popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

0k9L0.mp4

Emotet Gen1 PE64 PE File DLL OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 20, 2021, 7:48 a.m. May 20, 2021, 7:54 a.m.
Size 13.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 f3cfde24b4dcdb6a8f281929c9e000d5
SHA256 8430fd19a75b52c3abddc30a52ffc7c5956b0a590ffb1f00bc29c1f0b7d2d5e0
CRC32 AC7E8633
ssdeep 393216:4Mesjorlh2pBzBUjt+hHOY0QO07Na5J5:DesjopQpF20hHOYpOyNaP5
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
www.geoplugin.net
CNAME geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
request GET http://www.geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1756
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000027a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\_MEI22122\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\pywintypes37.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\pythoncom37.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\python37.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\mfc140u.dll
file C:\Users\test22\AppData\Local\Temp\_MEI22122\sqlite3.dll
Alibaba Trojan:Win32/Wofith.b656acaa
Cyren W64/CookieStealera.G.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Wofith.haf
McAfee-GW-Edition BehavesLike.Win64.Dropper.tc
Webroot W32.Malware.Gen
Avira TR/ATRAPS.Gen
MAX malware (ai score=95)
Microsoft Trojan:Win32/Sabsik.FT.A!ml
AegisLab Trojan.Win32.Wofith.4!c
Cynet Malicious (score: 99)
AhnLab-V3 Trojan/Win.SpyAgent.C4385667
McAfee Artemis!F3CFDE24B4DC
Malwarebytes Malware.AI.4178029874
Fortinet Malicious_Behavior.SB
AVG Win64:Malware-gen
Avast Win64:Malware-gen