popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C156.exe

Malicious Library UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 19, 2024, 2:16 p.m. Aug. 19, 2024, 3:14 p.m.
Size 2.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7c7382c5c39fb5cb7dffd9ca5dba25e5
SHA256 a707ace25bd01f990fb27b3de63b2ebac0f9fae50d8f7a344bee924a87ada62c
CRC32 DDBE0517
ssdeep 49152:0ryj1P33z+Z60GfwKbTsnySwPDsAFjjdjjA/YiY0Y0Y0Y0YI:0WPj260Ew+9JsAFjjdjjA/YiY0Y0Y0YO
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c156+0x1bfa28 @ 0x5bfa28
pos_c156+0x1bf96a @ 0x5bf96a
pos_c156+0x1bf92b @ 0x5bf92b
pos_c156+0x1d0d55 @ 0x5d0d55
pos_c156+0x1d4b77 @ 0x5d4b77
pos_c156+0x1d4e81 @ 0x5d4e81
pos_c156+0x1d501c @ 0x5d501c
pos_c156+0x1d3e81 @ 0x5d3e81
pos_c156+0x1d40c8 @ 0x5d40c8
pos_c156+0x1d41a8 @ 0x5d41a8
pos_c156+0x1d6891 @ 0x5d6891
pos_c156+0x1d6734 @ 0x5d6734
pos_c156+0x1dde4a @ 0x5dde4a
pos_c156+0x67f1b @ 0x467f1b
pos_c156+0x4fc73 @ 0x44fc73
pos_c156+0x52bd4 @ 0x452bd4
pos_c156+0x1ac969 @ 0x5ac969
pos_c156+0x52728 @ 0x452728
pos_c156+0x52793 @ 0x452793
pos_c156+0x52bd4 @ 0x452bd4
pos_c156+0x1ac969 @ 0x5ac969
pos_c156+0x4e760 @ 0x44e760
pos_c156+0x1e2994 @ 0x5e2994
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1636296
registers.edi: 1636484
registers.eax: 1636296
registers.ebp: 1636376
registers.edx: 0
registers.ebx: 6030376
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1717962257, next used block 12022528 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00215788 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002cae1c size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002cae30 size 0x00000274
ALYac Gen:Variant.Fragtor.597453
VIPRE Gen:Variant.Fragtor.597453
BitDefender Gen:Variant.Fragtor.597453
Cybereason malicious.5c39fb
Arcabit Trojan.Generic.D4614FF1
MicroWorld-eScan Gen:Variant.Fragtor.597453
Emsisoft Gen:Variant.Fragtor.597453 (B)
FireEye Gen:Variant.Fragtor.597453
MAX malware (ai score=85)
GData Gen:Variant.Fragtor.597453