Edit tour

Windows Analysis Report
zox1oNM5Xl.exe

Overview

General Information

Sample name:	zox1oNM5Xl.exe renamed because original name is a hash value
Original sample name:	e6966719c5ad13b4ffeb3475c037410e.exe
Analysis ID:	1581392
MD5:	e6966719c5ad13b4ffeb3475c037410e
SHA1:	ce7533af05ada74e959859aaae96370de896edf3
SHA256:	627ef85c42fe43276763c5fe0fd5dcc4917e5977b51ea7fd178bcd1984cb072b
Tags:	exeuser-abuse_ch

Errors No process behavior to analyse as no analysis process or sample was found Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Machine Learning detection for sample

PE file contains section with special chars

Entry point lies outside standard sections

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Sample file is different than original file name gathered from version info

Classification

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: zox1oNM5Xl.exe

Joe Sandbox ML: detected

Source:

Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: zox1oNM5Xl.exe

System Summary

PE file contains section with special chars

Source: zox1oNM5Xl.exe

Static PE information: section name:

Source: zox1oNM5Xl.exe

Static PE information: Data appended to the last section found

Source: zox1oNM5Xl.exe

Binary or memory string: OriginalFilenameB vs zox1oNM5Xl.exe

Source: zox1oNM5Xl.exe

Static PE information: Section: ZLIB complexity 1.0000576934171812

Source: classification engine

Classification label: mal56.winEXE@0/0@0/0

Source: zox1oNM5Xl.exe

Static file information: File size 4477543 > 1048576

Source: zox1oNM5Xl.exe

Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x60e000

Source:

Binary string: Z:\Oreans Projects\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: zox1oNM5Xl.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: zox1oNM5Xl.exe

Static PE information: real checksum: 0x623c38 should be: 0x446a60

Source: zox1oNM5Xl.exe	Static PE information: section name:
Source: zox1oNM5Xl.exe	Static PE information: section name: .imports
Source: zox1oNM5Xl.exe	Static PE information: section name: .themida

Source: zox1oNM5Xl.exe

Static PE information: section name: entropy: 7.972559965934052

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: telegram2.png

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Software Packing	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zox1oNM5Xl.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581392
Start date and time:	2024-12-27 14:52:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zox1oNM5Xl.exe renamed because original name is a hash value
Original Sample Name:	e6966719c5ad13b4ffeb3475c037410e.exe
Detection:	MAL
Classification:	mal56.winEXE@0/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe Unable to launch sample, stop analysis

Errors

No process behavior to analyse as no analysis process or sample was found
Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
VT rate limit hit for: zox1oNM5Xl.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	OTRykEzo6o.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	wceaux.dll.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	wp.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	13.107.246.63
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.251472499346601
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zox1oNM5Xl.exe
File size:	4'477'543 bytes
MD5:	e6966719c5ad13b4ffeb3475c037410e
SHA1:	ce7533af05ada74e959859aaae96370de896edf3
SHA256:	627ef85c42fe43276763c5fe0fd5dcc4917e5977b51ea7fd178bcd1984cb072b
SHA512:	98e64ce86a132d3ca6ceeaedd8fdc16dd448d5f8289a8cb7707bdd02607702fcaceb410aeda48d73151cd12b3462a0178ed48a4e5da7c82517dd55ee9cbba9ee
SSDEEP:	98304:IN5yA1a7c5z8Rlj3GmWEjH/XfxYzLgKKf:ysN7HjPigKk
TLSH:	E8265CF23A0AE2DFC2870878E453DD07D56D03F58715A912DC6DB87CAE53D9622C6B28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c............................BW... ...@....@.. ....................... c.....8<b...@................................

File Icon


Icon Hash:	0f39636064652b17

Static PE Info

General

Entrypoint:	0x485742
Entrypoint Section:	.themida
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x63E41DD4 [Wed Feb 8 22:10:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4328f7206db519cd4e82283211d98e83

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2203a	0x50	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0xa398	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x12000	0x876a	0939e25f30ca472549992c3b49d88082	False	1.0000576934171812	data	7.972559965934052	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0xa398	0xa400	9deb45ce6bc271949e6a24d48d0cf20a	False	0.6636099466463414	data	7.178108226554093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x20000	0xc	0x200	10f9af4c8625f86c22d663197e4eaa3b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.imports	0x22000	0x2000	0x200	dbd0fc163d1022be46a45b67e74740b2	False	0.16796875	data	1.1405531534676816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x24000	0x60e000	0x60e000	23b669402025e026c71624a1d824e91e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x141f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.6028368794326241
RT_ICON	0x14658	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.4405737704918033
RT_ICON	0x14fe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.349906191369606
RT_ICON	0x16088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.2425311203319502
RT_ICON	0x18630	0x4f64	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9969986223184413
RT_GROUP_ICON	0x1d594	0x4c	data	0.75
RT_VERSION	0x1d5e0	0x334	data	0.4353658536585366
RT_MANIFEST	0x1d914	0xa83	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.40245261984392416

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
mscoree.dll	_CorExeMain

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:53:42.075503111 CET	1.1.1.1	192.168.2.11	0x64ba	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:53:42.075503111 CET	1.1.1.1	192.168.2.11	0x64ba	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Statistics

⊘No statistics

System Behavior

⊘No system behavior

Disassembly

⊘No disassembly

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zox1oNM5Xl.exe

Overview

General Information

Detection

Signatures

Classification

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

System Behavior

Disassembly

Windows Analysis Report
zox1oNM5Xl.exe