popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

GetDataAVK.exe

Chrome User Data Google
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 11, 2021, 1:40 p.m. March 11, 2021, 1:41 p.m.
Size 664.5KB
Type PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 50803bdba827e6ae4600da26b5e81800
SHA256 02dce269070bfec91e4f01a67d774167f8208f17211e8027d8a7fe3dc62a356b
CRC32 0A414D79
ssdeep 12288:yjw3mhs2SwibEO3GplmjwyFFubW87S3/C/OeEzoWJHVazmcDV:yjw3mYwibEO3GplmjwyFFubx7P/cLPah
PDB Path C:\Users\skunk\Desktop\SPCL\PPP\proyecto polinesia francesa\extractor\new\GetDataAVK\2\GetDataAVK\obj\Debug\GetDataAVK.pdb
Yara
  • IsPE32 - (no description)
  • IsNET_EXE - (no description)
  • IsConsole - (no description)
  • IsPacked - Entropy Check
  • HasDebugData - DebugData Check
  • PE_Header_Zero - PE File Signature Zero
  • win_files_operation - Affect private profile

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Starting
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Aftker Sleeped
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: OutlookCreds :
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: OutlookCreds Done
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: GetPassFromDB func error: DLL 'sqlite3'?(?) ??? ? ????. ??? ??? ?? ? ????. (??? ??? HRESULT: 0x8007007E)
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: scanningFolder: C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: ChromePass :
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Chrome passes Done
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reading: C:\
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reading: D:\
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Emails list done
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: exiting
console_handle: 0x00000007
1 1 0
pdb_path C:\Users\skunk\Desktop\SPCL\PPP\proyecto polinesia francesa\extractor\new\GetDataAVK\2\GetDataAVK\obj\Debug\GetDataAVK.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00800000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72831000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72832000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0030b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00307000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00305000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00531000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00532000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
file C:\Users\test22\AppData\Local\Temp\Costura\1ACF592E7018DA88DDC32B96D203A4BE\32\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\Costura\1ACF592E7018DA88DDC32B96D203A4BE\32\sqlite3.dll
section {u'size_of_data': u'0x000a5800', u'virtual_address': u'0x00002000', u'entropy': 7.116990823582788, u'name': u'.text', u'virtual_size': u'0x000a56d4'} entropy 7.11699082358 description A section with a high entropy has been found
entropy 0.996987951807 description Overall entropy of this PE file is high
url http://www.microsoft.com/pki/certs/CSPCA.crt0
url https://www.verisign.com/cps0
url http://www.apple.com/
url http://microsoft.com0
url http://ocsp.verisign.com0
url https://www.verisign.com/rpa
url http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
url http://crl.verisign.com/pca3-g5.crl04
url https://www.verisign.com/rpa0
url http://logo.verisign.com/vslogo.gif04
url http://www.microsoft.com/pki/certs/tspca.crt0
url http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
url http://crl.verisign.com/tss-ca.crl0
url http://crl.verisign.com/ThawteTimestampingCA.crl0
description Code injection with CreateRemoteThread in a remote process rule inject_thread
description Create a windows service rule create_service
description Create a COM server rule create_com_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications smtp rule network_smtp_dotNet
description Communications over P2P network rule network_p2p_win
description Communications over HTTP rule network_http
description File downloader/dropper rule network_dropper
description Communications over FTP rule network_ftp
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
description Communication using dga rule network_dga
description Escalade priviledges rule escalate_priv
description Take screenshot rule screenshot
description Run a keylogger rule keylogger
description Steal credential rule cred_local
description Record Audio rule sniff_audio
description APC queue tasks migration rule migrate_apc
description Malware can spread east-west file rule spreading_file
description Malware can spread east-west using share drive rule spreading_share
description Create or check mutex rule win_mutex
description Affect system registries rule win_registry
description Affect system token rule win_token
description Affect private profile rule win_private_profile
description Affect private profile rule win_files_operation
description Match Winsock 2 API library declaration rule Str_Win32_Winsock2_Library
description Match Windows Inet API library declaration rule Str_Win32_Wininet_Library
description Match Windows Inet API call rule Str_Win32_Internet_API
description Match Windows Http API call rule Str_Win32_Http_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description browser info stealer rule infoStealer_browser_Zero
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.24891
MicroWorld-eScan Gen:Variant.MSILPerseus.146168
FireEye Generic.mg.50803bdba827e6ae
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
McAfee RDN/GenericM
Cylance Unsafe
SUPERAntiSpyware Trojan.Agent/Gen-Agent.MSIL
Sangfor Virus_Suspicious.Win32.Sality.ae
K7AntiVirus Trojan ( 0057101b1 )
Alibaba Trojan:MSIL/Ftker.8afe5612
K7GW Trojan ( 0057101b1 )
Cybereason malicious.ba827e
Arcabit Trojan.MSILPerseus.D23AF8
Cyren W32/MSIL_Perseus.G.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/PSW.Agent.QWE
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.MSIL.Ftker.gen
BitDefender Gen:Variant.MSILPerseus.146168
Paloalto generic.ml
Tencent Msil.Trojan.Ftker.Sttw
Ad-Aware Gen:Variant.MSILPerseus.146168
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1139866
McAfee-GW-Edition Artemis!Trojan
Emsisoft Gen:Variant.MSILPerseus.146168 (B)
Avira HEUR/AGEN.1139866
MAX malware (ai score=100)
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Backdoor:Win32/Bladabindi!ml
ZoneAlarm HEUR:Trojan.MSIL.Ftker.gen
GData Gen:Variant.MSILPerseus.146168
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Inject.R292885
ALYac Gen:Variant.MSILPerseus.146168
Malwarebytes Spyware.PasswordStealer
TrendMicro-HouseCall TROJ_GEN.R002H0CCA21
Rising Stealer.Agent!8.C2 (CLOUD)
Ikarus Trojan.Win32.Spy
Fortinet W32/Ftker.QWE!tr
Webroot W32.Trojan.Gen
AVG Win32:Trojan-gen
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Trojan.Generic.HgIASQgA