Edit tour
Windows
Analysis Report
ZOquwQZvoa.exe
Overview
General Information
| Sample name: | ZOquwQZvoa.exerenamed because original name is a hash value |
| Original sample name: | ca4c78e5b146a4eddfcde39610ff1943.exe |
| Analysis ID: | 1432079 |
| MD5: | ca4c78e5b146a4eddfcde39610ff1943 |
| SHA1: | 9ac38a6f5a9e77b724f4df58ad54ac5d90183e15 |
| SHA256: | 1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f |
| Tags: | 32exeStealc |
Errors
| |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Classification
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Static PE information: | ||
| Source: | Virustotal: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
⊘No Mitre Att&ck techniques found
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 42% | Virustotal | Browse | ||
| 100% | Avira | HEUR/AGEN.1361904 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1432079 |
| Start date and time: | 2024-04-26 12:00:06 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 3m 34s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 0 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Sample name: | ZOquwQZvoa.exerenamed because original name is a hash value |
| Original Sample Name: | ca4c78e5b146a4eddfcde39610ff1943.exe |
| Detection: | MAL |
| Classification: | mal60.winEXE@0/0@0/0 |
- Unable to connect to analysis machine: w10x64, esxi07-W10x64_Office_01, timeout exceeded, no analysis of the sample was performed
- No process behavior to analyse as no analysis process or sample was found
⊘No simulations
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.5021258330497504 |
| TrID: |
|
| File name: | ZOquwQZvoa.exe |
| File size: | 305'152 bytes |
| MD5: | ca4c78e5b146a4eddfcde39610ff1943 |
| SHA1: | 9ac38a6f5a9e77b724f4df58ad54ac5d90183e15 |
| SHA256: | 1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f |
| SHA512: | fd958e80f756c8002814d8e2a0616079ec3f7e37d4277fc1587f0975935836b523e3e611a5f2452fb474d9ca21231b93e18de79c61a5c57bc3dec36a0330bbf3 |
| SSDEEP: | 3072:1HdB+Q00pIdkl+P0VD8Df5h8jYbSE7XGKICg6hty92rN3G9JlCUj6+PhXmSIN8nj:pNySl68srjg6/529PCUj6Gch8nPr |
| TLSH: | D5545A0736E47C90E62247724F2EBAEC372DF9649F556B3722586F0B84702B0D263B56 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................q.......N.......O.......=.............X/K.......u.....X/p.....Rich............................PE..L.....=e... |
| Entrypoint: | 0x404457 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x653DC88F [Sun Oct 29 02:50:55 2023 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | fee2e01e9ecb27c28da2b6fc37f265e9 |
| Instruction |
|---|
| call 00007F468C52F0C2h |
| jmp 00007F468C529245h |
| push 00000014h |
| push 00417FD8h |
| call 00007F468C52C4B8h |
| call 00007F468C52F293h |
| movzx esi, ax |
| push 00000002h |
| call 00007F468C52F055h |
| pop ecx |
| mov eax, 00005A4Dh |
| cmp word ptr [00400000h], ax |
| je 00007F468C529246h |
| xor ebx, ebx |
| jmp 00007F468C529275h |
| mov eax, dword ptr [0040003Ch] |
| cmp dword ptr [eax+00400000h], 00004550h |
| jne 00007F468C52922Dh |
| mov ecx, 0000010Bh |
| cmp word ptr [eax+00400018h], cx |
| jne 00007F468C52921Fh |
| xor ebx, ebx |
| cmp dword ptr [eax+00400074h], 0Eh |
| jbe 00007F468C52924Bh |
| cmp dword ptr [eax+004000E8h], ebx |
| setne bl |
| mov dword ptr [ebp-1Ch], ebx |
| call 00007F468C52B68Fh |
| test eax, eax |
| jne 00007F468C52924Ah |
| push 0000001Ch |
| call 00007F468C529321h |
| pop ecx |
| call 00007F468C52AC42h |
| test eax, eax |
| jne 00007F468C52924Ah |
| push 00000010h |
| call 00007F468C529310h |
| pop ecx |
| call 00007F468C52F0CEh |
| and dword ptr [ebp-04h], 00000000h |
| call 00007F468C52D471h |
| test eax, eax |
| jns 00007F468C52924Ah |
| push 0000001Bh |
| call 00007F468C5292F6h |
| pop ecx |
| call dword ptr [004120B0h] |
| mov dword ptr [04022184h], eax |
| call 00007F468C52F0E9h |
| mov dword ptr [004346ECh], eax |
| call 00007F468C52ECA6h |
| test eax, eax |
| jns 00007F468C52924Ah |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x183e4 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x3c23000 | 0x167e0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x3c3a000 | 0x1380 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x121f0 | 0x38 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x178f8 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x12000 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x10035 | 0x10200 | 48af369956e9195ab73ea3822ff38852 | False | 0.6008660368217055 | data | 6.691582164808204 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x12000 | 0x6c72 | 0x6e00 | 8dbfb4f7efa534ed7af31cfbfd88dac2 | False | 0.38899147727272726 | data | 4.720676210345591 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x19000 | 0x3c09188 | 0x1b800 | 50acfa3161c562e0cd2e1d6d1ab01b64 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x3c23000 | 0x167e0 | 0x16800 | 4d1e9abd966fdeb3d0460b1a77cafb1e | False | 0.4259006076388889 | data | 4.907849938636764 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x3c3a000 | 0x1380 | 0x1400 | 15cbe146566e272d8f95752a554d23af | False | 0.74765625 | data | 6.462484217359861 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | 0x3c39020 | 0xe | data | 1.5714285714285714 | ||
