popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

SearcherBar.lnk

Generic Malware AntiVM Lnk Format AntiDebug GIF Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 15, 2024, 12:19 a.m. Sept. 15, 2024, 12:22 a.m.
Size 1.7KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Nov 20 15:48:36 2014, mtime=Thu Nov 20 15:48:36 2014, atime=Thu Nov 20 15:48:36 2014, length=12800, window=hide
MD5 9226ae2c94c666419fb8ec35ec248d08
SHA256 25aa062124d2b1470c574b0ec79663b406c1139586ce7abe9bfa2596d30c78da
CRC32 7947AFA7
ssdeep 24:8TZDOy728Aej+/eSj5aao/kzZE/5rab/DpQUN6:8dDDYH6ks1able
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73352000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\SearcherBar.lnk
cmdline "C:\Windows\System32\mshta.exe" C:\SearcherBar\run.hta
Zoner Probably Heur.LNKScript
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef90000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 2560 resumed a thread in remote process 2684
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000334
suspend_count: 1
process_identifier: 2684
1 0 0