popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ctrlxPWVtmxJrb.exe

Generic Malware Malicious Packer PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 17, 2021, 2:28 p.m. June 17, 2021, 2:30 p.m.
Size 1.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 66f348f54eb3cf9d2fc3a91058bf3bb8
SHA256 61b36c03b131bf1dac4d6ddf392b9ebd48a0d6c723abb9119c308dd22b5432db
CRC32 8E070766
ssdeep 24576:rcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQeA:YCpn8t74iA3qb6W8cU4F
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d72000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 86016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1108
region_size: 67108864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03a80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13727797248
free_bytes_available: 13727797248
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003b0000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0000b000', u'virtual_address': u'0x0017b000', u'entropy': 7.791727051734966, u'name': u'.rsrc', u'virtual_size': u'0x0000a658'} entropy 7.79172705173 description A section with a high entropy has been found
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Siggen6.55368
MicroWorld-eScan Trojan.Agent.DXTX
FireEye Generic.mg.66f348f54eb3cf9d
McAfee DistTrack!66F348F54EB3
Cylance Unsafe
SUPERAntiSpyware Trojan.Agent/Gen-PonyStealer
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00502b1a1 )
Alibaba Trojan:Win32/VBKrypt.32c
K7GW Trojan ( 00502b1a1 )
Cybereason malicious.54eb3c
BitDefenderTheta Gen:NN.ZevbaF.34738.Gn0@amlC54iO
Cyren W32/Injector.YKAB-2853
Symantec W32.Tapin
ESET-NOD32 Win32/AutoRun.Delf.LV
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Packed.Ponystealer-6733035-0
Kaspersky Trojan.Win32.VBKrypt.xupa
BitDefender Trojan.Agent.DXTX
NANO-Antivirus Trojan.Win32.VBKrypt.ewdbrj
Paloalto generic.ml
AegisLab Trojan.Win32.VBKrypt.tqRV
Ad-Aware Trojan.Agent.DXTX
TACHYON Trojan/W32.VB-VBKrypt.1576960.B
Emsisoft Trojan.Agent.DXTX (B)
Comodo TrojWare.Win32.Fareit.RGY@7qlz41
Zillya Trojan.VBKrypt.Win32.302131
TrendMicro TSPY_HPFAREIT.SME
McAfee-GW-Edition BehavesLike.Win32.DistTrack.tm
Sophos Mal/Generic-R + Mal/FareitVB-I
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.VBKrypt.cgtc
Avira HEUR/AGEN.1126331
Antiy-AVL Trojan/Generic.ASMalwS.23994B5
Microsoft VirTool:Win32/VBInject.YA!MTB
Gridinsoft Trojan.Win32.Kryptik.ka!s1
ViRobot Trojan.Win32.Agent.1576960.B
GData Win32.Trojan.Injector.T46SVF
Cynet Malicious (score: 100)
AhnLab-V3 Win-Trojan/VBKrypt.RP.X1764
Acronis suspicious
VBA32 Trojan.VBKrypt
ALYac Trojan.Agent.DXTX
MAX malware (ai score=87)
Malwarebytes Qbot.Backdoor.Stealer.DDS
Zoner Trojan.Win32.82457
TrendMicro-HouseCall TSPY_HPFAREIT.SME