popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C091.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 19, 2024, 2:15 p.m. Aug. 19, 2024, 3:44 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4542643b447f61d5b323ccb555eec06c
SHA256 9df00b2fae882736f0cf6fcf3f59e9007db8cbc2f96ff7eb02affdf121b385a6
CRC32 BBF02487
ssdeep 24576:2Mhdd6nEcDZSlh5wmj68EB5fI1lswi+6fu/Pwotqz05YiarRs7mrnaA3Ur5a/OB9:2u4ZSl/1gvAzPPYjUmHU9a6P/gFTwPD
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c091+0x17af20 @ 0x57af20
pos_c091+0x17ae6e @ 0x57ae6e
pos_c091+0x17ae2f @ 0x57ae2f
pos_c091+0x18b631 @ 0x58b631
pos_c091+0x18f273 @ 0x58f273
pos_c091+0x18f589 @ 0x58f589
pos_c091+0x18f73a @ 0x58f73a
pos_c091+0x18e57c @ 0x58e57c
pos_c091+0x18e7b8 @ 0x58e7b8
pos_c091+0x18e898 @ 0x58e898
pos_c091+0x191095 @ 0x591095
pos_c091+0x190f38 @ 0x590f38
pos_c091+0x1c49ea @ 0x5c49ea
pos_c091+0x1c1ac4 @ 0x5c1ac4
pos_c091+0x71573 @ 0x471573
pos_c091+0x5960f @ 0x45960f
pos_c091+0x5c55c @ 0x45c55c
pos_c091+0x1b065d @ 0x5b065d
pos_c091+0x5c0b0 @ 0x45c0b0
pos_c091+0x5c11b @ 0x45c11b
pos_c091+0x5c55c @ 0x45c55c
pos_c091+0x1b065d @ 0x5b065d
pos_c091+0x58108 @ 0x458108
pos_c091+0x1cbdb7 @ 0x5cbdb7
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1635884
registers.edi: 1636072
registers.eax: 1635884
registers.ebp: 1635964
registers.edx: 0
registers.ebx: 5748344
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00960000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x001fd070 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00214fa8 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00214fbc size 0x00000274
ALYac Gen:Variant.Strictor.291372
VIPRE Gen:Variant.Strictor.291372
BitDefender Gen:Variant.Strictor.291372
Arcabit Trojan.Strictor.D4722C
MicroWorld-eScan Gen:Variant.Strictor.291372
Emsisoft Gen:Variant.Strictor.291372 (B)
FireEye Gen:Variant.Strictor.291372
MAX malware (ai score=80)
GData Gen:Variant.Strictor.291372