Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 3, 2024, 9:27 a.m.	Sept. 3, 2024, 9:42 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ad714ee48d2e829c5012c65de6166c05`
SHA256	`7d32d13d123871650794a1e172adc70bc8dafbdb762f49d889f813844d532b20`
CRC32	`E7B45BF2`
ssdeep	`24576:ZfaPwrgBrO1BKH8jPcWYVxHCoh0XeV61r9qZWe7d7NWS91GsVz9cebgS9aI:ZCPwrgBWBKH8jkDVFCNXODzWS9HfX0HI`
PDB Path	C:\Users\tickr\Downloads\SecHex-Spoofy-main (4)\SecHex-Spoofy-main\SecHex-GUI\SecHex-GUI\obj\Debug\net6.0-windows\SecHex-GUI.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

SecHex-GUI.dll "C:\Users\test22\AppData\Local\Temp\SecHex-GUI.dll"
2068

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 3, 2024, 9:27 a.m.			0	0
IsDebuggerPresent Sept. 3, 2024, 9:27 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\tickr\Downloads\SecHex-Spoofy-main (4)\SecHex-Spoofy-main\SecHex-GUI\SecHex-GUI\obj\Debug\net6.0-windows\SecHex-GUI.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 3, 2024, 9:27 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (33 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3571000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c0b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000cf0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3574000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3574000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3574000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3574000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93dca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ddc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ea6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2024, 9:27 a.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93dcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00156c00', u'virtual_address': u'0x00002000', u'entropy': 7.884641100859472, u'name': u'.text', u'virtual_size': u'0x00156b04'}

entropy

7.88464110086

description

A section with a high entropy has been found

entropy

0.998543335761

description

Overall entropy of this PE file is high

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Redcap.4!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Gen:Variant.Application.Lazy.430285
Cylance	Unsafe
VIPRE	Gen:Variant.Application.Lazy.430285
Sangfor	Hacktool.Msil.Lazy.Vgju
K7AntiVirus	Hacktool ( 005b23f11 )
BitDefender	Gen:Variant.Application.Lazy.430285
K7GW	Hacktool ( 005b23f11 )
Cybereason	malicious.48d2e8
Arcabit	Trojan.Application.Lazy.D690CD
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/HackTool.Agent.XV
McAfee	GenericRXWL-HD!AD714EE48D2E
Avast	Win32:MalwareX-gen [Trj]
Alibaba	Trojan:Win32/MalwareX.48fa1316
NANO-Antivirus	Trojan.Win32.Redcap.koqpsl
MicroWorld-eScan	Gen:Variant.Application.Lazy.430285
Rising	Trojan.ScarletFlash!8.FB27 (CLOUD)
Emsisoft	Gen:Variant.Application.Lazy.430285 (B)
F-Secure	Trojan.TR/Redcap.ssmwv
Zillya	Tool.Agent.Win32.134724
TrendMicro	TROJ_GEN.R002C0PKN23
McAfeeD	ti!7D32D13D1238
FireEye	Gen:Variant.Application.Lazy.430285
Sophos	Mal/Generic-S
Ikarus	Trojan.IL.MSILZilla
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Redcap.ssmwv
MAX	malware (ai score=73)
Antiy-AVL	GrayWare/Win32.Puwaders
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:MSIL/Malgent!MTB
GData	Gen:Variant.Application.Lazy.430285
Varist	W32/ABApplication.ZPDE-8807
AhnLab-V3	Trojan/Win.Generic.C5530079
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2206580665
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0PKN23
Tencent	Malware.Win32.Gencirc.141564ae
MaxSecure	Trojan.Malware.215941052.susgen
Fortinet	PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	HackTool:MSIL/Malgent

SecHex-GUI.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All