popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

CrazyCoach.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer ftp PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 15, 2024, 2:17 p.m. Oct. 15, 2024, 2:24 p.m.
Size 2.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 05894e6439e626412c11b1c23eac073f
SHA256 042e2c5e4fe54168736c408dea6ce251a01ad59c1961f47438033204405ea2bb
CRC32 9B10F831
ssdeep 49152:uA/QyO+qnbHx11BLNTzrSTpah/yRjap+vMLBW5HEWoIthmrJGCxpbTjCw:zqrr5YpaN2nvM14HEZIngJGK
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
coach.028csc.com
A 47.240.68.28
47.240.68.28
s.z163.xyz
A 45.32.92.201
45.32.92.201
IP Address Status Action
164.124.101.2 Active Moloch
45.32.92.201 Active Moloch
47.240.68.28 Active Moloch

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name TEXTINCLUDE
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73442000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02510000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73441000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73404000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73442000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73441000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73404000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73442000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2832
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2832
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7257f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x764b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75831000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75b71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x730d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73921000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73261000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73441000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73404000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73442000
process_handle: 0xffffffff
1 0 0
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fd048 size 0x00000151
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fd048 size 0x00000151
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fd048 size 0x00000151
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002ff6b0 size 0x00000144
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe678 size 0x00000284
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe678 size 0x00000284
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x002fe1c0 size 0x0000018c
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003000c8 size 0x00000024
file C:\Users\test22\AppData\Local\Temp\libcurl.dll
file C:\Users\test22\AppData\Local\Temp\update.exe
file C:\Users\test22\AppData\Local\Temp\gzip.dll
file C:\Users\test22\AppData\Local\Temp\gzip.dll
file C:\Users\test22\AppData\Local\Temp\update.exe
file C:\Users\test22\AppData\Local\Temp\libcurl.dll
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL ¬*µcà# 'Š"¬B* "Dk0C_5C@ àA£ ðAì0B @B˜ëDT<0ôA¤.text܈"Š"``.dataˆ "Ž"@À.rdata@ýÀ"þ¨"@@.eh_fram¬îÀ<ð¦<@@.bss )°A€À.edata£ àA –A@@.idataìðA A@À.CRT0BºA@À.tls B¼A@À.rsrc 0B¾A@À.reloc˜ë@BìÄA@BƒìÇ$°…kèQ"ƒÄÍ´&¶WVSƒì‹D$$…Àur¡ °…k1҅À~Wƒè‹=<õ…k1ö£ °…kët&Ç$èÿ׃캉ðð±¤Í…k‰Ã…Àuß¡¨Í…kƒø„ÑÇ$èµ "ºƒÄ‰Ð[^_ t&ƒøuæd¡‹=<õ…k‹X1ö덴&9Ä°Ç$èÿ׃ì‰ðð±¤Í…k…ÀuÞ1Û¡¨Í…kƒø„ͅk…À„‘¡¨Í…kƒø„«…Ûtw¡@T€k…Àt‹T$(ÇD$‰T$‹T$ ‰$ÿÐƒì ƒ °…kºéIÿÿÿ´&fÇ$°…kèô"Ǩͅk‡¤Í…kéÿÿÿ´&»ébÿÿÿ¶‡¤Í…këÇD$†kÇ$†kǨͅkè²"éLÿÿÿt&ÇD$†kÇ$†kè”"Ǩͅké2ÿÿÿt&Ç$èT"éÿÿÿ´&´&UW‰ÏV‰ÆS‰Óƒì‰ì¸fk…ÒuI¡ °…k…Àthè A!‰|$‰\$‰4$è«S!ƒì ‰Å…Û„îƒû„åÇì¸fkÿÿÿÿƒÄ‰è[^_]ÐèË@!Cÿ‰|$‰\$‰4$ƒø‡ôèŸýÿÿƒì …Àu1í뿍t&‰|$‰\$‰4$è0S!ƒì …À„Õƒû…qÿÿÿè—=!‰|$ÇD$‰4$èS!ƒì ‰Å…À…qÿÿÿ‰|$ÇD$‰4$èòR!ƒì ‰|$ÇD$‰4$èËR!ƒì ‰|$1íÇD$‰4$èýÿÿƒì é%ÿÿÿ´&v‰|$‰\$‰4$èR!ƒì ‰Å‰|$‰\$‰4$èËüÿÿƒì …À…ëþÿÿ1íéäþÿÿ´&fèkR!ƒì ‰Åé»þÿÿƒûtƒ1íé¿þÿÿt&ƒì Ǽͅk‹L$‹T$‹D$èRþÿÿƒÄ  ´&t&ƒì‹D$ Ç$°…k‰D$è¹"ƒÄАU‰åWVSƒìÇ$Àfkÿ¤ô…kƒì…Àts‰ÃÇ$Àfkÿèô…k‹=¬ô…kƒì£°…kÇD$Àfk‰$ÿ׃ì‰ÆÇD$)Àfk‰$ÿ׃죠fk…ötÇD$°…kÇ$$Á€kÿÖÇ$€Dkè^ÿÿÿeô[^_]Ͷ¸¾ëÀt&U‰åƒì¡ fk…Àt Ç$$Á€kÿС°…k…Àt ‰$ÿ|ô…kƒìÉÐUW‰×V‰ÆSƒì,‰L$ÇD$Ç$0ÿ fk…À„¤‰4$‰Ãè"‰4$‰Åÿ  fk‰…Àtk…íuM‰<$ÿ  fk‰C …ÀtU‹D$‰C‹D$@‰C‹D$D‰$èk=f‰C‹D$H‰$è[=f‰CƒÄ,‰Ø[^_]Ít&€|.