popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1243.exe

Generic Malware .NET framework(MSIL) Malicious Library UPX AntiDebug PE File OS Processor Check PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 19, 2025, 11:21 a.m. Feb. 19, 2025, 12:01 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0a736eeb2a65ab14079363292764e5f2
SHA256 6823eb6442c4c905c76af5c2963c59e68b123e8fa6a43597d5efa2fadf24411f
CRC32 DE1C174A
ssdeep 49152:IBJ7U1Fda2hANIZqPhkMx/YS45eFuqCjwTi:yVU18I6kMxQKLCjz
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72382000
process_handle: 0xffffffff
1 0 0
file C:\providernet\sicHapKyGYP2TAHBW5h5Pr.vbe
file C:\providernet\Fontcrt.exe
file C:\providernet\qQKuNRKPWtLo4QlMy6.bat
file C:\providernet\sicHapKyGYP2TAHBW5h5Pr.vbe
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 700 resumed a thread in remote process 1352
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000268
suspend_count: 1
process_identifier: 1352
1 0 0