Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 17, 2024, 1:29 p.m.	Sept. 17, 2024, 2:13 p.m.

Size	155.5KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c3555ffa261822a6b1d04314c5370151`
SHA256	`a8b4fb8e5e17df94c0caa0118382f193ec0fa63703b14d0efc12317f7b80f4ce`
CRC32	`B6740653`
ssdeep	`3072:GewS32JhImIpXUeXljzm7ikzXCciWM5koxQY1ZK3d2qcyEzc5:GeR3tmIpUQl3QikzPHM5koxQY1ZZvQ`
PDB Path	c:\9qehe\obj\Re\ease\gqa.pdb
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) IsPE32 - (no description)

CnyvVl.exe "C:\Users\test22\AppData\Local\Temp\CnyvVl.exe"
652

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 17, 2024, 1:29 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 17, 2024, 1:29 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 17, 2024, 1:29 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:29 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:29 p.m.			0	0
IsDebuggerPresent Sept. 17, 2024, 1:29 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

c:\9qehe\obj\Re\ease\gqa.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 17, 2024, 1:29 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 17, 2024, 1:29 p.m.	stacktrace: exception.instruction_r: 8b 4a 4c 51 8b 4a 30 51 8b 8d ef 00 00 00 51 ff exception.instruction: mov ecx, dword ptr [edx + 0x4c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2672329 registers.esp: 4582796 registers.edi: 40313087 registers.eax: 1971378608 registers.ebp: 40312764 registers.edx: 4025872912 registers.ebx: 3968769764 registers.esi: 131072 registers.ecx: 774111232	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 17, 2024, 1:29 p.m.	process_identifier: 652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02671000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00026200', u'virtual_address': u'0x00002000', u'entropy': 7.989348570179122, u'name': u'.text', u'virtual_size': u'0x00026194'}

entropy

7.98934857018

description

A section with a high entropy has been found

entropy

0.983870967742

description

Overall entropy of this PE file is high

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.MSILMamut.4!c
CAT-QuickHeal	Trojan.MSIL
Skyhigh	Artemis!Trojan
ALYac	IL:Trojan.MSILMamut.13721
Cylance	Unsafe
VIPRE	IL:Trojan.MSILMamut.13721
Sangfor	Trojan.Msil.Kryptik.Vtr6
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	IL:Trojan.MSILMamut.13721
K7GW	Trojan ( 005b9f261 )
K7AntiVirus	Trojan ( 005b9f261 )
Arcabit	IL:Trojan.MSILMamut.D3599
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.HBFX
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Zusy-10035770-0
Kaspersky	HEUR:Trojan.MSIL.Stelpak.gen
Alibaba	Trojan:MSIL/LummaStealer.26947df9
MicroWorld-eScan	IL:Trojan.MSILMamut.13721
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:NfcgCpRPYFzlrHLlrO8CFA)
Emsisoft	IL:Trojan.MSILMamut.13721 (B)
F-Secure	Trojan.TR/Kryptik.eptzf
DrWeb	Trojan.Packed2.47854
Zillya	Trojan.Stelpak.Win32.715
TrendMicro	TROJ_GEN.R053C0DIA24
McAfeeD	ti!A8B4FB8E5E17
CTX	exe.trojan.msil
Sophos	Troj/MSILIn-BFQ
Ikarus	Trojan.MSIL.Krypt
FireEye	IL:Trojan.MSILMamut.13721
Google	Detected
Avira	TR/Kryptik.eptzf
Kingsoft	MSIL.Trojan.Stelpak.gen
Gridinsoft	Trojan.Win32.Packed.dd!ni
Microsoft	Trojan:MSIL/LummaStealer.KAP!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Stelpak.gen
GData	IL:Trojan.MSILMamut.13721
Varist	W32/MSIL_Agent.IOI.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5665865
McAfee	GenericRXWP-BQ!C3555FFA2618
DeepInstinct	MALICIOUS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R053C0DIA24
Tencent	Malware.Win32.Gencirc.14191cd8
Yandex	Trojan.Stelpak!jeVGZIZe46g
huorong	Trojan/MSIL.Agent.li
Fortinet	MSIL/Kryptik.AMFU!tr

CnyvVl.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All