Report - ZeroBOX

ScreenShot

Info
Location map


Created	2021.03.08 15:15	Machine	s1_win7_x6401
Filename	fre.php
Type	PHP script, ASCII text, with CRLF line terminators
AI Score	Not founds	Behavior Score	4.2
ZERO API	file : clean
VT API (file)	1 detected (PHP.BackDoor.75)
md5	ea9f466d28c594dc4741469805fd440c
sha256	dfbcbf7be88c7c934d6e905b90e1fdc4aad14e19921f15743a185b1a1ff1823a
ssdeep	24:0/9MAcwAWwALQjtTmfAKE7Igh8nbV8AS18HL:0/9MAJATA0jtTmfzE7IgSnx8NWHL
imphash
impfuzzy

Network IP location

Signature (10cnts)

Level	Description
watch	Communicates with host for which no DNS query was performed
watch	Resumed a suspended thread in a remote process potentially indicative of process injection
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	An application raised an exception which may be indicative of an exploit crash
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Performs some HTTP requests
notice	Potentially malicious URLs were found in the process memory dump
notice	Uses Windows utilities for basic Windows functionality
notice	Yara rule detected in process memory
info	One or more processes crashed

Rules (47cnts)

Level	Name	Description	Collection
watch	PWS_CnC_memory_Zero	Communications PWS network	memory
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	Check_Dlls	(no description)	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerCheck__RemoteAPI	(no description)	memory
info	DebuggerException__ConsoleCtrl	(no description)	memory
info	DebuggerException__SetConsoleCtrl	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	create_service	Create a windows service	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	hijack_network	Hijack network configuration	memory
info	inject_thread	Code injection with CreateRemoteThread in a remote process	memory
info	keylogger	Run a keylogger	memory
info	Microsoft_Office_Document_Zero	Microsoft Office Document Signature Zero	binaries (download)
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_dropper	File downloader/dropper	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_p2p_win	Communications over P2P network	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	network_toredo	Communications over Toredo network	memory
info	network_udp_sock	Communications over UDP network	memory
info	screenshot	Take screenshot	memory
info	sniff_audio	Record Audio	memory
info	spreading_file	Malware can spread east-west file	memory
info	spreading_share	Malware can spread east-west using share drive	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Network (0cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?

Report - fre.php

Signature (10cnts)

Rules (47cnts)

Network (0cnts) ?

Suricata ids

Similarity measure (PE file only) - Checking for service failure