ÿ.u¬ÆD(ÿ륍´&v‹‰$ÿ fk‹C ‰$ÿ fk‰$ÿ fkƒÄ,1ۉØ[^_]Ít&UW‰ÏV‰ÖSƒì,‹‰D$¶„Àuë~¶¶AƒÁ„Àtm< tñ< tí‰Êë"´&f< •Ã< •À„Ãt¶BƒÂ„Àt hŁåýu܋D$‰Ó‰)Ët.9ûs*‰\$‰4$‰L$èl"ƃÄ,1À[^_]Ͷ‹D$‰ƒÄ,¸+[^_]Ít&ƒìD$(ÇD$`Àfk‰D$‹D$ ‰$豅!ƒÄÍ´&¶UWVSì¼‰D$0‰ÐT$LL$H‰T$(T$P\$b‰T$$t$WT$m‰L$¼$¯L$D¬$®‰T$ ‰|$‰\$‰L$‰l$ ‰t$ÇD$`Àfk‰$èbÿÿÿƒø t Ä¼[^_]ÃfT$m‰$è´þÇD$ŒÀfk‰D$<‹D$H‰$‰D$4‹D$D‰D$8è°…À…øÇD$Àfk‰$蘅À…0‰$1ÛÇD$’Àfkè~ÇD$ŒÀfk‰4$…À•ÃÁãèf…À…ÇD$Àfk‰4$èN…À…ÖÇD$’Àfk‰4$è6¹ …À„<ÿÿÿ…Û„4ÿÿÿ‹D$4‰$‰ú‰D$‹D$8‰D$‰èèåüÿÿ…À„ÿÿÿ‹T$L‹L$P‹|$0‹t$<‰P 1҅ɕ‰p‰PP$‰T$ ‰D$‹G‰D$G‰$èpÄ¼[^_]Ít&»ÇD$ŒÀfk‰4$è›…ÀuGÇD$Àfk‰4$臅À„9ÿÿÿ¹éTÿÿÿt&¹é=ÿÿÿ¶»뮍´&f¹é%ÿÿÿ¶¹é ÿÿÿ¶‹D$º•Àfkƒèƒøw‹… Âfk‰ÐÍt&SƒìÇD$Ç$ÿ fk‰Ã…Àt@ÇD$‰$ènÇCƒÄ‰Ø[ÃWVSƒì‹|$ ‹\$$‹‰$ÿ fk‰$ÿ  fk‰…À„´ÇD$–Àfk‰$è䲉ƅÀtoÇ$ÿÿ fk‰Ã…Àtev‰t$ÇD$ÿ‰$è°…Àt0¶‰Ú„Àuët&¶BƒÂ„Àt < tñ< tí<#tÁ‰øèÒüÿÿ븉$ÿ fk‰4$è"1ÀƒÄ[^_ˉ$ÿ fkÇÇ$ÿ fk‰4$èð"¸ë̍´&f‹T$¸+…Òt ‹D$‰P1ÀÍ´&fUWVSƒì‹l$0‹}…ÿtR‹_…Ût0´&‹3‹[‹‰$ÿ fk‹F ‰$ÿ fk‰4$ÿ fk…Ûu׋‰$ÿ fk‰<$ÿ fkÇEƒÄ[^_]Ít&UWVSì¬‹´$ÄÇD$x‹¼$ȅötf‹Fƒà…ÿtR1ۅÀu=1ۀ?t6D$x‰|$‰D$ D$t‰D$‹„$À‰$èâ‰Ã…Àt<‹D$x‰$ÿ fkÄ¬‰Ø[^_]Ãf‹>…Àu…ÿuªÄ¬1ۉØ[^_]Í´&‹D$tÇD$uÇD$‰D$ Ç$œÀfkèì"‹v…ö„ä‰\$l‰¼$È鐋C‹k º•Àfk‹L$|‰D$D‹„$€‰D$H‹„$„‰D$L‹„$ˆ‰D$P‹„$ŒƒÀ‰D$T‹„$l‰D$X·C‰D$\‹C ‰D$`‹Cƒèƒøw‹… Âfk·C‰D$d‹‰D$h‹C‰l$<ƒèƒø‡Ì‹\$D‰L$4‹…
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Üã哘‚‹À˜‚‹À˜‚‹Àž…À³‚‹À®¤À_‚‹À®¤€ÀÀ‚‹À㞇À‚‹À͘À´‚‹Àú˜À‚‹À˜‚ŠÀŀ‹Àp€Àò‚‹ÀpÀƒ‚‹À˜‚‹À¼‚‹À_„À™‚‹ÀRich˜‚‹ÀPELf ifà `   pö° @0ûÄ*¤ÄvÀ   €à `° T@à.rsrc X@À3.95UPX! )&A‚¨L´Ê,ÛgF° I±°hÄ9ͦa4X@ð´¬q®7€Å{˜Bº~*ݘ¾*©cøh<s=q`†Ç,Æǜ%Ú¹¿eÝÛ°«Ú2ߘÄ}¢wæ ð±šnjš/œ)Iq¾b`"xTÄo¦Çº6¥uÿ8y¶¦«'ßZxr|ý¦E ΛÙ­P““È€™ˆ+Ë(÷¼uRˆbÒ¢`Jøel,TW ~hªÓ#a¸KóÁ0×Òü )ÿ_‚hÉLw¹4Aвîì¿RëÜڨΈü»¬Ÿ˜|¨Ù‚>°}–,!çÃoU`ƒ?õC£ÇL÷÷ñ´¸+GFzþ]¿ç›uÞSu‘Jü€â$ɐɻQVc‰[ëqK?‡©ým;&Þtß\aò·°6óóZ>´è–3“L…ÎTïSÔ¸nVeÞ=‘Õmö•ºÏàÿ¯™>-‡ðFÑ$¯ö½†Z4{H¢L Aßî7Šº4[L£eí~u ÍcðqC¡U1 Ý<šÐf‚$WÏEۘ{™²Où«1™hf)WÛ1 É#È`+­&¸å¹lHñeÁ§ù“–Í ¿ðNª Q¥ ªsdóÙ éÌ÷ßôß X5‰0þŠÍŸ¨C‹j•c±q·.,UhÛ\ü0^g: Üng˜!n2&D¨[FŸ†²õoú‹WŽ£åÒp…{ï¶kÞ¥ ÷iÀŠŸ+X|µ3۞N¼ `ö‹yÿa+¦ÏOºOGÛCk’ý§¢ši±¯3„{3œ„‹Ž…—<êÔÇòòo¹F¦;@Õ\$è é³£37íÅRº5È[Ãpèñý@ã<Tè/ ‡ S±Ûِ9XF ò½5±¢P‹uFc*#{5 ËUÃôÖ_h;81qŽ~Ä~•4¯%ñ¥EQ Ž‰·žÎæ”%Ã[ž1ºyÎßÄ2t\îc·ÛQ ìÁ&9)r-uDÄä{ñ¡×ãçâ ﻧ*p‹ 6¯?f=1³ÂìblçþÀy@«Æ (Ãókô´ù„ýW;ÆɅÕ•tØýmÇõ 5,Iݚqa@Ì5Òqݜf¢ÍŸ‰bR/T](LÅHÕWâ@m81À~·uëePÔDµ±ñîP5'—p÷¾Œÿ¢šažÍ@Â¾3äpœâ•XõÎI¨†F¢\Ä3•6îÎèlï#y.?;üçA9NÎþ)`Ý!