popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

setup.exe

Generic Malware Malicious Library Antivirus UPX Malicious Packer OS Processor Check PE32 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 31, 2025, 12:06 p.m. March 31, 2025, 12:17 p.m.
Size 3.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 668a2b6bc52f43d1367d97899a7e74c1
SHA256 82f4d2a4ac8b5782a6ad408564c8739dc742ae73368f07eb532d9364dc213394
CRC32 AC11FEAE
ssdeep 98304:L0Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/tV:L0Fxb8yuO+JLA3DUue
PDB Path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • Antivirus - Contains references to security software
  • CAB_file_format - CAB archive file
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev
A 162.159.140.237
A 172.66.0.235
172.66.0.235
x1.i.lencr.org
CNAME crl.root-x1.letsencrypt.org.edgekey.net
CNAME e8652.dscx.akamaiedge.net
A 23.41.113.98
23.52.33.11
IP Address Status Action
162.159.140.237 Active Moloch
164.124.101.2 Active Moloch
23.41.113.98 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49163 -> 162.159.140.237:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
162.159.140.237:443 		C=US, O=Let's Encrypt, CN=R11 CN=*.r2.dev aa:79:da:cd:20:a6:72:e4:79:6f:4a:2a:74:7a:e5:95:5e:1c:21:4e

pdb_path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .didat
section .fptable
request GET http://x1.i.lencr.org/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000398
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Lionic Trojan.Win32.Generic.4!c
CAT-QuickHeal Trojan.Ghanarava.17433709687e74c1
Skyhigh BehavesLike.Win32.Dropper.wh
ALYac Trojan.GenericKD.76088740
Cylance Unsafe
VIPRE Trojan.GenericKD.76088740
BitDefender Trojan.GenericKD.76088740
Arcabit Trojan.Generic.D48905A4
Symantec ML.Attribute.HighConfidence
Avast FileRepMalware [Misc]
Kaspersky UDS:DangerousObject.Multi.Generic
MicroWorld-eScan Trojan.GenericKD.76088740
Emsisoft Trojan.GenericKD.76088740 (B)
DrWeb Trojan.Lyrics.2419
McAfeeD ti!82F4D2A4AC8B
CTX exe.trojan.multi
FireEye Trojan.GenericKD.76088740
Webroot Win.Trojan.Gen
Google Detected
Antiy-AVL Trojan/Multi.Agent
Microsoft Program:Win32/Wacapew.C!ml
GData Trojan.GenericKD.76088740
Varist W32/ABTrojan.RQWI-6648
AhnLab-V3 Malware/Win.Generic.C5743772
McAfee Artemis!668A2B6BC52F
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H09CM25
MaxSecure Trojan.Malware.7164915.susgen
Fortinet W32/PossibleThreat
AVG FileRepMalware [Misc]
alibabacloud Software:Multi/Generic.Gen