popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

getfile.php

OS Processor Check PE64 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 10, 2021, 9:30 a.m. June 10, 2021, 9:34 a.m.
Size 200.5KB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 28193ba741232f91101849f606fa8419
SHA256 67e54b44dad909734a59df457950c05727b7ecf387f1f37c38c18cef5af579c2
CRC32 A42757FA
ssdeep 3072:o7tbwam7niPOMFJjOknVCSd/3391UnrWoTmutZ/dyQCK+VBVmICKUizHz2/bf:StbwamK1jlnnV91UrWStFdjaVF2/b
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7feff08a278
TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7feff08b394
SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7feff06e1e2
TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7feff054bcb
TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7feff055cc1
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7feff061ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7feff0580d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7feff0580b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7feff057e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7feff057d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x771eb894
LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x771e4249
RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x771e4180
rundll32+0x302b @ 0xff8d302b
rundll32+0x3b7a @ 0xff8d3b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76e5652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x771ec521

exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39
exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278
exception.instruction: call qword ptr [rax + 0x18]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 303736
exception.address: 0x7feff08a278
registers.r14: 0
registers.r15: 0
registers.rcx: 44938208
registers.rsi: 0
registers.r10: 1
registers.rbx: 0
registers.rsp: 720304
registers.r11: 0
registers.r8: 718688
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1955324712
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00012400', u'virtual_address': u'0x0001a000', u'entropy': 6.86296170503174, u'name': u'.rdata', u'virtual_size': u'0x000122ea'} entropy 6.86296170503 description A section with a high entropy has been found
entropy 0.365914786967 description Overall entropy of this PE file is high
host 172.217.25.14
DrWeb Trojan.Siggen13.54762
MicroWorld-eScan Trojan.GenericKD.46453461
FireEye Generic.mg.28193ba741232f91
ALYac Trojan.GenericKD.46453461
Cylance Unsafe
Sangfor Riskware.Win32.Wacapew.C
CrowdStrike win/malicious_confidence_90% (W)
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win64/Kryptik.CLJ
Avast Win64:Trojan-gen
BitDefender Trojan.GenericKD.46453461
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.46453461
Emsisoft Trojan.GenericKD.46453461 (B)
Comodo TrojWare.Win32.Agent.bdack@0
McAfee-GW-Edition Artemis!Trojan
Sophos Generic PUA BC (PUA)
Microsoft Program:Win32/Wacapew.C!ml
GData Trojan.GenericKD.46453461
Cynet Malicious (score: 100)
McAfee RDN/BazarLoader
Fortinet W32/PossibleThreat
AVG Win64:Trojan-gen