Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 7, 2021, 5:48 p.m.	June 7, 2021, 5:58 p.m.

Size	496.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`72023ccff6feee079620118b47db8305`
SHA256	`9ab73e4f0c050f09eef0aa397a15e4e136b7b014ffe0e302408802f81e47d8de`
CRC32	`13C95688`
ssdeep	`12288:rmv+OYdynM7lpVof6v60pUP5PgsqKmHfQ:6OyM7ljoiZqF3mHI`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 7, 2021, 5:48 p.m.			0	0

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 7, 2021, 5:48 p.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x0006ae00', u'virtual_address': u'0x0000f000', u'entropy': 7.686196547383099, u'name': u'.data', u'virtual_size': u'0x0006cd9c'}

entropy

7.68619654738

description

A section with a high entropy has been found

entropy

0.862764883956

description

Overall entropy of this PE file is high

host

172.217.25.14

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 003c36381 )
K7GW	Trojan ( 003c36381 )
CrowdStrike	win/malicious_confidence_80% (W)
Cyren	W32/Faker.V.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gc
FireEye	Generic.mg.72023ccff6feee07
Sophos	Generic PUA CC (PUA)
SentinelOne	Static AI - Malicious PE
AegisLab	Riskware.Win32.AdLoad.1!c
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Azorult!ml
Acronis	suspicious
McAfee	Artemis!72023CCFF6FE
Cylance	Unsafe
Rising	Trojan.Kryptik!1.D6EE (CLASSIC)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZexaF.34722.FuW@aOylQbfi
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.340b41

winlog.exe