{
"root":{
"result":{
"data": {
"summary": {
"sha1": "039f786b81455c83dc50283e42d0ee2ac48059c8",
"md5": "7980094788f0e46145bdff91b0f4743e",
"scenes": [],
"tag": {
"s": [
"dll",
"lang_english"
],
"x": [
"Trojan",
"ZLoader"
]
},
"file_size": 471552,
"is_whitelist": false,
"malware_type": "Trojan",
"malware_family": "ZLoader",
"sandbox_type_list": [
"win10_1903_enx64_office2016",
"win7_sp1_enx86_office2013"
],
"threat_level": "malicious",
"submit_time": "2024-11-05 23:56:27",
"last_detection_time": "2024-11-06 07:59:28",
"file_name": "7980094788F0E46145BDFF91B0F4743E",
"file_type": "DLLx64",
"sample_sha256": "603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3",
"threat_score": 70,
"sandbox_type": "win7_sp1_enx86_office2013",
"multi_engines": "14/28"
},
"multiengines": {
"result": {
"IKARUS": "Trojan.Win64.ZLoader",
"vbwebshell": "safe",
"Avast": "Win64:MalwareX-gen [Misc]",
"Avira": "TR/Redcap.nvthy",
"Sophos": "Mal/Generic-S",
"K7": "Spyware ( 005b0cf61 )",
"Rising": "Spyware.Zbot!8.16B (CLOUD)",
"Kaspersky": "Trojan.Win64.Agentb.lbtp",
"Panda": "Trj/Chgt.AD",
"Baidu-China": "safe",
"NANO": "safe",
"Antiy": "Trojan/Win64.ZLoader",
"AVG": "Win64:MalwareX-gen [Misc]",
"Baidu": "safe",
"DrWeb": "Trojan.PWS.Sphinx.116",
"GDATA": "Trojan.GenericKD.74808184",
"Microsoft": "Trojan:Win64/ZLoader.DB!MTB",
"Qihu360": "safe",
"ESET": "a variant of Win64/Spy.Zbot.S",
"ClamAV": "safe",
"JiangMin": "safe",
"Trustlook": "safe",
"MicroAPT": "safe",
"OneAV": "safe",
"OneStatic": "safe",
"MicroNonPE": "safe",
"OneAV-PWSH": "safe",
"ShellPub": "safe"
},
"scan_time": "2024-11-05 23:59:28",
"detect_rate": "14/28"
},
"static": {
"details": {
"pe_version_info": [
{
"name": "CompanyName",
"value": "Altair Industries"
},
{
"name": "FileDescription",
"value": "HexaLab"
},
{
"name": "FileVersion",
"value": "8.94.14.711"
},
{
"name": "InternalName",
"value": "HexaLab"
},
{
"name": "LegalCopyright",
"value": "Copyright © 2023 Altair Industries"
},
{
"name": "OriginalFilename",
"value": "HexaLab.dll"
},
{
"name": "ProductName",
"value": "Bit Nova"
},
{
"name": "ProductVersion",
"value": "8.94.14.711"
},
{
"name": "Translation",
"value": "0x0409 0x04b0"
}
],
"pe_sections": [
{
"name": ".text",
"virtual_address": "0x00001000",
"virtual_size": "0x00057840",
"size_of_data": "0x00057a00",
"pointer_to_rawdata": "0x00000400",
"hash": "071570a522e923806c78ef95b2d6ed7b",
"SectionPermission": "R-E",
"entropy": 6.385688825236411
},
{
"name": ".rdata",
"virtual_address": "0x00059000",
"virtual_size": "0x00011fea",
"size_of_data": "0x00012000",
"pointer_to_rawdata": "0x00057e00",
"hash": "056c3c10d944547aa9ba1606fd4b6acf",
"SectionPermission": "R--",
"entropy": 5.843108990423532
},
{
"name": ".data",
"virtual_address": "0x0006b000",
"virtual_size": "0x00006d40",
"size_of_data": "0x00001600",
"pointer_to_rawdata": "0x00069e00",
"hash": "92078e4bf88550d7dd35cd2b0d1a7677",
"SectionPermission": "RW-",
"entropy": 1.9720657252837093
},
{
"name": ".pdata",
"virtual_address": "0x00072000",
"virtual_size": "0x00006d5c",
"size_of_data": "0x00006e00",
"pointer_to_rawdata": "0x0006b400",
"hash": "002497e496fa985f8d3f30284d3f586e",
"SectionPermission": "R--",
"entropy": 5.671708918490455
},
{
"name": "_RDATA",
"virtual_address": "0x00079000",
"virtual_size": "0x000000fc",
"size_of_data": "0x00000200",
"pointer_to_rawdata": "0x00072200",
"hash": "0d9aab0caec253f52388cd1c1f0460a5",
"SectionPermission": "R--",
"entropy": 2.4558081453626235
},
{
"name": ".reloc",
"virtual_address": "0x0007a000",
