Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 6, 2021, 1:31 p.m.	April 6, 2021, 1:33 p.m.

Size	1.5MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`958c184f9e41f943ab794f180870692e`
SHA256	`fd01cc51dc5553a97472b79b1fe64e9e9fd8b0552530cf0d39d31d44d7ae048f`
CRC32	`4C0E08F4`
ssdeep	`24576:AXCYQVCnAT59ypgs0MfhGH0T1XiNfXVqekMhV1qbX96elZpj4xrSqc66guj2eb1/:ASYQ4OYpOMZrxS9gekMh+PjWuqcPj2mJ`
Yara	win_registry - Affect system registries win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero IsPE64 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check

ukex%E9%97%AE%E9%A2%98.exe "C:\Users\test22\AppData\Local\Temp\ukex%E9%97%AE%E9%A2%98.exe"
112

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
178.236.44.37	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 6, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sedata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 139 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 315392 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000401000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000401000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000401000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 274432 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000404000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 274432 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000404000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 147456 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000572000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000044b000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

ukex%E9%97%AE%E9%A2%98.exe tried to sleep 283 seconds, actually delayed analysis time by 283 seconds

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 6, 2021, 1:24 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 262144 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000021b0000 process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0002bc00', u'virtual_address': u'0x00001000', u'entropy': 7.998745560456876, u'name': u'.text', u'virtual_size': u'0x0004d000'}

entropy

7.99874556046

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0014f000', u'virtual_address': u'0x0004e000', u'entropy': 7.620723706884645, u'name': u'.sedata', u'virtual_size': u'0x0014f000'}

entropy

7.62072370688

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001000', u'virtual_address': u'0x0019e000', u'entropy': 7.984222641752575, u'name': u'.sedata', u'virtual_size': u'0x00001000'}

entropy

7.98422264175

description

A section with a high entropy has been found

entropy

0.999342105263

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

178.236.44.37

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Elastic	malicious (high confidence)
Qihoo-360	Win64/Trojan.Generic.H8oAYt8A
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.89480a
Symantec	Trojan.Gen.MBT
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Avast	Win64:Malware-gen
Rising	Malware.Blackv!8.E14F (CLOUD)
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win64.Trickbot.tc
FireEye	Generic.mg.958c184f9e41f943
SentinelOne	Static AI - Suspicious PE
Jiangmin	TrojanDropper.Agent.bpxz
Avira	HEUR/AGEN.1138440
Gridinsoft	Trojan.Heur!.030100A3
AegisLab	Trojan.Win32.Malicious.4!c
Microsoft	Program:Win32/Wacapew.C!ml
AhnLab-V3	Malware/Win32.RL_Generic.R305514
McAfee	Artemis!958C184F9E41
Cylance	Unsafe
Ikarus	PUA.NoobyProtect
eGambit	Unsafe.AI_Score_99%
Fortinet	Malicious_Behavior.SB
AVG	Win64:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

ukex%E9%97%AE%E9%A2%98.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All