popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

POS_C180.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX MZP Format PE File dll PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:01 p.m. Aug. 19, 2024, 2:09 p.m.
Size 1.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d03e7f80a3ad69af54a082c1ebf202ea
SHA256 6255614a84b38a43c97504cdcce770df9f3a5d6f23290ce8cfb9354f6a3ce846
CRC32 E3A9A76C
ssdeep 24576:Q3zxdAN3NK5lg5l4f3h5plzuJC07xa8q1HNIzlRT+ncOBxnykUvNl4PD8v:Q3YEmEvIlX3+XHPnPDS
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pos_c180+0x10c25c @ 0x50c25c
pos_c180+0x10c1aa @ 0x50c1aa
pos_c180+0x10c16b @ 0x50c16b
pos_c180+0x11c85d @ 0x51c85d
pos_c180+0x12049f @ 0x52049f
pos_c180+0x1207b5 @ 0x5207b5
pos_c180+0x120966 @ 0x520966
pos_c180+0x11f7a8 @ 0x51f7a8
pos_c180+0x11f9e4 @ 0x51f9e4
pos_c180+0x11fac4 @ 0x51fac4
pos_c180+0x122581 @ 0x522581
pos_c180+0x122418 @ 0x522418
pos_c180+0x15067f @ 0x55067f
pos_c180+0x150ad1 @ 0x550ad1
pos_c180+0x4776f @ 0x44776f
pos_c180+0x4a6bc @ 0x44a6bc
pos_c180+0x14166d @ 0x54166d
pos_c180+0x4a210 @ 0x44a210
pos_c180+0x4a27b @ 0x44a27b
pos_c180+0x4a6bc @ 0x44a6bc
pos_c180+0x14166d @ 0x54166d
pos_c180+0x46280 @ 0x446280
pos_c180+0x1513ac @ 0x5513ac
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1636172
registers.edi: 1636360
registers.eax: 1636172
registers.ebp: 1636252
registers.edx: 0
registers.ebx: 5294516
registers.esi: 10061
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73662000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0017942c size 0x000002e8
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00193d0c size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00193d20 size 0x00000274
Bkav W32.AIDetectMalware
APEX Malicious
MaxSecure Trojan.Malware.300983.susgen