popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

doitallmain.exe

Admin Tool (Sysinternals etc ...) UPX MSOffice File PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 21, 2025, 10:10 a.m. April 21, 2025, 12:13 p.m.
Size 1.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b1bbdf491a3d32319eb33121c086030d
SHA256 8a0d53b3b7956954147162b7ecca4adc1a629bbaa7d83842a033364c571cfa07
CRC32 02AB3631
ssdeep 24576:eQHtzv+IUx9xGv4tS/8qVaYKsViuWaPfB/XZ:9RixGv4tUaYKsVKaPfR
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003e0000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Bulz.4!c
Cynet Malicious (score: 99)
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Bulz.764018
Cylance Unsafe
VIPRE Gen:Variant.Bulz.764018
Sangfor Trojan.Win32.Agent.V3nd
BitDefender Gen:Variant.Bulz.764018
Cybereason malicious.91a3d3
Arcabit Trojan.Bulz.DBA872
Paloalto generic.ml
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Malware-gen
MicroWorld-eScan Gen:Variant.Bulz.764018
Emsisoft Gen:Variant.Bulz.764018 (B)
F-Secure Heuristic.HEUR/AGEN.1337149
DrWeb BACKDOOR.Trojan
McAfeeD ti!8A0D53B3B795
FireEye Gen:Variant.Bulz.764018
Sophos Generic Reputation PUA (PUA)
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1337149
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.Agent
Microsoft Program:Win32/Wacapew.C!ml
GData Gen:Variant.Bulz.764018
Varist W32/ABRisk.OHKR-8520
AhnLab-V3 Trojan/Win.HDC.R597229
McAfee Artemis!B1BBDF491A3D
Malwarebytes Generic.Malware/Suspicious
Yandex Trojan.GenAsa!hK4fJsJltlE
huorong HEUR:TrojanDownloader/VBCode.a
MaxSecure Trojan.Malware.196081869.susgen
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen
Panda Trj/Genetic.gen