"virtual_size": "0x0000071c",
"size_of_data": "0x00000800",
"pointer_to_rawdata": "0x00072400",
"hash": "a1c06c8003ce55dbfd84874d5d760e10",
"SectionPermission": "R--",
"entropy": 5.187047747505069
},
{
"name": ".rsrc",
"virtual_address": "0x0007b000",
"virtual_size": "0x000004be",
"size_of_data": "0x00000600",
"pointer_to_rawdata": "0x00072c00",
"hash": "85dfdabfbcad79f9ab3406e21a0ef7d6",
"SectionPermission": "R--",
"entropy": 3.4830131399980435
}
],
"pe_signatures": {
"product": "Bit Nova",
"verified": "Unsigned",
"description": "HexaLab"
},
"pe_imports": [
{
"dll": "KERNEL32.dll",
"imports": [
{
"address": "0x180059020",
"name": "GetTickCount64"
},
{
"address": "0x180059028",
"name": "ResetEvent"
},
{
"address": "0x180059278",
"name": "GetModuleHandleExW"
},
{
"address": "0x180059280",
"name": "HeapFree"
},
{
"address": "0x180059288",
"name": "FindFirstFileExW"
},
{
"address": "0x1800592a0",
"name": "GetOEMCP"
},
{
"address": "0x1800592a8",
"name": "GetCPInfo"
},
{
"address": "0x1800592b0",
"name": "GetCommandLineA"
},
{
"address": "0x1800592b8",
"name": "GetCommandLineW"
}
]
},
{
"dll": "USER32.dll",
"imports": [
{
"address": "0x1800592e0",
"name": "PeekMessageW"
}
]
},
{
"dll": "ADVAPI32.dll",
"imports": [
{
"address": "0x180059000",
"name": "OpenSCManagerW"
},
{
"address": "0x180059008",
"name": "CloseServiceHandle"
},
{
"address": "0x180059010",
"name": "CryptReleaseContext"
}
]
},
{
"dll": "SHLWAPI.dll",
"imports": [
{
"address": "0x1800592c8",
"name": "PathFindFileNameW"
},
{
"address": "0x1800592d0",
"name": "StrCmpNIA"
}
]
},
{
"dll": "WS2_32.dll",
"imports": [
{
"address": "0x1800592f0",
"name": "ntohs"
},
{
"address": "0x1800592f8",
"name": "setsockopt"
},
{
"address": "0x180059300",
"name": "getsockopt"
},
{
"address": "0x180059308",
"name": "sendto"
},
{
"address": "0x180059310",
"name": "closesocket"
},
{
"address": "0x180059318",
"name": "shutdown"
},
{
"address": "0x180059320",
"name": "htonl"
},
{
"address": "0x180059328",
"name": "inet_addr"
},
{
"address": "0x180059330",
"name": "WSAGetLastError"
}
]
},
{
"dll": "ole32.dll",
"imports": [
{
"address": "0x180059380",
"name": "CoCreateInstance"
}
]
},
{
"dll": "gdiplus.dll",
"imports": [
{
"address": "0x180059340",
"name": "GdipGetImageEncodersSize"
}
]
},
{
"dll": "ntdll.dll",
"imports": [
{
"address": "0x180059350",
"name": "RtlVirtualUnwind"
},
{
"address": "0x180059358",
"name": "RtlUnwindEx"
},
{
"address": "0x180059360",
"name": "RtlPcToFileHeader"
},
{
"address": "0x180059368",
"name": "RtlCaptureContext"
},
{
"address": "0x180059370",
"name": "RtlLookupFunctionEntry"
}
]
}
],
"pe_resources": [
{
"name": "RT_VERSION",
"offset": "0x0007b0a0",
"size": "0x000002dc",
"filetype": "data",
"language": "LANG_ENGLISH",
"sublanguage": "SUBLANG_ENGLISH_US"
},
{
"name": "RT_MANIFEST",
"offset": "0x0007b37c",
"size": "0x00000142",
"filetype": "ASCII text, with CRLF line terminators",
"language": "LANG_ENGLISH",
"sublanguage": "SUBLANG_ENGLISH_US"
}
],
"tag": [],
"pe_basic": {
"tls_info": {},
"import_hash": "e78df8995d788e9664d5306651cffb6f",
"peid": [
"filetype: PE64",
"arch: AMD64",
"mode: 64",
"endianess: LE",
"type: DLL",
"compiler: Microsoft Visual C/C++(-)[-]",
"linker: Microsoft Linker(14.29**)[DLL64]"
],
"time_stamp": "2024-11-04 19:29:01",
"entry_point_section": ".text",
"image_base": "0x180000000",
"entry_point": "0x4d920"
},
"pe_detect": {
"find_crypt": {},
"urls": []
},
"pe_exports": [
{
"address": "0x1800237b0",
"name": "DllRegisterServer",
