popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ConsoleApplication6.exe

Generic Malware Malicious Library Downloader UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:01 p.m. Aug. 19, 2024, 2:07 p.m.
Size 353.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 e3454ebec6c620ea8547121080a4634e
SHA256 d4ff3691a8f6e2e3d5dc2dbc23d222f1547e4addf2b8b7f598b213cd7559d5fd
CRC32 91D3E999
ssdeep 6144:r6U8gPcMcHsSB6+1zrXsEvKXchoQfaSEX:O8cHsSB6IzzsHshoTX
PDB Path D:\ProjectStub\ConsoleApplication6\x64\Release\ConsoleApplication6.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
exploit-elite.pro
A 172.67.204.99
A 104.21.22.108
104.21.22.108
IP Address Status Action
164.124.101.2 Active Moloch
172.67.204.99 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 172.67.204.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49165
172.67.204.99:443 		C=US, O=Google Trust Services, CN=WE1 CN=exploit-elite.pro c1:6c:4c:e0:d2:55:b6:ef:43:4f:74:59:ab:ac:b2:46:c7:7f:7d:fc

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path D:\ProjectStub\ConsoleApplication6\x64\Release\ConsoleApplication6.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
request GET https://exploit-elite.pro/build.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\file1.exe
Bkav W64.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win64.NetLoader.fh
APEX Malicious
McAfeeD ti!D4FF3691A8F6
FireEye Generic.mg.e3454ebec6c620ea
SentinelOne Static AI - Suspicious PE
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)