popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

relvo.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 18, 2021, 7:59 a.m. June 18, 2021, 8:05 a.m.
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3f891f4ea01741d664416c3b34f64208
SHA256 dd1dea95bf17e3f135d2740e87d8b9f08ccf347e4ff832b9e747f775017ff346
CRC32 50E37596
ssdeep 24576:uscqzDohX1lerbtv1acwAyXIrt2go5pvxM+Yy5X1IVeY27:u4YhQbttyA1r3o5ZxNX1IVeY
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name S2
resource name SS
name S2 language LANG_RUSSIAN filetype data sublanguage SUBLANG_ARABIC_SYRIA offset 0x0005db54 size 0x000186a0
name SS language LANG_RUSSIAN filetype data sublanguage SUBLANG_ARABIC_SYRIA offset 0x000761f4 size 0x00091d1a
section {u'size_of_data': u'0x000af800', u'virtual_address': u'0x0005d000', u'entropy': 7.208748286569005, u'name': u'.rsrc', u'virtual_size': u'0x000af800'} entropy 7.20874828657 description A section with a high entropy has been found
entropy 0.668889947594 description Overall entropy of this PE file is high
host 172.217.25.14
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37118746
ALYac Trojan.GenericKD.46502573
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Chapak.5013d3e7
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Trojan.Generic.D236631A
Cyren W32/Trojan.QYRU-8833
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Spy.Raccoon.A
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky Trojan.Win32.Chapak.ezrb
BitDefender Trojan.GenericKD.37118746
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.37118746
Emsisoft Trojan.GenericKD.37118746 (B)
Comodo TrojWare.Win32.UMal.idswt@0
McAfee-GW-Edition BehavesLike.Win32.DealPly.tc
FireEye Generic.mg.3f891f4ea01741d6
Sophos Mal/Generic-S
Ikarus Trojan.WinGo.Netbounce
Avira TR/AD.StellarStealer.cznhv
eGambit Unsafe.AI_Score_97%
MAX malware (ai score=100)
Kingsoft Win32.Troj.Chapak.ez.(kcloud)
Microsoft Trojan:Win32/Bunitucrypt.RTA!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm Trojan.Win32.Chapak.ezrb
GData Trojan.GenericKD.37118746
Cynet Malicious (score: 100)
McAfee Artemis!3F891F4EA017
VBA32 BScope.Trojan.Chapak
Malwarebytes Spyware.RaccoonStealer
Rising Trojan.Generic@ML.83 (RDML:cOetzjTltT0FO8eXffJ/GA)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.PALLAS.H
BitDefenderTheta Gen:NN.ZelphiF.34744.bHW@aCNQfcpI
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.f831c6
Panda Trj/CI.A