Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 17, 2024, 10:11 p.m.	Aug. 17, 2024, 10:18 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`25ed0fce4a9df59b3ed88853db8206f3`
SHA256	`c5b32f1cdc2a48f1dd2b1623598c24a2635dc57fdab3b4328f1cb3b66f5079ba`
CRC32	`43CE7BB1`
ssdeep	`24576:o+uySzDesoxGcxOTVeXEUdlrDx2b0xWHVaTDdAuIWEcAt:tDxpU2lrAb0xWHVandAuREcO`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

Ukodbcdcl.exe "C:\Users\test22\AppData\Local\Temp\Ukodbcdcl.exe"
316

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 17, 2024, 10:11 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 17, 2024, 10:11 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 17, 2024, 10:11 p.m.			0	0
IsDebuggerPresent Aug. 17, 2024, 10:11 p.m.			0	0
IsDebuggerPresent Aug. 17, 2024, 10:11 p.m.			0	0
IsDebuggerPresent Aug. 17, 2024, 10:11 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (2 events)

Time & API	Arguments	Status	Return	Repeated
CryptExportKey Aug. 17, 2024, 10:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0050b678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1	0
CryptExportKey Aug. 17, 2024, 10:11 p.m.	buffer: f ¶yØy©:öF8ûêy{.æ\Ùb³Yª©Ð¸KQlh crypto_handle: 0x0050b678 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 17, 2024, 10:11 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02070000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00632000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00633000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 17, 2024, 10:11 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00109600', u'virtual_address': u'0x00002000', u'entropy': 7.852042732452756, u'name': u'.text', u'virtual_size': u'0x001095a0'}

entropy

7.85204273245

description

A section with a high entropy has been found

entropy

0.998119417019

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 84cb7a2366d29b769e0617b1c511a87d344a105c

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Crysan.m!c
Elastic	malicious (high confidence)
CAT-QuickHeal	Backdoor.MSIL
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Trojan.Generic.36708048
Cylance	Unsafe
VIPRE	Trojan.Generic.36708048
Sangfor	Backdoor.Msil.Crysan.Vqk3
K7AntiVirus	Trojan ( 005ad6e81 )
BitDefender	Trojan.Generic.36708048
K7GW	Trojan ( 005ad6e81 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AJWH
APEX	Malicious
McAfee	Artemis!25ED0FCE4A9D
Avast	Win32:RATX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
Alibaba	Trojan:MSIL/Kryptik.75dc9a25
MicroWorld-eScan	Trojan.Generic.36708048
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:Hk0NWGvRc/KomnYS1G/jwA)
Emsisoft	Trojan.Generic.36708048 (B)
F-Secure	Trojan.TR/AD.Coroxy.mxfcn
TrendMicro	Trojan.Win32.AMADEY.YXEHMZ
McAfeeD	ti!C5B32F1CDC2A
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.25ed0fce4a9df59b
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/AD.Coroxy.mxfcn
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Backdoor]/MSIL.Crysan
Kingsoft	malware.kb.c.992
Gridinsoft	Trojan.Win32.Agent.sa
Microsoft	Backdoor:Win32/Coroxy.E
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	MSIL.Trojan.PSE.4LXSWR
Varist	W32/MSIL_Kryptik.KHA.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C5658446
BitDefenderTheta	Gen:NN.ZemsilF.36812.cn0@aG6BJVk
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
Ikarus	Trojan.MSIL.Crypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXEHMZ
Tencent	Malware.Win32.Gencirc.141623ee
huorong	TrojanDropper/MSIL.Agent.hv
MaxSecure	Trojan.Malware.300983.susgen

Ukodbcdcl.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All