popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C079.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 19, 2024, 2:12 p.m. Aug. 19, 2024, 3:05 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e0172234f8bfbf6caab3256f36999589
SHA256 48da39c0d4c4d3fe391b54582b044e34924bd1778da7f4b4a9e0e6ef53865813
CRC32 9D41A698
ssdeep 24576:DHm1GV2ScFdrrS6vzTtsojdd9en5cP4Qg6rf1kDIABaGiHRlcCcLYr0MMfWR2e4o:DH8NT9G5CgzPMfmPDTxi
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c079+0x1400e8 @ 0x5400e8
pos_c079+0x140036 @ 0x540036
pos_c079+0x13fff7 @ 0x53fff7
pos_c079+0x1506e9 @ 0x5506e9
pos_c079+0x15432b @ 0x55432b
pos_c079+0x154641 @ 0x554641
pos_c079+0x1547f2 @ 0x5547f2
pos_c079+0x153634 @ 0x553634
pos_c079+0x153870 @ 0x553870
pos_c079+0x153950 @ 0x553950
pos_c079+0x15614d @ 0x55614d
pos_c079+0x155ff0 @ 0x555ff0
pos_c079+0x1bdaf0 @ 0x5bdaf0
pos_c079+0x6d597 @ 0x46d597
pos_c079+0x55633 @ 0x455633
pos_c079+0x58580 @ 0x458580
pos_c079+0x10f2d5 @ 0x50f2d5
pos_c079+0x580d4 @ 0x4580d4
pos_c079+0x5813f @ 0x45813f
pos_c079+0x58580 @ 0x458580
pos_c079+0x10f2d5 @ 0x50f2d5
pos_c079+0x5412c @ 0x45412c
pos_c079+0x1bf011 @ 0x5bf011
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1636312
registers.edi: 1636500
registers.eax: 1636312
registers.ebp: 1636392
registers.edx: 0
registers.ebx: 5507136
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 300
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x001f00f8 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00222b60 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00222b74 size 0x00000274
ALYac Gen:Variant.Strictor.291372
VIPRE Gen:Variant.Strictor.291372
BitDefender Gen:Variant.Strictor.291372
Cybereason malicious.4f8bfb
Arcabit Trojan.Strictor.D4722C
MicroWorld-eScan Gen:Variant.Strictor.291372
Emsisoft Gen:Variant.Strictor.291372 (B)
FireEye Gen:Variant.Strictor.291372
MAX malware (ai score=86)
GData Gen:Variant.Strictor.291372
MaxSecure Trojan.Malware.300983.susgen