"ordinal": 1
},
{
"address": "0x1800019e0",
"name": "DmxzenyaSttc",
"ordinal": 2
},
{
"address": "0x18001d3a0",
"name": "DwxuexCcald",
"ordinal": 3
},
{
"address": "0x180027230",
"name": "FgesNhaw",
"ordinal": 4
},
{
"address": "0x180009940",
"name": "IntpTwppux",
"ordinal": 5
},
{
"address": "0x1800079f0",
"name": "RvqiZaej",
"ordinal": 6
},
{
"address": "0x180026ae0",
"name": "UpumvqvIlcu",
"ordinal": 7
},
{
"address": "0x18001a0e0",
"name": "VpjnIcef",
"ordinal": 8
},
{
"address": "0x180020d40",
"name": "YyuxzzvMetk",
"ordinal": 9
}
]
},
"basic": {
"sha1": "039f786b81455c83dc50283e42d0ee2ac48059c8",
"sha256": "603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3",
"file_type": "PE32+ executable (DLL) (GUI) x86-64, for MS Windows",
"file_name": "603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3-1730851062",
"ssdeep": "6144:TYSbPcIFqVNwHRIkXRMTPPcIBbVpov6Cxfqm3xKRe+KTc:0Sb0tNwHtRcvVpLCBDWe+KTc",
"file_size": 471552,
"md5": "7980094788f0e46145bdff91b0f4743e"
}
},
"signature": [],
"dropped": [],
"network": {
"mitm": [],
"tcp": [],
"udp": [],
"icmp": [],
"http": [],
"tls": [],
"dns": [],
"smtp": [],
"irc": [],
"irc_ex": [],
"dns_servers": [
"119.29.29.29",
"223.5.5.5"
],
"fingerprint": [],
"tcp_ex": [],
"smtp_ex": [],
"http_ex": [],
"https_ex": [],
"dead_hosts": [],
"domains": [],
"hosts": []
},
"pstree": {
"children": [
{
"track": true,
"pid": 6008,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,RvqiZaej",
"first_seen": 1.730851039239155E9,
"ppid": 6004,
"children": []
},
{
"track": true,
"pid": 4608,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,DllRegisterServer",
"first_seen": 1.730851039761047E9,
"ppid": 3280,
"children": []
},
{
"track": true,
"pid": 4276,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,IntpTwppux",
"first_seen": 1.730851040195206E9,
"ppid": 4988,
"children": []
},
{
"track": true,
"pid": 5280,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,VpjnIcef",
"first_seen": 1.730851040520639E9,
"ppid": 5824,
"children": []
},
{
"track": true,
"pid": 656,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,YyuxzzvMetk",
"first_seen": 1.730851040886768E9,
"ppid": 2780,
"children": []
},
{
"track": true,
"pid": 3168,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,DwxuexCcald",
"first_seen": 1.730851041251268E9,
"ppid": 4356,
"children": []
},
{
"track": true,
"pid": 6816,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,FgesNhaw",
"first_seen": 1.730851041521835E9,
"ppid": 5256,
"children": []
},
{
"track": true,
"pid": 2612,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,UpumvqvIlcu",
"first_seen": 1.73085104180838E9,
"ppid": 1348,
"children": []
},
{
"track": true,
"pid": 6600,
"process_name": "rundll32.exe",
"command_line": "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Users\\Administrator\\Desktop\\603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3.dll,DmxzenyaSttc",
"first_seen": 1.730851042077707E9,
"ppid": 6216,
"children": []
}
],
"process_name": {
"en": "Analysed 9 processes in total",
"cn": "共分析了9个进程"
}
},
"strings": {
"603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3": [
".?AVbad_function_call@std@@",
"api-ms-win-core-file-l1-2-2",
"L9}@rdH",
"CreateProcessW",
"GetACP",
" </requestedPrivileges>",
"api-ms-win-security-systemfunctions-l1-1-0",
"EnterCriticalSection",
"DESKTOP-H9URB7T",
"e13678",
"ip6-servers"
]
}
},
"response_code": 200,
"msg": "Success"
},
"hash":"039f786b81455c83dc50283e42d0ee2ac48059c8",
"host":"45.77.252.42"
}
}
