popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wwbizsrvs.exe

Generic Malware Malicious Library UPX ftp PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 15, 2024, 1:42 p.m. Nov. 15, 2024, 1:51 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2912cd42249241d0e1ef69bfe6513f49
SHA256 968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0
CRC32 929138C5
ssdeep 49152:ZE1zpZW1D7w0brP6+pCixXvq1p/42mi080tULLd0:m1zaZJHP62C2OrQ
PDB Path E:\Dev\alibaba-inc\IMClient\wwbizsrv\symbol\Release\wwbizsrv.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • ftp_command - ftp command
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
pdb_path E:\Dev\alibaba-inc\IMClient\wwbizsrv\symbol\Release\wwbizsrv.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name SECRET
name SECRET language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210fa8 size 0x000004a8
name SECRET language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210fa8 size 0x000004a8
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210430 size 0x00000468
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00211450 size 0x0000007e
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00211450 size 0x0000007e
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00210898 size 0x00000092
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x001e93d0 size 0x00000304
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000016c
process_name: pw.exe
process_identifier: 1688
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: SearchProtocolHost.exe
process_identifier: 1476
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: SearchFilterHost.exe
process_identifier: 808
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: wwbizsrvs.exe
process_identifier: 1880
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: svchost.exe
process_identifier: 2280
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: mscorsvw.exe
process_identifier: 2304
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: mscorsvw.exe
process_identifier: 2352
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: sppsvc.exe
process_identifier: 2404
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: cmd.exe
process_identifier: 2472
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: conhost.exe
process_identifier: 2480
1 1 0

Process32NextW

 snapshot_handle: 0x0000016c
process_name: pw.exe
process_identifier: 2504
1 1 0
ALYac Gen:Variant.Zusy.565988
Cylance Unsafe
VIPRE Gen:Variant.Zusy.565988
CrowdStrike win/grayware_confidence_70% (D)
BitDefender Gen:Variant.Zusy.565988
Arcabit Trojan.Zusy.D8A2E4
Avast Win32:Malware-gen
Kaspersky VHO:Trojan.Win32.Shelm.gen
MicroWorld-eScan Gen:Variant.Zusy.565988
Emsisoft Gen:Variant.Zusy.565988 (B)
CTX exe.unknown.zusy
FireEye Gen:Variant.Zusy.565988
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Zusy.565988
AVG Win32:Malware-gen
process: potential process injection target explorer.exe