popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Bundicut.exe

Suspicious_Script_Bin Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 13, 2024, 12:05 p.m. Oct. 13, 2024, 12:08 p.m.
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c065ba22909fc8dbded4ea0eebb24ad5
SHA256 9817f4d8bc1374f102196cfcb8a351abdc0563dea60f6084a7525e5ee5409b6d
CRC32 2D388F88
ssdeep 24576:vqJm/Xl+FIqBwq4QlGsljfzlE6J4zYfs6nScxy63:S4l+OqyLQHugVfDnS8y63
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) moved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Adidas=T
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: mxrGRochester-Vice-Assign-J-Su-Minus-Dream-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'mxrGRochester-Vice-Assign-J-Su-Minus-Dream-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: KQENutrition-Tue-Promotion-Subtle-Nicaragua-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'KQENutrition-Tue-Promotion-Subtle-Nicaragua-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: KmSPRack-Mem-Badge-Modular-Pee-Dd-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'KmSPRack-Mem-Badge-Modular-Pee-Dd-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Foot=H
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: ESLfShit-Pills-Tvs-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'ESLfShit-Pills-Tvs-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: OSGuns-General-Terry-Telephone-Barn-Stress-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'OSGuns-General-Terry-Telephone-Barn-Stress-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: VMfMarried-Schools-Tracks-Bradley-Massive-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'VMfMarried-Schools-Tracks-Bradley-Massive-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: KmWTent-Jail-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'KmWTent-Jail-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
file C:\Users\test22\AppData\Local\Temp\103495\Powder.pif
cmdline "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
file C:\Users\test22\AppData\Local\Temp\103495\Powder.pif
file C:\Users\test22\AppData\Local\Temp\103495\Powder.pif
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c move Centres Centres.bat & Centres.bat
filepath: cmd
1 1 0
section {u'size_of_data': u'0x00008600', u'virtual_address': u'0x000f4000', u'entropy': 7.386337967469147, u'name': u'.rsrc', u'virtual_size': u'0x000085a8'} entropy 7.38633796747 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x000fd000', u'entropy': 7.948997141079563, u'name': u'.reloc', u'virtual_size': u'0x00000f32'} entropy 7.94899714108 description A section with a high entropy has been found
entropy 0.490196078431 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline tasklist
cmdline cmd /c move Centres Centres.bat & Centres.bat
cmdline "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
Bkav W32.AIDetectMalware
Sangfor Trojan.Win32.Agent.Vsbz
CrowdStrike win/grayware_confidence_60% (D)
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
Trapmine suspicious.low.ml.score
FireEye Generic.mg.c065ba22909fc8db
Microsoft Trojan:Win32/Phonzy.B!ml
GData Win32.Trojan.Ilgergop.W1D270
DeepInstinct MALICIOUS
huorong Trojan/BAT.Agent.cv
Paloalto generic.ml
file C:\mIRC\mirc.ini
Process injection Process 2168 resumed a thread in remote process 2692
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000084
suspend_count: 0
process_identifier: 2692
1 0 0