Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.05 04:11
VST32License.exe
11.05 03:11
VST32License.exe
11.03 01:11
DocTromTinNhan.exe
11.01 06:11
MPDW-constraints.vbs
11.01 06:11
87f3f2.exe
11.01 06:11
Client-built.exe
11.01 06:11
norm.exe
11.01 06:11
chrome_131.exe
11.01 06:11
kjrhjijawdkrjhh.exe
11.01 09:11
Calibre_Installer.exe

Latest News
11.05 01:11
메가존클라우드-파이오링크, 클라우드 보안...
11.05 01:11
프로페셔널 헤어케어 브랜드 레삐, ‘20...
11.05 01:11
Chinese Group Accused ...
11.05 01:11
25년 정보보호 전자공시시스템 고도화 및...
11.05 01:11
KISA, 민원 응대 보호시스템 전사 확대
11.05 01:11
아늑샵, 2024년 4분기 '한국소비자인...
11.05 01:11
크라운슬립, 프리미엄 구스 이불 론칭 기...
11.05 01:11
Google Warns of Active...
11.05 12:11
안랩, 2024년 3분기 매출 685억,...
11.05 12:11
Southeast Asia’s Digit...

Summary | ZeroBOX

smtp.pdf.exe

Gen1 Generic Malware Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 20, 2024, 9:19 a.m.	Oct. 20, 2024, 9:27 a.m.

Size	784.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bc20ccdfe58debf965054d868fa95085`
SHA256	`cabfe8b3b3a31c703388d30e54de9488fe1b168e38162c9333f6fc009bc61cb5`
CRC32	`93B38FEC`
ssdeep	`24576:pxGEWJ4qGgrSgQxQGYTRDSDEhI8Wq+rgEJeEIYRd:iPJ48rSgQx8tOi31+rgAGYRd`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

smtp.pdf.exe "C:\Users\test22\AppData\Local\Temp\smtp.pdf.exe"
2536
- smtp.pdf.tmp "C:\Users\test22\AppData\Local\Temp\is-4DGK7.tmp\smtp.pdf.tmp" /SL5="$6011A,354490,141312,C:\Users\test22\AppData\Local\Temp\smtp.pdf.exe"
  2612
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 20, 2024, 9:19 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 20, 2024, 9:19 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 20, 2024, 9:19 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Oct. 20, 2024, 9:14 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Oct. 20, 2024, 9:20 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 8474367351460986880 root_path: C:\Program Files\SmtpInfo\SMTP Mailer\ total_number_of_bytes: 0		0	0
GetDiskFreeSpaceExW Oct. 20, 2024, 9:20 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 8474367351460986880 root_path: C:\Program Files\SmtpInfo\ total_number_of_bytes: 0		0	0
GetDiskFreeSpaceExW Oct. 20, 2024, 9:20 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13321605120 root_path: C:\Program Files\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-62CP5.tmp\_isetup\_shfoldr.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\is-4DGK7.tmp\smtp.pdf.tmp
file	C:\Users\test22\AppData\Local\Temp\is-62CP5.tmp\_isetup\_shfoldr.dll

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

CrowdStrike	win/grayware_confidence_70% (D)
APEX	Malicious

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Oct. 20, 2024, 9:19 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SMTP Mailer_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\SMTP Mailer_is1		2	0
RegOpenKeyExW Oct. 20, 2024, 9:19 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SMTP Mailer_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000101 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SMTP Mailer_is1		2	0