popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C072.exe

Malicious Library UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:01 p.m. Aug. 19, 2024, 2:04 p.m.
Size 2.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0a236bdebd71e66a6145b5438ccd7833
SHA256 e952266312e5e9f5051e918f76a9fc677f8e16eec4c6cf73f9227b80c1750817
CRC32 535B8714
ssdeep 24576:tLbe/vHy/GfM9UNvKO75sWUYPM1XRfo2/3AXK2nbsjeonR6xtt5137XfLlFPivd7:tXtAMedXUYPSRfoKQX3Sop3TcubPDS
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c072+0x148518 @ 0x548518
pos_c072+0x148466 @ 0x548466
pos_c072+0x148427 @ 0x548427
pos_c072+0x158b19 @ 0x558b19
pos_c072+0x15c75b @ 0x55c75b
pos_c072+0x15ca71 @ 0x55ca71
pos_c072+0x15cc22 @ 0x55cc22
pos_c072+0x15ba64 @ 0x55ba64
pos_c072+0x15bca0 @ 0x55bca0
pos_c072+0x15bd80 @ 0x55bd80
pos_c072+0x15e57d @ 0x55e57d
pos_c072+0x15e420 @ 0x55e420
pos_c072+0x1c2cba @ 0x5c2cba
pos_c072+0x1c324d @ 0x5c324d
pos_c072+0x7770f @ 0x47770f
pos_c072+0x5f717 @ 0x45f717
pos_c072+0x62664 @ 0x462664
pos_c072+0x117769 @ 0x517769
pos_c072+0x621b8 @ 0x4621b8
pos_c072+0x62223 @ 0x462223
pos_c072+0x62664 @ 0x462664
pos_c072+0x117769 @ 0x517769
pos_c072+0x5e210 @ 0x45e210
pos_c072+0x1c3f04 @ 0x5c3f04
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1636224
registers.edi: 1636412
registers.eax: 1636224
registers.ebp: 1636304
registers.edx: 0
registers.ebx: 5540976
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2576
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73662000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x001f4094 size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00211bd4 size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00211be8 size 0x00000274
Bkav W32.AIDetectMalware
ALYac Gen:Variant.Strictor.291372
VIPRE Gen:Variant.Strictor.291372
BitDefender Gen:Variant.Strictor.291372
Cybereason malicious.ebd71e
Arcabit Trojan.Generic.D4614FD8
MicroWorld-eScan Gen:Variant.Strictor.291372
Emsisoft Gen:Variant.Strictor.291372 (B)
FireEye Gen:Variant.Strictor.291372
MAX malware (ai score=88)
GData Gen:Variant.Strictor.291372