popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

%E6%9A%97%E5%B7%B7%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%8A%A9%E6%89%8B.exe

Emotet Gen1 OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 26, 2021, 9:22 a.m. May 26, 2021, 9:29 a.m.
Size 806.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 dab5d970f5261b346185007f25d3e5db
SHA256 f19106fe86c7fee8a0c981bfe98937b43c2c818fac6e2fa85f831ddf906ff6bc
CRC32 0D5A6276
ssdeep 12288:RoHZNzEtcggJyCCUZH27oGuoHTqXFvU+Hz0MjP54KmU34BZlfRWHjzkQWc:mbzXgx3UZW7DuoHuXFTj754rlfYHo
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d72000
process_handle: 0xffffffff
1 0 0
description %E6%9A%97%E5%B7%B7%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%8A%A9%E6%89%8B.exe tried to sleep 246 seconds, actually delayed analysis time by 246 seconds
name RT_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0003683c size 0x00000468
name RT_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0003683c size 0x00000468
name RT_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0003683c size 0x00000468
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000f779c size 0x00000014
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000f77b4 size 0x00000300
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000f7ab8 size 0x0000022e
file C:\Users\test22\AppData\Local\Temp\AxCat.Top
file C:\Users\test22\AppData\Local\Temp\AxCat.Top
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000015c
process_name: mobsync.exe
process_identifier: 2064
1 1 0

Process32NextW

 snapshot_handle: 0x0000015c
process_name: taskhost.exe
process_identifier: 1292
1 1 0

Process32NextW

 snapshot_handle: 0x0000015c
process_name: %E6%9A%97%E5%B7%B7%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%8A%A9%E6%89%8B.exe
process_identifier: 2444
1 1 0

Process32NextW

 snapshot_handle: 0x0000015c
process_name: AxCat.Top
process_identifier: 804
1 1 0
section {u'size_of_data': u'0x000c6600', u'virtual_address': u'0x0002e000', u'entropy': 7.762493974732785, u'name': u'UPX1', u'virtual_size': u'0x000c7000'} entropy 7.76249397473 description A section with a high entropy has been found
entropy 0.985102420857 description Overall entropy of this PE file is high
process axcat.top
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
Bkav W32.AIDetect.malware1
CyrenCloud W32/Occamy.T.gen!Eldorado
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.36883953
FireEye Generic.mg.dab5d970f5261b34
CAT-QuickHeal Trojan.Dorv.28643
McAfee Artemis!DAB5D970F526
Cylance Unsafe
Zillya Trojan.Injector.Win32.275978
SUPERAntiSpyware Trojan.Agent/Gen-Injector
Sangfor Trojan.Win32.Blamon.clu
K7AntiVirus Trojan ( 004990741 )
Alibaba Trojan:Win32/Injector.a27672e2
K7GW Trojan ( 004990741 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZexaF.34690.YmKfaikBAmlb
F-Prot W32/Occamy.T.gen!Eldorado
Symantec Trojan.Gen
ESET-NOD32 Win32/Injector.BBYK
APEX Malicious
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Malware.Razy-6782239-0
GData Trojan.GenericKD.36883953
Kaspersky Trojan.Win32.Blamon.clu
BitDefender Trojan.GenericKD.36883953
NANO-Antivirus Riskware.Win32.Adw.drhzfg
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.lpZC
Tencent Malware.Win32.Gencirc.10b3a639
Ad-Aware Trojan.GenericKD.36883953
Sophos Mal/Generic-S
Comodo TrojWare.Win32.TrojanSpy.Banker.OV@6e1pyh
Baidu Win32.Trojan.Injector.jm
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_FRS.0NA103HU19
Emsisoft Trojan.GenericKD.36883953 (B)
SentinelOne Static AI - Malicious PE
Cyren W32/Occamy.T.gen!Eldorado
Jiangmin TrojanDropper.Injector.ayzp
Avira TR/Dropper.Gen
Antiy-AVL Trojan/Generic.ASMalwS.105B32B
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Win32.Agent.vb!s2
Arcabit Trojan.Generic.D232CDF1
ViRobot Trojan.Win32.Z.Injector.825856.D
ZoneAlarm Trojan.Win32.Blamon.clu
Microsoft PWS:MSIL/Mintluks
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Injector.C1871649
VBA32 BScope.Trojan.MulDrop