ùÒd­…Ó# #<”_ÂC­ ýfØ=_ÐÝ^1ü"µ"Cl$ª5VdnëÛ"÷ “aç×éw,\L‹í{Y÷p;Üyubb¢á›«ëä ª³)IÒIž¥ÔÜbÜÓR“â.)£EáCÕ*ÿåƒ)@ÏtÜû ®ÂYš­M1àwÏüTvq›QŸv¯æ!ø`Ç­¬¶cö×…k²¨"#3 …îi•k—3ÎömèýÙtùs¦NzJ½VZÈlÅ¿t.D\|’$·C)$ûI/E i5–ã`*4èJ—vPö o£Ñ<›-Ä.3Ö;;€“@y„;iôÄÚê©“0)qX[ì¹Aêâbò–”£ñqdV· vE㎎vÉ-‹p²¨—QFF=6Å?ª.,Pu!›À¨{¬t×åô;?#PžC¾ç81:ž?ÆOÚg`×úùìõ`Rнp¤Nq剎ϩ†PçÜ0ˆW ü:ÑÃoòÔûS ½Q¡M6ß;£«è$=ö‘òªæùǧ1uuòÞmEàƒ¤@±CâÌxJê¼qzÿÏ0sؼ¥¸°¡–Øto¦%&^m7£8‡Â^RI/3ºVEiOŒB.+Å]Óa7Žç¤EOâZöõèo£¡/No_ë`d‘˜¨É_“N wm è|kÊå)#µ…ÆĒåÓ]PLZ±ƒš­=ž¢ÆBÕjOÔþˆrñCÏLŸu³V ÅKå¸ÓH!Ø@ÑÃ+Þ M{1—“K=:,A¯ Y¥ðWñcÓB bó^€UnŽ£ˆw³Œsÿ…Õà³Yü§Nó;V1š ÷¬ÝöV¡E:Ži›þŠ¸IeG"1Ä$8w<ʐh%Ӑ5&.þ3‚m™ŒþÀ~ØÃL—#=ffµXFîe~Æ·Ó®´ë¹A ¬ÜjÅZB]°€Š÷©¼ ë©ÆN/öxvëҜ(ãAc,  k.7嚳^ÇFƒ{X_Zà͏4jà2TæÊß½å ý´Ï†Ô5Ö;ùÓâ ΚtÀWd6FÛ¸7¡?EWéZ>mNZªYÖ¦ßÚM'År9³Ô7Y§ýÆ y`×Q·%Ìl&ë>OÏ[Vԃ@ë>óBfÔ»ê=ñ’]~ç4 *(_…ö@þLù¶¼ÙÂ?»e6þ”uçã}¡|Ûv½ªÁç*÷¿Ðx£ƒwSó”ú¶ŸÞexߙBø{1S#Œ9µ„«c“Ì‚Éì0ö\ ‹œ =æà"&(y1ÍV,Ê]³ƒI´š“ìæˆÆŽ‚¥/Ӗ#fFà×ñµ ~lM­ÜZZz[9¶[çt(.  ÙSÒƒÂj‘ÑÔG•¤Šƒ>2B 62¨Î(Äý9:$®˜ €2f‚\ª­¦¦¿”¹Ñ\†aŸà;&$Œáñ!º”ûòX~³`RoÄ|jP‘z)ùç©|_‘IFÑXWª@ Ž®U³@žGRâÜÍ5• / u_'¢(u­¸¤¼Q@÷ .¯ËrÖ¥“;5ª7äZYQ,{Aîå¼}=÷qqúÎ÷Q²óÈÛ¯«G˜ 27mvv¡#© oäCñöhMj ,Ú-…Òcnv— ¨ɕÝ¡æÞ¾ñÝã5;áR÷Ìgɓ‚ô€ò:ÏNùŠè¡Hh2\øq™!,!OqKr(Pu’¢ÇéÐ}$H™˜"ÈI^^R‹¹›ïufŽðÚ6i#dÿ#äŠ~›á'ÄVÄû[ã\2œ%ڋûKÏÛcmiãȃì=qéì׏F™æäBhB˜Âïdb¸P¨/›Çˆ˜,KÆXùþ"/ T[gr¶ìåf½ä/ÂTpðF›ÝOZΔ‘ý¨þ_XV­Ÿç2Sg³¡q©Ü%žï~(¥T›ðÍÂMÊló_ êç‚lä´RÁsf¤‚ Ý!ƒoô Z¤^€•)9¨ÏŠdˆi®@a]XD­–6ÛÌ%`wbO+»]æýš™ãÎ÷²@·ÔLͬ »€…Ê̝h±¦u©KØIJჲ¬êV0’6^紇®2³$¹vÚC¯ à»ôÞÊü@fΛ>—«n(ý/½É.—Ùç+°êÞ¨ùÖ¼W՜—_p²¾m éäË·†úëú»–´èpLñ€\eè›Om> ó27/'Ã!DÕ3’çîÃ_ì¨ þ<”A­yðì–òܬ£¤#¼-A¢»©G?·}¼óeÓ./ßÚZ‚m黑EƒãØÝg¬¶KM§ãjÞëÜ.$²ÜdçcŽ&ƒë«™Ñ¢%ô[‰ÙþCà>Áß6ÉøBGP®ûyn!2ÔÂmëÿDp̒¹ÊV¥¼~Žh­`ܡɀ7 Â<}r Râ—„µ‰´Ø-çùâ–é÷§6,Zm!‰eÁÝZSÚó˜xÒò±Øîê„|ºaÈD¤Ì$k˜sù'BŸYf£Å Í,#L¢L§eÕ;n¢DЭ´Eî@Æ üÒB÷9š• d à-áø¦÷Ét:Cö;Nè7ßÌ)ý'Š¾,)°ÔÏۋê­Ê`!5¾é ï Ͳc> óNÈè¬A'Sñ‘g>›$=€oR„<>•…¯otÂ2Çœ»¯_¢f?óÈBŠv &Áx%pžu®-DyPÆË túÝ®TH5F®JkðcBmò¤û,;m¡zÌ-T@)0ôå#Ó¬¢$õ|Æï˜џ­•«!Jî£Æюý§óò[ǂ.ŒwÁ­¨^ì6©Ùš÷R\ȋVckUšã.žJ:¼Y‘MºuK=Š%Ÿ†Ð
