popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C110.exe

Malicious Library UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 20, 2024, 9:30 a.m. Aug. 20, 2024, 9:32 a.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 86de5cffa568d6a2392d576fc6535b3b
SHA256 0f165fb1adf68683c2a9d89f51d9db0c533bb26c29e6a303af748942f8a1511c
CRC32 011A6A9A
ssdeep 24576:4T2o2ln+HxdLKJgPB90O8sHh4ZGsg+QaC55gM2:4T24H7kO7mGkCDh
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c110+0x10e0fc @ 0x50e0fc
pos_c110+0x10e04a @ 0x50e04a
pos_c110+0x10e00b @ 0x50e00b
pos_c110+0x11e6fd @ 0x51e6fd
pos_c110+0x12233f @ 0x52233f
pos_c110+0x122655 @ 0x522655
pos_c110+0x122806 @ 0x522806
pos_c110+0x121648 @ 0x521648
pos_c110+0x121884 @ 0x521884
pos_c110+0x121964 @ 0x521964
pos_c110+0x124161 @ 0x524161
pos_c110+0x124004 @ 0x524004
pos_c110+0x125b6b @ 0x525b6b
pos_c110+0x66d53 @ 0x466d53
pos_c110+0x4eef7 @ 0x44eef7
pos_c110+0x51e44 @ 0x451e44
pos_c110+0x4ecc7 @ 0x44ecc7
pos_c110+0x51998 @ 0x451998
pos_c110+0x51a03 @ 0x451a03
pos_c110+0x51e44 @ 0x451e44
pos_c110+0x4ecc7 @ 0x44ecc7
pos_c110+0x4da20 @ 0x44da20
pos_c110+0x126e88 @ 0x526e88
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1636300
registers.edi: 1636488
registers.eax: 1636300
registers.ebp: 1636380
registers.edx: 0
registers.ebx: 5302356
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00149598 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00154704 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00154718 size 0x00000274
ALYac Gen:Variant.Fragtor.597441
VIPRE Gen:Variant.Fragtor.597441
BitDefender Gen:Variant.Fragtor.597441
Cybereason malicious.fa568d
Arcabit Trojan.Generic.D4614FF3
MicroWorld-eScan Gen:Variant.Fragtor.597441
Emsisoft Gen:Variant.Fragtor.597441 (B)
FireEye Gen:Variant.Fragtor.597441
MAX malware (ai score=81)
GData Gen:Variant.Fragtor.597441