| RT_ICON | 0x3c236e0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | 0.41647465437788017 | ||
| RT_ICON | 0x3c23da8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.16410788381742739 | ||
| RT_ICON | 0x3c26350 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.21365248226950354 | ||
| RT_ICON | 0x3c267e8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.3664712153518124 | ||
| RT_ICON | 0x3c27690 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.45442238267148016 | ||
| RT_ICON | 0x3c27f38 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | 0.45506912442396313 | ||
| RT_ICON | 0x3c28600 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.4638728323699422 | ||
| RT_ICON | 0x3c28b68 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.2683609958506224 | ||
| RT_ICON | 0x3c2b110 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | 0.3072232645403377 | ||
| RT_ICON | 0x3c2c1b8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.35106382978723405 | ||
| RT_ICON | 0x3c2c688 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.5690298507462687 | ||
| RT_ICON | 0x3c2d530 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.5437725631768953 | ||
| RT_ICON | 0x3c2ddd8 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.6184971098265896 | ||
| RT_ICON | 0x3c2e340 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.4632780082987552 | ||
| RT_ICON | 0x3c308e8 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | 0.4866322701688555 | ||
| RT_ICON | 0x3c31990 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 0 | 0.4905737704918033 | ||
| RT_ICON | 0x3c32318 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.44769503546099293 | ||
| RT_ICON | 0x3c327e8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.4240405117270789 | ||
| RT_ICON | 0x3c33690 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.4833032490974729 | ||
| RT_ICON | 0x3c33f38 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | 0.5835253456221198 | ||
| RT_ICON | 0x3c34600 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.4913294797687861 | ||
| RT_ICON | 0x3c34b68 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.4701244813278008 | ||
| RT_ICON | 0x3c37110 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | 0.4878048780487805 | ||
| RT_ICON | 0x3c381b8 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 0 | 0.5032786885245901 | ||
| RT_ICON | 0x3c38b40 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | 0.5514184397163121 | ||
| RT_STRING | 0x3c39270 | 0x2bc | data | 0.49142857142857144 | ||
| RT_STRING | 0x3c39530 | 0x2ac | data | 0.48830409356725146 | ||
| RT_GROUP_ICON | 0x3c32780 | 0x68 | data | 0.7115384615384616 | ||
| RT_GROUP_ICON | 0x3c2c620 | 0x68 | data | 0.6826923076923077 | ||
| RT_GROUP_ICON | 0x3c267b8 | 0x30 | data | 0.9375 | ||
| RT_GROUP_ICON | 0x3c38fa8 | 0x76 | data | 0.6779661016949152 | ||
| RT_VERSION | 0x3c39030 | 0x23c | data | 0.5367132867132867 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GlobalMemoryStatus, GetLocaleInfoA, LocalCompact, InterlockedDecrement, GetComputerNameW, CreateHardLinkA, GetSystemDefaultLCID, BackupSeek, GetTickCount, GetConsoleAliasesA, GetWindowsDirectoryA, EnumTimeFormatsW, GetUserDefaultLangID, SetCommState, GlobalAlloc, LoadLibraryW, ReadConsoleInputA, WriteConsoleW, GetModuleFileNameW, MultiByteToWideChar, GetLastError, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, RemoveDirectoryA, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, SetCalendarInfoW, GetExitCodeThread, AddAtomW, CreateEventW, GlobalFindAtomW, GetOEMCP, LoadLibraryExA, VirtualProtect, GetConsoleProcessList, GetTempPathA, GetVolumeInformationW, HeapAlloc, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, HeapFree, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetStdHandle, WriteFile, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteCriticalSection, HeapSize, GetFileType, GetStartupInfoW, CloseHandle, GetModuleFileNameA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetStringTypeW, LoadLibraryExW, OutputDebugStringW, LCMapStringW, SetStdHandle, SetFilePointerEx, HeapReAlloc, CreateFileW |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
⊘No statistics
⊘No system behavior
⊘No disassembly