Summary | ZeroBOX

Telltalely.chm

Suspicious_Script_Bin AntiVM AntiDebug
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 15, 2024, 2:15 p.m. Oct. 15, 2024, 2:17 p.m.
Size 482.6KB
Type ASCII text, with very long lines, with no line terminators
MD5 19a2f85327b3bca4544ea2a0880a5c5f
SHA256 6b38ffe8bf309a42dd3702e1004209da0127c2ff43d69bcf9ef24fc35e0f3d87
CRC32 F2199F7C
ssdeep 6144:Uw6CCuFl4bHd6vOAhjT1dghhcUgNu71xjI0ieCuYm4VrEuw8PjiQOZrgoXFbow8G:XK9+ILC/zRhDiTxFGw8hV+SejAC/
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7fefe5ba278
TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7fefe5bb394
SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7fefe59e1e2
TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7fefe584bcb
TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7fefe585cc1
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefe591ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefe5880d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefe5880b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefe587e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefe587d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x776eb894
LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x776e4249
RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x776e4180
strncpy_s+0x14a exit-0x92 msvcrt+0x9962 @ 0x7fefe689962
hh+0x1bc1 @ 0xff3d1bc1
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39
exception.instruction: call qword ptr [rax + 0x18]
exception.exception_code: 0xc0000005
exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278
exception.address: 0x7fefe5ba278
registers.r14: 0
registers.r15: 0
registers.rcx: 2614176
registers.rsi: 0
registers.r10: 1
registers.rbx: 0
registers.rsp: 1375920
registers.r11: 0
registers.r8: 1374464
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 8791660052512
registers.r13: 0
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 300 resumed a thread in remote process 2148
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x0000028c
suspend_count: 1
process_identifier: 2148
1 0 0