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x001e1c00', u'virtual_address': u'0x00001000', u'entropy': 7.359521858796242, u'name': u'.text', u'virtual_size': u'0x001e1b8e'} entropy 7.3595218588 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000200', u'virtual_address': u'0x0031e000', u'entropy': 6.855434502813052, u'name': u'.text', u'virtual_size': u'0x00000200'} entropy 6.85543450281 description A section with a high entropy has been found
entropy 0.69572279372 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2552
process_handle: 0x000003b8
0 0

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2552
process_handle: 0x000003b8
1 0 0
process CrazyCoach.exe useragent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
process update.exe useragent Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.vc
ALYac Gen:Variant.Babar.223737
Cylance Unsafe
Sangfor Trojan.Win32.Agent.Vck8
CrowdStrike win/malicious_confidence_90% (D)
BitDefender Gen:Variant.Babar.223737
K7GW Trojan ( 0040f54a1 )
K7AntiVirus Trojan ( 0040f54a1 )
Arcabit Trojan.Babar.D369F9
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX Malicious
Avast Win32:Pasta [Cryp]
ClamAV Win.Malware.Trojanx-9951053-0
Kaspersky UDS:DangerousObject.Multi.Generic
NANO-Antivirus Virus.Win32.Agent.dvixmz
MicroWorld-eScan Gen:Variant.Babar.223737
Rising Packer.Win32.Agent.g (CLASSIC)
Emsisoft Gen:Variant.Babar.223737 (B)
DrWeb Trojan.PWS.Wsgame.57795
VIPRE Gen:Variant.Babar.223737
McAfeeD Real Protect-LS!05894E6439E6
Trapmine malicious.high.ml.score
CTX exe.trojan.generic
Sophos Mal/EncPk-AQI
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.05894e6439e62641
Jiangmin Trojan/Agent.edyx
Google Detected
Antiy-AVL Trojan/Win32.SBadur
Kingsoft malware.kb.a.988
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium TrojWare.Win32.Agent.OSCF@5rs7jr
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win32.Trojan.PSE.1TYMTF4
Varist W32/Trojan.CLL.gen!Eldorado
AhnLab-V3 Malware/Win.Generic.R668664
Acronis suspicious
McAfee Flyagent.d
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.MulDrop
Malwarebytes Generic.Malware.AI.DDS
Ikarus Trojan.Win32.Disabler
Zoner Probably Heur.ExeHeaderL
MaxSecure Trojan.Malware.300983.susgen