popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

4f3200e5324a333579e06ed5aa264ed2.bin.exe

Generic Malware Malicious Library UPX ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 19, 2024, 7:28 p.m. Nov. 19, 2024, 7:29 p.m.
Size 2.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4f3200e5324a333579e06ed5aa264ed2
SHA256 a300c5659a4b2575a7deb8cfb04a978bbf939d473e0842fb6e759f4a77de83ea
CRC32 4573BAF5
ssdeep 49152:KGEs3d2XPdz5v7lVLODcFONjE1CiKHWH2AZPyuPyD:KPs0/vuEKE162HzPyuPyD
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .00cfg
section .TON
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
4f3200e5324a333579e06ed5aa264ed2+0x8cc30 @ 0x10fcc30
4f3200e5324a333579e06ed5aa264ed2+0xa15d4 @ 0x11115d4
4f3200e5324a333579e06ed5aa264ed2+0xc05aa @ 0x11305aa
4f3200e5324a333579e06ed5aa264ed2+0x208b6c @ 0x1278b6c
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 3138592
registers.edi: 4229248
registers.eax: 1
registers.ebp: 3138624
registers.edx: 2130566132
registers.ebx: 96
registers.esi: 3473408
registers.ecx: 2141519872
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01295000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0004b200', u'virtual_address': u'0x0022c000', u'entropy': 7.999439322895262, u'name': u'.TON', u'virtual_size': u'0x0004b200'} entropy 7.9994393229 description A section with a high entropy has been found
section {u'size_of_data': u'0x0004b200', u'virtual_address': u'0x00278000', u'entropy': 7.999439322895262, u'name': u'.TON', u'virtual_size': u'0x0004b200'} entropy 7.9994393229 description A section with a high entropy has been found
entropy 0.213993234823 description Overall entropy of this PE file is high
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2624
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000064
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL|¬4gà äʀˆ@ @…êŒP0B0¸.textûãä `.rdata¡ "è@@.dataè0b @À.CRT@l@@.reloc0BPDn@B
base_address: 0x00400000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer: 0‹@
base_address: 0x00454000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2624
process_handle: 0x00000064
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL|¬4gà äʀˆ@ @…êŒP0B0¸.textûãä `.rdata¡ "è@@.dataè0b @À.CRT@l@@.reloc0BPDn@B
base_address: 0x00400000
process_identifier: 2624
process_handle: 0x00000064
1 1 0
Process injection Process 2548 called NtSetContextThread to modify thread in remote process 2624
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2291872
registers.edi: 0
registers.eax: 4229248
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000060
process_identifier: 2624
1 0 0
Process injection Process 2548 resumed a thread in remote process 2624
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000060
suspend_count: 1
process_identifier: 2624
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2628
thread_handle: 0x00000060
process_identifier: 2624
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\4f3200e5324a333579e06ed5aa264ed2.bin.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\4f3200e5324a333579e06ed5aa264ed2.bin.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000064
1 1 0

NtGetContextThread

 thread_handle: 0x00000060
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2624
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000064
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL|¬4gà äʀˆ@ @…êŒP0B0¸.textûãä `.rdata¡ "è@@.dataè0b @À.CRT@l@@.reloc0BPDn@B
base_address: 0x00400000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00440000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00443000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer: 0‹@
base_address: 0x00454000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00455000
process_identifier: 2624
process_handle: 0x00000064
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2624
process_handle: 0x00000064
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2291872
registers.edi: 0
registers.eax: 4229248
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000060
process_identifier: 2624
1 0 0

NtResumeThread

 thread_handle: 0x00000060
suspend_count: 1
process_identifier: 2624
1 0 0
Bkav W32.AIDetectMalware
MicroWorld-eScan Trojan.GenericKD.74800196
Skyhigh BehavesLike.Win32.Trojan.vh
ALYac Trojan.GenericKD.74800196
Cylance Unsafe
VIPRE Trojan.GenericKD.74800196
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
BitDefender Trojan.GenericKD.74800196
K7GW Trojan ( 005bd2f21 )
K7AntiVirus Trojan ( 005bd2f21 )
Arcabit Trojan.Generic.D4755C44
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HYGY
APEX Malicious
Avast Win32:Evo-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Stelpak.gen
Rising Stealer.Convagent!8.1326D (TFE:5:thkolWElf4R)
Emsisoft Trojan.GenericKD.74800196 (B)
F-Secure Trojan.TR/Crypt.Agent.muynp
DrWeb Trojan.Inject5.11904
McAfeeD Real Protect-LS!4F3200E5324A
CTX exe.trojan.generic
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.4f3200e5324a3335
Google Detected
Avira TR/Crypt.Agent.muynp
Antiy-AVL Trojan/Win32.Stelpak
Kingsoft malware.kb.a.979
Microsoft Trojan:Win32/Vidar.CBB!MTB
GData Win32.Trojan.PSE.1103JM4
Varist W32/Trojan.QCQT-3737
AhnLab-V3 Trojan/Win.Generic.R681772
DeepInstinct MALICIOUS
VBA32 Trojan.Stelpak
Malwarebytes Trojan.Crypt
Panda Trj/GdSda.A
Tencent Malware.Win32.Gencirc.10c06c13
Fortinet W32/Kryptik.HYGY!tr
AVG Win32:Evo-gen [Trj]