popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32 CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 27, 2025, 4:43 p.m. Jan. 27, 2025, 5:02 p.m.
Size 866.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e7c964e5bd52da0b4ff1e6543608cf27
SHA256 33cab7cd9069c761a907a2498c2d496da5e9332412b13472710e774ca80c4b48
CRC32 0A9A4B2E
ssdeep 12288:gCxr3SAoHl8uj7c8BNV0CW9TBBMtVIN+9exmPh0LguCifyV03qGs7ifbVpBgYeSa:gcrCAY8uj7nGPFLWVIN+9e5iUDTq/Shk
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Entity=F
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: xRPxSoutheast-Gazette-Norman-Similar-Placed-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'xRPxSoutheast-Gazette-Norman-Similar-Placed-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: nqPartially-Approved-Prize-Teenage-Arlington-Tony-Ecuador-Demonstration-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'nqPartially-Approved-Prize-Teenage-Arlington-Tony-Ecuador-Demonstration-' is not recognized as an internal or external command, operable program or batch file
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: MFMil-Began-Moving-Entire-Builder-Solution-Lender-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'MFMil-Began-Moving-Entire-Builder-Solution-Lender-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: qscRHindu-Feels-Meditation-Diagram-Xl-Almost-Measurements-Travis-Fastest-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'qscRHindu-Feels-Meditation-Diagram-Xl-Almost-Measurements-Travis-Fastest-' is not recognized as an internal or external command, operable program or batch fil
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: e.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: iZIgnored-Communication-Nike-Christ-Revelation-Asset-Scale-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'iZIgnored-Communication-Nike-Christ-Revelation-Asset-Scale-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Applicant=5
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: RDcMagnetic-Fell-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'RDcMagnetic-Fell-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: uUiiEncourage-Solutions-Powell-Romania-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'uUiiEncourage-Solutions-Powell-Romania-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: zTsModification-Holdem-Gcc-Worldcat-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'zTsModification-Holdem-Gcc-Worldcat-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: ZDAssociate-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'ZDAssociate-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: JOGLaunch-Jerusalem-Ons-Blowjobs-Cdt-Horny-Was-Missile-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'JOGLaunch-Jerusalem-Ons-Blowjobs-Cdt-Horny-Was-Missile-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: JsThought-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'JsThought-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Lasting=I
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: hgIrs-Array-Rent-Spring-Page-Coral-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'hgIrs-Array-Rent-Spring-Page-Coral-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: JUuTh-Others-Heated-Adjustments-Pools-Levels-Prayers-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 'JUuTh-Others-Heated-Adjustments-Pools-Levels-Prayers-' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
file C:\Users\test22\AppData\Local\Temp\634977\Surrey.com
cmdline "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd
file C:\Users\test22\AppData\Local\Temp\634977\Surrey.com
file C:\Users\test22\AppData\Local\Temp\634977\Surrey.com
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /c copy Universities Universities.cmd & Universities.cmd
filepath: cmd
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000012c
process_name: pw.exe
process_identifier: 524
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: taskhost.exe
process_identifier: 1944
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: SearchProtocolHost.exe
process_identifier: 1200
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: conhost.exe
process_identifier: 1212
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: 1.exe
process_identifier: 872
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: pw.exe
process_identifier: 1188
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: Surrey.com
process_identifier: 2716
1 1 0

Process32NextW

 snapshot_handle: 0x0000012c
process_name: inject-x86.exe
process_identifier: 2768
1 1 0
section {u'size_of_data': u'0x0000be00', u'virtual_address': u'0x000f4000', u'entropy': 7.208891662649734, u'name': u'.rsrc', u'virtual_size': u'0x0000bcfe'} entropy 7.20889166265 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x00100000', u'entropy': 7.933129462779457, u'name': u'.reloc', u'virtual_size': u'0x00000f32'} entropy 7.93312946278 description A section with a high entropy has been found
entropy 0.569060773481 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline tasklist
Process injection Process 2088 resumed a thread in remote process 2716
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000084
suspend_count: 0
process_identifier: 2716
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Runner.m!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Ghanarava.173788898408cf27
Skyhigh Artemis!Trojan
ALYac Trojan.Generic.37258956
Cylance Unsafe
VIPRE Trojan.Generic.37258956
Sangfor Trojan.Win32.Agent.Awz3
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.Generic.37258956
K7GW Trojan ( 005bf3e91 )
K7AntiVirus Trojan ( 005bf3e91 )
Arcabit Trojan.Generic.D23886CC
VirIT Trojan.Win32.NSISGenT.ABRY
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.NSIS.CG
Avast Win32:Malware-gen
Kaspersky Trojan.Script.Agentb.cs
Alibaba Packed:Win32/Runner.9ed0c569
MicroWorld-eScan Trojan.Generic.37258956
Emsisoft Trojan.Generic.37258956 (B)
F-Secure Backdoor.BDS/Agent.tfsdc
McAfeeD ti!33CAB7CD9069
Trapmine suspicious.low.ml.score
CTX exe.trojan.runner
Sophos Mal/Generic-S
FireEye Trojan.Generic.37258956
Google Detected
Avira BDS/Agent.tfsdc
Antiy-AVL Trojan/NSIS.Runner.ew
Kingsoft Win32.Hack.Agent.gen
Microsoft Trojan:Win32/Znyonm
GData Win32.Trojan.Agent.NY4X7A
Varist W32/ABTrojan.OARA-4691
AhnLab-V3 Trojan/Win.Agent.C5721021
McAfee Artemis!E7C964E5BD52
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.4288530468
Ikarus Trojan.NSIS.Runner
TrendMicro-HouseCall TROJ_GEN.R053H01AP25
Tencent Win32.Trojan.FalseSign.Bdhl
huorong HEUR:Trojan/Runner.bv
Fortinet W32/Runner.FS!tr
AVG Win32:Malware-gen
Paloalto generic.ml
alibabacloud Backdoor:Win/Runner.FB