Summary | ZeroBOX

uDUxwumDrV.dll

OS Processor Check PE64 PE File DLL
Category Machine Started Completed
FILE s1_win7_x6401 April 28, 2021, 4:07 p.m. April 28, 2021, 4:11 p.m.
Size 15.9MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 ee03a7aafeaa2e4b937066e5efe8016f
SHA256 071726ffe3567442cc251bb3bf1b72db413081cbe1a41483c8cc230c31834816
CRC32 3AA46985
ssdeep 196608:TtPW0qJXS7S/PzVjqjKj4U1tc18OXVmJXSMKAQPJjDqPXDKw9AHurr6:Tt6Jjvj1tc1XVmJXvKAykPXOwuHh
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
section ?MYF.v\x1d%
section bX,7Ic,:
section 7vVtIR\x1fP
section 8:!CD-Y#
section lX9\x1cFMLW
section YT;jIN:!
section B;bdgtRg
section TD_8>Y0q
section =\Q-FAQc
section \x1c*\x1eHAdSP
section V:D8)cUm
section S%w9EedK
section vdR&<rVA
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba @ 0x2a83fba
dbkFCallWrapperAddr+0x72c6dd uduxwumdrv+0xdcb975 @ 0x2a3b975
0x293000
0x28f508

exception.instruction_r: 90 68 c1 bc a9 dc e8 ec c8 07 00 68 81 bc 22 0d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol: dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba
exception.address: 0x2a83fba
registers.r14: 5
registers.r15: 0
registers.rcx: 3735929054
registers.rsi: 2688304
registers.r10: -1951159840
registers.rbx: 2687584
registers.rsp: 2223952
registers.r11: 84
registers.r8: 655420
registers.r9: 43840
registers.rdx: 364
registers.r12: 43298143
registers.rbp: 2676096
registers.rdi: 2687824
registers.rax: 1562723623
registers.r13: 0
1 0 0

__exception__

stacktrace:
dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba @ 0x2a83fba
dbkFCallWrapperAddr+0x72c6dd uduxwumdrv+0xdcb975 @ 0x2a3b975
0x3320e0
0x32e578

exception.instruction_r: 90 68 c1 bc a9 dc e8 ec c8 07 00 68 81 bc 22 0d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol: dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba
exception.address: 0x2a83fba
registers.r14: 5
registers.r15: 0
registers.rcx: 3735929054
registers.rsi: 3339680
registers.r10: -1951159840
registers.rbx: 3338960
registers.rsp: 847872
registers.r11: 84
registers.r8: 655420
registers.r9: 43840
registers.rdx: 364
registers.r12: 43298143
registers.rbp: 3331456
registers.rdi: 3339200
registers.rax: 1558197503
registers.r13: 0
1 0 0

__exception__

stacktrace:
dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba @ 0x2a83fba
dbkFCallWrapperAddr+0x72c6dd uduxwumdrv+0xdcb975 @ 0x2a3b975
0x1c20c0
0x1be558

exception.instruction_r: 90 68 c1 bc a9 dc e8 ec c8 07 00 68 81 bc 22 0d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol: dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba
exception.address: 0x2a83fba
registers.r14: 5
registers.r15: 0
registers.rcx: 3735929054
registers.rsi: 1832320
registers.r10: -1951159840
registers.rbx: 1831600
registers.rsp: 849120
registers.r11: 84
registers.r8: 655420
registers.r9: 43840
registers.rdx: 364
registers.r12: 43298143
registers.rbp: 1824096
registers.rdi: 1831840
registers.rax: 1563748316
registers.r13: 0
1 0 0

__exception__

stacktrace:
dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba @ 0x2b83fba
dbkFCallWrapperAddr+0x72c6dd uduxwumdrv+0xdcb975 @ 0x2b3b975
0x4320e0
0x42e578

exception.instruction_r: 90 68 c1 bc a9 dc e8 ec c8 07 00 68 81 bc 22 0d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol: dbkFCallWrapperAddr+0x774d22 uduxwumdrv+0xe13fba
exception.address: 0x2b83fba
registers.r14: 5
registers.r15: 0
registers.rcx: 3735929054
registers.rsi: 4388256
registers.r10: -1950111264
registers.rbx: 4387536
registers.rsp: 2749360
registers.r11: 84
registers.r8: 655420
registers.r9: 43840
registers.rdx: 364
registers.r12: 44346719
registers.rbp: 4380032
registers.rdi: 4387776
registers.rax: 1481943739
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00048a00', u'virtual_address': u'0x006b1000', u'entropy': 7.9991395216885115, u'name': u'TD_8>Y0q', u'virtual_size': u'0x000488e0'} entropy 7.99913952169 description A section with a high entropy has been found
section {u'size_of_data': u'0x00050200', u'virtual_address': u'0x006fa000', u'entropy': 7.995932504638369, u'name': u'=\\Q-FAQc', u'virtual_size': u'0x000501c0'} entropy 7.99593250464 description A section with a high entropy has been found
section {u'size_of_data': u'0x0057d000', u'virtual_address': u'0x0074b000', u'entropy': 7.863972219166107, u'name': u'\\x1c*\\x1eHAdSP', u'virtual_size': u'0x0057ce61'} entropy 7.86397221917 description A section with a high entropy has been found
section {u'size_of_data': u'0x002ef600', u'virtual_address': u'0x00cc8000', u'entropy': 7.617840162915499, u'name': u'V:D8)cUm', u'virtual_size': u'0x002ef574'} entropy 7.61784016292 description A section with a high entropy has been found
entropy 0.566465303119 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.FGHR
Cylance Unsafe
CrowdStrike win/malicious_confidence_100% (W)
K7GW Spyware ( 005791d51 )
K7AntiVirus Spyware ( 005791d51 )
Arcabit Trojan.Agent.FGHR
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win64/Spy.Mekotio.P
APEX Malicious
Avast Win64:Trojan-gen
BitDefender Trojan.Agent.FGHR
AegisLab Trojan.Win32.Fghr.4!c
Rising Spyware.Mekotio!8.F5DF (CLOUD)
Ad-Aware Trojan.Agent.FGHR
Emsisoft Trojan.Agent.FGHR (B)
McAfee-GW-Edition BehavesLike.Win64.Softcnapp.wc
FireEye Generic.mg.ee03a7aafeaa2e4b
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Webroot W32.Trojan.Gen
MAX malware (ai score=83)
Kingsoft Win32.Troj.Generic.a.(kcloud)
Gridinsoft Trojan.Heur!.02296202
Microsoft Trojan:Win32/Wacatac.B!ml
GData Trojan.Agent.FGHR
McAfee Artemis!EE03A7AAFEAA
Malwarebytes Malware.AI.4211687409
TrendMicro-HouseCall TROJ_FRS.VSNTDR21
Fortinet W64/Mekotio.P!tr.spy
AVG Win64:Trojan-gen