Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 30, 2024, 9:33 a.m.	Sept. 30, 2024, 9:50 a.m.

Size	310.0KB
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`17fb69181d1a92988f6a56b46578f808`
SHA256	`884039ab697c811a11dc4e3cc03bea9c3fb7e8dbfe0b0722318ce9cc456e4a82`
CRC32	`C4CBDC86`
ssdeep	`6144:+UEoCtY62ldcXh0GUPbC7/r9ky5j/9YqKtfqYohOb0dioBt:GouZ9Xhybcrjj/9KtiYoXf`
PDB Path	C:\Users\O-Frank-Research\Downloads\PortBender-main\PortBender-main\src\PortBender\x64\Release\PortBender.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\884039ab697c811a11dc4e3cc03bea9c3fb7e8dbfe0b0722318ce9cc456e4a82.exe.exe.dll,
2164
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\884039ab697c811a11dc4e3cc03bea9c3fb7e8dbfe0b0722318ce9cc456e4a82.exe.exe.dll,ReflectiveLoader
2052
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\884039ab697c811a11dc4e3cc03bea9c3fb7e8dbfe0b0722318ce9cc456e4a82.exe.exe.dll,ReflectiveLoader
  2248

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

pdb_path

C:\Users\O-Frank-Research\Downloads\PortBender-main\PortBender-main\src\PortBender\x64\Release\PortBender.pdb

section

_RDATA

Bkav	W64.AIDetectMalware
Lionic	Hacktool.Win32.Inject.3!c
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74213988
Sangfor	Hacktool.Win32.Inject.V5sb
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.74213988
Arcabit	Trojan.Generic.D46C6A64
Symantec	Packed.Generic.700
Avast	Win64:HacktoolX-gen [Trj]
Kaspersky	HEUR:HackTool.Win32.Inject.heur
Alibaba	HackTool:Win32/Inject.1c609df3
MicroWorld-eScan	Trojan.GenericKD.74213988
Rising	Hacktool.Inject!8.36B (CLOUD)
Emsisoft	Trojan.GenericKD.74213988 (B)
McAfeeD	ti!884039AB697C
CTX	dll.hacktool.inject
Sophos	Harmony Loader (PUA)
FireEye	Trojan.GenericKD.74213988
Google	Detected
Antiy-AVL	HackTool/Win32.Inject
Kingsoft	Win32.HackTool.Inject.heur
Gridinsoft	Hack.Win64.Patcher.sa
ZoneAlarm	HEUR:HackTool.Win32.Inject.heur
GData	Trojan.GenericKD.74213988
Varist	W64/ABRisk.OJKG-4847
McAfee	Artemis!17FB69181D1A
DeepInstinct	MALICIOUS
Ikarus	Trojan.Win64.Hacktool
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R014H07IS24
MaxSecure	Trojan.Malware.10455307.susgen
Fortinet	W32/PossibleThreat
AVG	Win64:HacktoolX-gen [Trj]
alibabacloud	HackTool:Win/Inject.hyrv

884039ab697c811a11dc4e3cc03bea9c3fb7e8dbfe0b0722318ce9cc456e4a82.exe.exe