popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Practical2.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x3201 March 9, 2021, 11:04 a.m. March 9, 2021, 11:06 a.m.
Size 1.4MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 971a3320179e0494fdb70b138ada2446
SHA256 9633d0564a2b8f1b4c6e718ae7ab48be921d435236a403cf5e7ddfbfd4283382
CRC32 35C24685
ssdeep 12288:hkhSL4pH7FYiIiicuueTh9yeJWrpDz29Wa+QB1t6gMvlTpa6NYjHhtkaJN:h72Z/8VWrpn2ZF1Ea1jBH
PDB Path C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\General\AtlCon\bitcoin coinjoin op.pdb
Yara
  • IsPE32 - (no description)
  • IsConsole - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
195.140.214.82 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\General\AtlCon\bitcoin coinjoin op.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x2063626
0x207145b
0x207366b
0x2065d61
BaseThreadInitThunk+0x12 SetUnhandledExceptionFilter-0xbc kernel32+0x53c45 @ 0x762e3c45
RtlInitializeExceptionChain+0xef RtlFreeSid-0x117 ntdll+0x637f5 @ 0x77af37f5
RtlInitializeExceptionChain+0xc2 RtlFreeSid-0x144 ntdll+0x637c8 @ 0x77af37c8

exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7
exception.symbol: lstrcpyW+0x16 lstrcmp-0x49 kernel32+0x38c10
exception.instruction: movzx eax, word ptr [ecx]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 232464
exception.address: 0x762c8c10
registers.esp: 38924640
registers.edi: 38924780
registers.eax: 38924664
registers.ebp: 38924680
registers.edx: 59965440
registers.ebx: 38924920
registers.esi: 38924936
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 4088
region_size: 12582912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01460000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 4088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7621e000
process_handle: 0xffffffff
1 0 0
description Practical2.exe tried to sleep 125 seconds, actually delayed analysis time by 125 seconds
url http://www.expedia.com/favicon.ico
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16jwTh.img?h=75
url http://uk.ask.com/favicon.ico
url http://www.priceminister.com/
url http://ib.adnxs.com/async_usersync_file
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16jyJT.img?h=194
url http://175.208.134.150:8282/test/test.eml
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16jXod.img?h=75
url http://ru.wikipedia.org/
url https://www.google.com/chrome/static/js/installer.min.js
url http://www.merlin.com.pl/favicon.ico
url https://www.adobe.com/etc.clientlibs/beagle/fe/adobe-head.min.fp-49c976728c560175ef3915d2bbcaa219.js
url http://www.cnet.com/favicon.ico
url https://www.winzip.com/static/css/footer.css
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16jVxR.img?h=75
url https://www.adobe.com/etc.clientlibs/globalnav/clientlibs/base/feds.js
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB15WEhx.img?h=75
url http://search.nifty.com/
url http://ns.adobe.com/exif/1.0/
url https://www.winzip.com/static/css/leap-over-promo.css
url http://www.etmall.com.tw/
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16jn2i.img?h=75
url http://search.goo.ne.jp/
url http://fr.wikipedia.org/favicon.ico
url http://busca.estadao.com.br/favicon.ico
url http://search.hanafos.com/favicon.ico
url http://search.chol.com/favicon.ico
url http://purl.org/rss/1.0/
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16etuG.img?h=75
url https://www.adobe.com/etc.clientlibs/beagle/fe/liveperson.min.fp-0232b34deadc0421a8b6a57415f16562.css
url http://amazon.fr/
url http://www.amazon.co.jp/
url http://www.mtv.com/favicon.ico
url http://busqueda.aol.com.mx/
url http://search.live.com/results.aspx?FORM=SOLTDF
url http://msdn.microsoft.com/
url http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)
url http://purl.org/rss/1.0/modules/syndication/
url http://www.sify.com/favicon.ico
url http://www.microsoft.com/money
url http://ocsp.secti
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAbCGCU.img?h=16
url http://suche.freenet.de/
url http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16juv5.img?h=194
url https://www.gstatic.com/m/images/sy_stars_9.gif
url http://search.aol.com/
url http://browse.guardian.co.uk/
url http://www.mercadolibre.com.mx/
url http://www.asharqalawsat.com/
url http://www.facebook.com/
description Listen for incoming communication rule network_tcp_listen
description Communications over HTTP rule network_http
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Malware can spread east-west file rule spreading_file
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_files_operation
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerException__SetConsoleCtrl
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description email clients info stealer rule infoStealer_emailClients_Zero
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Hijack network configuration rule hijack_network
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Perform crypto currency mining rule bitcoin
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
host 195.140.214.82
url http://175.208.134.150:8282/test/test.eml
url http://175.208.134.150:8282/favicon.ico
url http://175.208.134.150:8282/test/doc1.zip
file C:\Users\Administrator\AppData\Local\Temp\:Zone.Identifier
dead_host 195.140.214.82:6703
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader36.27489
MicroWorld-eScan Gen:Variant.Razy.804171
ALYac Gen:Variant.Razy.804171
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.AveMaria.AM
K7AntiVirus Trojan ( 005747701 )
BitDefender Gen:Variant.Razy.804171
K7GW Trojan ( 005747701 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Razy.DC454B
Cyren W32/Kryptik.BKJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HIDW
APEX Malicious
Kaspersky Trojan-Spy.Win32.AveMaria.dqa
Alibaba TrojanSpy:Win32/AveMaria.86389254
NANO-Antivirus Trojan.Win32.AveMaria.idremq
Tencent Malware.Win32.Gencirc.10ce2ecb
Ad-Aware Gen:Variant.Razy.804171
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.MortyStealer.njjtp
Zillya Trojan.Kryptik.Win32.2738973
McAfee-GW-Edition Artemis!Trojan
FireEye Gen:Variant.Razy.804171
Emsisoft Trojan.Crypt (A)
Jiangmin TrojanSpy.AveMaria.ml
Avira TR/AD.MortyStealer.njjtp
MAX malware (ai score=88)
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.oa!s1
ZoneAlarm Trojan-Spy.Win32.AveMaria.dqa
GData Gen:Variant.Razy.804171
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Win32.RL_Generic.R357891
McAfee GenericRXAA-AA!971A3320179E
TACHYON Trojan-Spy/W32.AveMaria.1446912
VBA32 BScope.TrojanSpy.AveMaria
Malwarebytes Backdoor.AveMaria
Panda Trj/GdSda.A
Zoner Trojan.Win32.99616
TrendMicro-HouseCall TROJ_GEN.R002C0DBO21
Rising Spyware.AveMaria!8.108C2 (CLOUD)
Yandex TrojanSpy.AveMaria!Vjki3TH2T+g
Ikarus Trojan.Win32.Crypt
Fortinet W32/Kryptik.HIDW!tr
AVG Win32:RATX-gen [Trj]
Cybereason malicious.0179e0