popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

240903-회국회(정) 제1차 전체회의 의사일정안(결산,안건 상정,현안 보고).chm

AntiVM AntiDebug CHM Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 13, 2024, 10:20 a.m. Aug. 13, 2024, 10:23 a.m.
Size 1.4MB
Type MS Windows HtmlHelp Data
MD5 f5f5a585a12df9cb406dde6b3e6da23d
SHA256 3e0f4eaf3db754160f8c012a94772bf05b20823806962836fd0d32e0f160b916
CRC32 2ECEFDF9
ssdeep 24576:7pe7dQrkYIAhbQwhcaNhSeD1v94k9+Kt94fhBv6V07GK7RnheLQtlHmkqX5PXJi1:7U7dQBhHeKdD1vpLt94fv6V0Sgnhek31
Yara
  • chm_file_format - chm file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 3028 resumed a thread in remote process 2208
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 2208
1 0 0
Lionic Trojan.HTML.Generic.4!c
Skyhigh Artemis!Trojan
ALYac Trojan.Downloader.CHM
Sangfor Trojan.Win32.Kryptik.V9s6
Arcabit Exploit.CHM-Downloader.Gen [many]
Symantec Trojan.Gen.NPE
ESET-NOD32 multiple detections
TrendMicro-HouseCall Mal_ChmDr
McAfee Artemis!FC2AA8460FF7
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Exploit.CHM-Downloader.Gen
MicroWorld-eScan Exploit.CHM-Downloader.Gen
Rising Trojan.Agent!8.B1E (TFE:5:gyxpKOOvVlE)
Emsisoft Exploit.CHM-Downloader.Gen (B)
Zillya Dropper.Agent.Win32.566594
TrendMicro Mal_ChmDr
FireEye Exploit.CHM-Downloader.Gen
Sophos Mal/Iframe-AN
Ikarus Trojan-Downloader.HTML.Agent
Jiangmin Trojan.Agent.esyn
Google Detected
MAX malware (ai score=85)
Kingsoft Win32.Troj.Undef.a
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
GData Exploit.CHM-Downloader.Gen
BitDefenderTheta Gen:NN.ZexaF.36810.HvW@au2xsmoi
Tencent Win32.Trojan.Agent.Rgil
Fortinet W32/Kryptik.HWQL!tr
alibabacloud Exploit:Win/CHM-Downloader.Gyf