Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 17, 2025, 5:13 p.m.	Jan. 17, 2025, 5:15 p.m.

Size	73.5KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9d347d5ac998a89f78ba00e74b951f55`
SHA256	`2ea5686422bd8fb6eda542e9a96588f9deb1c97c45f3cb7d3b21ac4da540b57c`
CRC32	`9134A586`
ssdeep	`384:ytBuEejMVr2gy0mK1SvySYS4SRmbESgSNSsiKjHxqD4fpBSIxoI2AAgz:y+EjXQL6SYS4SRmbESgSNSsiQJxBSQH`
PDB Path	C:\Users\d4ps\source\repos\PdfFile\obj\Release\Pdf Reader.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Pdf%20Reader.exe "C:\Users\test22\AppData\Local\Temp\Pdf%20Reader.exe"
1460

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 17, 2025, 5:13 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Jan. 17, 2025, 5:13 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 17, 2025, 5:13 p.m.			0	0
IsDebuggerPresent Jan. 17, 2025, 5:13 p.m.			0	0
IsDebuggerPresent Jan. 17, 2025, 5:13 p.m.			0	0
IsDebuggerPresent Jan. 17, 2025, 5:13 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA Jan. 17, 2025, 5:13 p.m.	buffer: Unhandled Exception: console_handle: 0x0000000b	1	1	0
WriteConsoleA Jan. 17, 2025, 5:13 p.m.	buffer: System.IO.FileNotFoundException: Could not load file or assembly 'System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified. at PdfFile.Program.<Main>d__0.MoveNext() at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[TStateMachine](TStateMachine& stateMachine) at PdfFile.Program.Main() at PdfFile.Program.<Main>() console_handle: 0x0000000b	1	1	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\d4ps\source\repos\PdfFile\obj\Release\Pdf Reader.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 17, 2025, 5:13 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00472000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 17, 2025, 5:13 p.m.	process_identifier: 1460 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Lazy.4!c
CAT-QuickHeal	Trojan.Ghanarava.1737097591951f55
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Lazy.629628
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.629628
Sangfor	Downloader.Win32.Agent.V5dt
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Gen:Variant.Lazy.629628
K7GW	Trojan-Downloader ( 005be3921 )
K7AntiVirus	Trojan-Downloader ( 005be3921 )
Arcabit	Trojan.Lazy.D99B7C
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.RNI
Avast	Win32:DropperX-gen [Drp]
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
Alibaba	Trojan:MSIL/DropperX.8a1e1425
MicroWorld-eScan	Gen:Variant.Lazy.629628
Rising	Downloader.Agent!8.B23 (CLOUD)
Emsisoft	Gen:Variant.Lazy.629628 (B)
F-Secure	Trojan.TR/Dldr.Agent.sbiao
Zillya	Downloader.Agent.Win32.582361
McAfeeD	ti!2EA5686422BD
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Lazy.629628
Google	Detected
Avira	TR/Dldr.Agent.sbiao
Kingsoft	MSIL.Trojan.Agent.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win.Z.Agent.75264.QP
GData	Gen:Variant.Lazy.629628
Varist	W32/ABTrojan.GVAN-2061
AhnLab-V3	Trojan/Win.Generic.R684863
McAfee	Artemis!9D347D5AC998
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.1031032275
Ikarus	Trojan-Downloader.MSIL.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R023H09LE24
Tencent	Malware.Win32.Gencirc.14247c45
MaxSecure	Trojan.Malware.315562381.susgen
Fortinet	MSIL/Agent.RNI!tr.dldr
AVG	Win32:DropperX-gen [Drp]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:MSIL/Lazy.Gen

Pdf%20Reader.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All