popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C028.exe

Malicious Library UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 20, 2024, 9:25 a.m. Aug. 20, 2024, 9:29 a.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8b2ae18d721ae95719598ca0369e94af
SHA256 f69a66d1b8e3539d47ccfab3d1d5e391e0ae33b05a40229755a7b03012bf9eba
CRC32 56A07F63
ssdeep 49152:Arymwfg47jww06anvPD6AFjjdjjA/YiY0Y0Y0Y0YI:ArqY4XaD6AFjjdjjA/YiY0Y0Y0Y0YI
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c028+0x150500 @ 0x550500
pos_c028+0x15044e @ 0x55044e
pos_c028+0x15040f @ 0x55040f
pos_c028+0x160b01 @ 0x560b01
pos_c028+0x164743 @ 0x564743
pos_c028+0x164a59 @ 0x564a59
pos_c028+0x164c0a @ 0x564c0a
pos_c028+0x163a4c @ 0x563a4c
pos_c028+0x163c88 @ 0x563c88
pos_c028+0x163d68 @ 0x563d68
pos_c028+0x166565 @ 0x566565
pos_c028+0x166408 @ 0x566408
pos_c028+0x167b9a @ 0x567b9a
pos_c028+0x695cf @ 0x4695cf
pos_c028+0x5168b @ 0x45168b
pos_c028+0x545d8 @ 0x4545d8
pos_c028+0x1408c5 @ 0x5408c5
pos_c028+0x5412c @ 0x45412c
pos_c028+0x54197 @ 0x454197
pos_c028+0x545d8 @ 0x4545d8
pos_c028+0x1408c5 @ 0x5408c5
pos_c028+0x501b4 @ 0x4501b4
pos_c028+0x168dd4 @ 0x568dd4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1636032
registers.edi: 1636220
registers.eax: 1636032
registers.ebp: 1636112
registers.edx: 0
registers.ebx: 5573720
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73662000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1717962257, next used block 12022528 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x001953a4 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0021ec08 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0021ec1c size 0x00000274
Bkav W32.AIDetectMalware
BitDefender Trojan.GenericKD.73863946
MicroWorld-eScan Trojan.GenericKD.73863946
Emsisoft Trojan.GenericKD.73863946 (B)
FireEye Trojan.GenericKD.73863946
MAX malware (ai score=80)
Kingsoft malware.kb.a.928
GData Trojan.GenericKD.73863946