Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 20, 2024, 9:36 a.m.	Aug. 20, 2024, 9:40 a.m.

Size	323.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`52245c8ae7ec10fb61eeeb2b329e9a34`
SHA256	`2b44f40fb8a0827a131e9d11738cea7883dee351deba09d8ca3dd054c78fa71f`
CRC32	`C15FAEE0`
ssdeep	`6144:6hhSt3tbfzetfjzXc2lKp+jAFbwEWokqFQcuQ3g4mOBzNEO:SwBfzyfnpDyE2vBzNEO`
PDB Path	c:\welwjvp3lq2\obj\Release\G.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

66c1f0aa0deee_crypted.exe#1 "C:\Users\test22\AppData\Local\Temp\66c1f0aa0deee_crypted.exe#1"
1664

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 20, 2024, 9:36 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 20, 2024, 9:36 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 20, 2024, 9:36 a.m.			0	0
IsDebuggerPresent Aug. 20, 2024, 9:36 a.m.			0	0
IsDebuggerPresent Aug. 20, 2024, 9:36 a.m.			0	0
IsDebuggerPresent Aug. 20, 2024, 9:36 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

c:\welwjvp3lq2\obj\Release\G.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 20, 2024, 9:36 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 20, 2024, 9:36 a.m.	process_identifier: 1664 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004dc00', u'virtual_address': u'0x00002000', u'entropy': 7.994000774910276, u'name': u'.text', u'virtual_size': u'0x0004da04'}

entropy

7.99400077491

description

A section with a high entropy has been found

entropy

0.993610223642

description

Overall entropy of this PE file is high

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stealerc.1m!c
Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.Multi
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Lazy.588785
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.588785
Sangfor	Infostealer.Msil.Kryptik.Vjvc
K7AntiVirus	Unwanted-Program ( 700000121 )
BitDefender	Gen:Variant.Zusy.557413
K7GW	Unwanted-Program ( 700000121 )
Arcabit	Trojan.Zusy.D88165
VirIT	Trojan.Win32.GenusT.DYTO
Symantec	Trojan Horse
ESET-NOD32	a variant of MSIL/GenKryptik.HASV
APEX	Malicious
McAfee	Artemis!52245C8AE7EC
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Pwsx-10034591-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealerc.gen
Alibaba	Trojan:MSIL/RedLineSteal.b4095c82
MicroWorld-eScan	Gen:Variant.Zusy.557413
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:muh1ekS2vkIRor4TH3fr5Q)
Emsisoft	Gen:Variant.Zusy.557413 (B)
F-Secure	Trojan.TR/AD.RedLineSteal.cupyr
TrendMicro	TrojanSpy.Win32.REDLINE.YXEHSZ
McAfeeD	ti!2B44F40FB8A0
FireEye	Generic.mg.52245c8ae7ec10fb
Sophos	Mal/MSIL-KC
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.MSIL.Stealerc
Google	Detected
Avira	TR/AD.RedLineSteal.cupyr
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Sabsik
Kingsoft	MSIL.Trojan-PSW.Stealerc.gen
Gridinsoft	Malware.Win32.RedLine.tr
Xcitium	Malware@#3avom8v3za39k
Microsoft	Trojan:MSIL/Seraph.RG!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealerc.gen
GData	Gen:Variant.Zusy.557413
Varist	W32/MSIL_Kryptik.LLC.gen!Eldorado
AhnLab-V3	Trojan/Win.PWSX-gen.C5659776
BitDefenderTheta	Gen:NN.ZemsilF.36812.um2@aOD3Cig
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
Ikarus	Trojan.MSIL.Krypt
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEHSZ

66c1f0aa0deee_crypted.exe#1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All