2024, 12:32 p.m.

Size	14.5MB
Type	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`ff432e4003e9d7135a97bd4dc0445dc3`
SHA256	`03495c3e0d041d6c6c1949cf6cfabea9b3d4308fee9cbf85754bb00b434d3778`
CRC32	`F74C0F70`
ssdeep	`393216:fRdW64cosTowwMzcG5FU90WGqNyW8O9hHZUSStMbZlna4:T6gozccuLoNyW8evUSs2`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rutua.dll,MainFunc
2552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rutua.dll,_cgo_dummy_export
2636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rutua.dll,
2728

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 10, 2024, 12:29 p.m.			0	0
IsDebuggerPresent Aug. 10, 2024, 12:29 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (12 events)

section	becb`
section	[e[fe
section	^^STU
section	bY^eU
section	a_SfU
section	Y\d^_
section	T]^[_
section	eZ]e\
section	f^Ycc
section	cUfXW
section	TUaYW
section	SZVZY

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Aug. 10, 2024, 12:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 30473024 registers.edi: 1865380064 registers.eax: 0 registers.ebp: 30473028 registers.edx: 4294967295 registers.ebx: 30473040 registers.esi: 30473176 registers.ecx: 0	1
__exception__ Aug. 10, 2024, 12:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 7993408 registers.edi: 1865380064 registers.eax: 0 registers.ebp: 7993412 registers.edx: 4294967295 registers.ebx: 7993424 registers.esi: 7993560 registers.ecx: 0	1
__exception__ Aug. 10, 2024, 12:29 p.m.	stacktrace: rundll32+0x1326 @ 0x8c1326 rundll32+0x1901 @ 0x8c1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 exception.instruction: add byte ptr [eax], al exception.exception_code: 0xc0000005 exception.symbol: MainFunc+0x3191ec rutua+0x7ff64c exception.address: 0x6fabf64c registers.esp: 653640 registers.edi: 0 registers.eax: 196990 registers.ebp: 653756 registers.edx: 9 registers.ebx: 0 registers.esi: 196990 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 10, 2024, 12:29 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00e77600', u'virtual_address': u'0x00f3e000', u'entropy': 7.902753948284128, u'name': u'TUaYW', u'virtual_size': u'0x00e77480'}

entropy

7.90275394828

description

A section with a high entropy has been found

entropy

0.999865006243

description

Overall entropy of this PE file is high

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.Vy7j
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.VMProtect.BC suspicious
McAfee	Artemis!FF432E4003E9
Avast	Win32:MalwareX-gen [Trj]
Rising	Trojan.Kryptik!8.8 (TFE:6:GYKdcmG8yzF)
McAfeeD	ti!03495C3E0D04
SentinelOne	Static AI - Malicious PE
Gridinsoft	Trojan.Heur!.002121B0
Microsoft	Program:Win32/Wacapew.C!ml
AhnLab-V3	Trojan/Win.FakeAV.C5650867
DeepInstinct	MALICIOUS
VBA32	Malware-Cryptor.Inject.gen
Malwarebytes	Floxif.Virus.FileInfector.DDS
Ikarus	Win32.Outbreak
Fortinet	Riskware/Application
AVG	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)
alibabacloud	VirTool:Win/Wacatac.H9nj

rutua.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All