popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

5.exe

OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 May 5, 2021, 8:14 p.m. May 5, 2021, 8:20 p.m.
Size 629.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 870b1ebd3a6f7418f9d9651a2772431f
SHA256 dc466832b1cfeb541df94d49aea4de357c034f78bf70480c27fe265e440010bf
CRC32 18149BB5
ssdeep 12288:k3gFg6zftI7r0GkdamN8Zf9uoVTnSnT0fparzmr:1Fg6zG0GLhdSnTOparzy
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .pecawab
section .new
resource name POFOLAZIVUVUMIMUPIRIC
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 397312
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 996
region_size: 618496
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name POFOLAZIVUVUMIMUPIRIC language LANG_MONGOLIAN filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x000b08d8 size 0x00000bf7
name RT_VERSION language LANG_MONGOLIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x000b14d0 size 0x000001b0
section {u'size_of_data': u'0x00077400', u'virtual_address': u'0x00001000', u'entropy': 7.92394837377636, u'name': u'.text', u'virtual_size': u'0x0007738a'} entropy 7.92394837378 description A section with a high entropy has been found
entropy 0.759554140127 description Overall entropy of this PE file is high
host 172.217.25.14
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46245600
McAfee Packed-GBF!870B1EBD3A6F
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D2C1A6E0
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HKSB
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Chapak.gen
BitDefender Trojan.GenericKD.46245600
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.46245600
McAfee-GW-Edition BehavesLike.Win32.Lockbit.jc
FireEye Generic.mg.870b1ebd3a6f7418
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Microsoft Trojan:Win32/Azorult.FW!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Chapak.gen
GData Win32.Trojan-Stealer.PSWSteal.SNH2OW
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Glupteba.R418996
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34688.NCW@a4mnbIpO
Malwarebytes Trojan.MalPack.GS
Rising Trojan.Kryptik!8.8 (CLOUD)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/Kryptik.HKRT!tr
Webroot W32.Malware.Gen
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.8ab194