popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cs-daili.exe

Admin Tool (Sysinternals etc ...) UPX PE32 MSOffice File PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 16, 2024, 10:59 a.m. Oct. 16, 2024, 11:12 a.m.
Size 296.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4adcb0f7a3d272d2897488bc269a102b
SHA256 a59992138030f8f040b0048d8e7e1faf429bdfd2d0ef1ea26fecb90f40a862ed
CRC32 8FF226A4
ssdeep 3072:ct0QIFAhuRVXBuhqofdJSrwYbpH1WkmkOtjSFK2JCoNQTDF/QzJocznlJYyuTh:hQ/sA63H7FKu+PFmJZpJo
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1633948
registers.edi: 1634136
registers.eax: 1633948
registers.ebp: 1634028
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634136
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634008
registers.edi: 1634196
registers.eax: 1634008
registers.ebp: 1634088
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634196
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634004
registers.edi: 1634192
registers.eax: 1634004
registers.ebp: 1634084
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634192
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634004
registers.edi: 1634192
registers.eax: 1634004
registers.ebp: 1634084
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634192
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634008
registers.edi: 1634196
registers.eax: 1634008
registers.ebp: 1634088
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634196
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634012
registers.edi: 1634200
registers.eax: 1634012
registers.ebp: 1634092
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634200
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634008
registers.edi: 1634196
registers.eax: 1634008
registers.ebp: 1634088
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634196
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1634008
registers.edi: 1634196
registers.eax: 1634008
registers.ebp: 1634088
registers.edx: 0
registers.ebx: 5458864
registers.esi: 1634196
registers.ecx: 2
1 0 0

__exception__

 stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008f
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1636560
registers.edi: 5458864
registers.eax: 1636560
registers.ebp: 1636640
registers.edx: 0
registers.ebx: 5458864
registers.esi: 5458864
registers.ecx: 2
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004a0f0 size 0x000001fc
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003e0000
process_handle: 0xffffffff
1 0 0
Lionic Trojan.Win32.Babar.4!c
Skyhigh BehavesLike.Win32.VBObfus.dm
Cylance Unsafe
Sangfor Trojan.Win32.Agent.Vsxg
Symantec Trojan.Gen.MBT
Avast Win32:Malware-gen
McAfeeD ti!A59992138030
CTX exe.trojan.babar
Antiy-AVL Trojan/Win32.Agent
McAfee GenericRXQP-XP!4ADCB0F7A3D2
DeepInstinct MALICIOUS
AVG Win32:Malware-gen