popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Synaptics.exe

Malicious Library UPX MZP Format PE File DLL PE32 JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 2, 2025, 2:45 a.m. May 2, 2025, 2:47 a.m.
Size 753.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 de7945db57ff9c218797e548c11b012b
SHA256 9a3afd3e6d8f6de62f47ab28505af4c8b47d9317127851f7450fc79237997fc3
CRC32 5CBBFAD7
ssdeep 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ijr:ansJ39LyjbJkQFMhmC+6GD9U
Yara
  • PE_Header_Zero - PE File Signature
  • mzp_file_format - MZP(Delphi) file format
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
www.dropbox.com
CNAME www-env.dropbox-dns.com
A 162.125.84.18
162.125.84.18
drive.usercontent.google.com
A 142.250.198.193
142.250.206.193
docs.google.com
A 142.250.71.206
172.217.161.238
xred.mooo.com
freedns.afraid.org
A 69.42.215.252
69.42.215.252
IP Address Status Action
142.250.198.193 Active Moloch
142.250.71.206 Active Moloch
162.125.84.18 Active Moloch
164.124.101.2 Active Moloch
69.42.215.252 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 142.250.71.206:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49170 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49169 -> 142.250.198.193:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49168
142.250.71.206:443 		C=US, O=Google Trust Services, CN=WE2 CN=*.google.com 67:52:2f:ab:93:de:39:da:94:50:11:ae:8b:37:cb:88:8f:dc:56:7d
TLSv1
192.168.56.101:49169
142.250.198.193:443 		C=US, O=Google Trust Services, CN=WE2 CN=*.usercontent.google.com e2:75:33:38:ea:c5:6b:07:01:99:0c:e5:64:b0:63:79:cc:b5:d4:83

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x959fc @ 0x4959fc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60161500
registers.edi: 60161688
registers.eax: 60161500
registers.ebp: 60161580
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95a83 @ 0x495a83
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60159312
registers.edi: 60159500
registers.eax: 60159312
registers.ebp: 60159392
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11004
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95b0a @ 0x495b0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 60157124
registers.edi: 60157312
registers.eax: 60157124
registers.ebp: 60157204
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0
domain xred.mooo.com
request GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
request GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x735f2000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39b8 size 0x000010a8
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39b8 size 0x000010a8
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000bd178 size 0x000047d3
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x000c19d8 size 0x00000014
name RT_VERSION language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x000c19ec size 0x00000304
domain docs.google.com
file C:\ProgramData\Synaptics\Synaptics.dll
domain www.dropbox.com
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver reg_value C:\ProgramData\Synaptics\Synaptics.exe
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x039a3540
hook_identifier: 2 (WH_KEYBOARD)
module_address: 0x039a0000
1 459143 0
process Synaptics.exe useragent MyApp
process Synaptics.exe useragent Synaptics.exe
Bkav W32.Common.A575260F
Lionic Trojan.Win32.DarkKomet.tp6k
Cynet Malicious (score: 100)
CAT-QuickHeal Sus.Nocivo.E0011
Skyhigh BehavesLike.Win32.Synaptics.bh
ALYac Win32.Comet.A
Cylance Unsafe
VIPRE Win32.Comet.A
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Win32.Comet.A
K7GW Trojan ( 000112511 )
K7AntiVirus Trojan ( 000112511 )
Arcabit HEUR.VBA.Trojan.d
Symantec W32.Zorex
Elastic malicious (high confidence)
ESET-NOD32 Win32/Delf.NBX
APEX Malicious
Avast Win32:Zorex-E [Wrm]
ClamAV Win.Trojan.Emotet-9850453-0
Kaspersky Trojan.Win32.XRed.mg
Alibaba Backdoor:Win32/DarkKomet.353
NANO-Antivirus Trojan.Win32.DarkKomet.fazbwq
SUPERAntiSpyware Adware.FileTour/Variant
MicroWorld-eScan Win32.Comet.A
Rising Virus.Synaptics!1.E51C (CLASSIC)
Emsisoft Win32.Comet.A (B)
F-Secure Trojan:W97M/MaliciousMacro.GEN
DrWeb Win32.HLLW.Siggen.10555
Zillya Trojan.Delf.Win32.76144
TrendMicro Virus.Win32.NAPWHICH.D.orig
McAfeeD ti!9A3AFD3E6D8F
CTX exe.trojan.generic
Sophos Troj/DocDl-JJH
SentinelOne Static AI - Malicious PE
Jiangmin Win32/Synaptics.Gen
Webroot W32.Malware.gen
Google Detected
Avira WORM/Delphi.Gen
Antiy-AVL Virus/Win32.DarkKomet.a
Gridinsoft Trojan.Win32.Downloader.mz!n
Xcitium Virus.Win32.Agent.DE@74b38h
Microsoft Worm:Win32/AutoRun.XXY!bit
ViRobot Win32.Zorex.A
ZoneAlarm Troj/DocDl-JJH
GData Win32.Backdoor.Agent.AXS
Varist W32/Trojan.YMOP-5085
AhnLab-V3 Win32/Zorex.X1800
Acronis suspicious
McAfee GenericRXBW-CE!DE7945DB57FF