Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 16, 2024, 11:06 a.m.	Oct. 16, 2024, 11:29 a.m.

Size	48.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a6a0e9efccb47bff03a3b203736a150d`
SHA256	`13c9625faf1b1d62f0f4e7cb782d4e1ff285777f7b6d9b724b4e16851a25984c`
CRC32	`35DE184F`
ssdeep	`768:qDK/rtW7bqCCCCCCCCCCCCCCCCCCCCCCCLCpDCgCCCCCCCdY4b1ANyTPOsEnayJN:qDStY3b7OMyJVGJkyrt517EwM+9hQf`
PDB Path	C:\Users\Administrator\Desktop\net8.0-windows7.0\Data\src\Ledger-Live\Ledger-Live\obj\Release\Ledger-Live.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

LedgerUpdater.exe "C:\Users\test22\AppData\Local\Temp\LedgerUpdater.exe"
2556

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Oct. 16, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 16, 2024, 11:06 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0
IsDebuggerPresent Oct. 16, 2024, 11:06 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (22 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b0f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b178 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b1b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 16, 2024, 11:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0068b238 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\net8.0-windows7.0\Data\src\Ledger-Live\Ledger-Live\obj\Release\Ledger-Live.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 16, 2024, 11:06 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00435000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00426000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00427000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0216f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:06 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000b800', u'virtual_address': u'0x00002000', u'entropy': 7.230843169394192, u'name': u'.text', u'virtual_size': u'0x0000b638'}

entropy

7.23084316939

description

A section with a high entropy has been found

entropy

0.958333333333

description

Overall entropy of this PE file is high

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
ALYac	IL:Trojan.MSILZilla.116274
Cylance	Unsafe
VIPRE	IL:Trojan.MSILZilla.116274
Sangfor	Trojan.Win32.Agent.V1q7
CrowdStrike	win/malicious_confidence_60% (D)
BitDefender	IL:Trojan.MSILZilla.116274
Arcabit	IL:Trojan.MSILZilla.D1C632
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
Kaspersky	UDS:DangerousObject.Multi.Generic
MicroWorld-eScan	IL:Trojan.MSILZilla.116274
Emsisoft	IL:Trojan.MSILZilla.116274 (B)
McAfeeD	ti!13C9625FAF1B
CTX	exe.trojan.msilzilla
FireEye	IL:Trojan.MSILZilla.116274
Google	Detected
Avira	TR/SelfDel.npwdw
Kingsoft	MSIL.Trojan.SelfDel.gen
Gridinsoft	Trojan.Win32.Agent.dd!n
Microsoft	Trojan:Win32/Sonbokli.A!cl
GData	IL:Trojan.MSILZilla.116274
AhnLab-V3	Trojan/Win.MSILZilla.C5683132
McAfee	Artemis!A6A0E9EFCCB4
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Trojan.IL.MSILZilla
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09JE24
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat
Paloalto	generic.ml

LedgerUpdater.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All