popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

relvo.exe

Generic Malware Admin Tool (Sysinternals etc ...) Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 18, 2021, 9:43 a.m. June 18, 2021, 9:45 a.m.
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3f891f4ea01741d664416c3b34f64208
SHA256 dd1dea95bf17e3f135d2740e87d8b9f08ccf347e4ff832b9e747f775017ff346
CRC32 50E37596
ssdeep 24576:uscqzDohX1lerbtv1acwAyXIrt2go5pvxM+Yy5X1IVeY27:u4YhQbttyA1r3o5ZxNX1IVeY
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name S2
resource name SS
name S2 language LANG_RUSSIAN filetype data sublanguage SUBLANG_ARABIC_SYRIA offset 0x0005db54 size 0x000186a0
name SS language LANG_RUSSIAN filetype data sublanguage SUBLANG_ARABIC_SYRIA offset 0x000761f4 size 0x00091d1a
section {u'size_of_data': u'0x000af800', u'virtual_address': u'0x0005d000', u'entropy': 7.208748286569005, u'name': u'.rsrc', u'virtual_size': u'0x000af800'} entropy 7.20874828657 description A section with a high entropy has been found
entropy 0.668889947594 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37118746
FireEye Generic.mg.3f891f4ea01741d6
McAfee Artemis!3F891F4EA017
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Chapak.5013d3e7
K7GW Riskware ( 0040eff71 )
Cybereason malicious.f831c6
Arcabit Trojan.Generic.D2C592AD
BitDefenderTheta Gen:NN.ZelphiF.34744.bHW@aCNQfcpI
Cyren W32/Trojan.QYRU-8833
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Spy.Raccoon.A
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky Trojan.Win32.Chapak.ezrb
BitDefender Trojan.GenericKD.37118746
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.37118746
Sophos Mal/Generic-S
Comodo TrojWare.Win32.UMal.idswt@0
McAfee-GW-Edition BehavesLike.Win32.DealPly.tc
Emsisoft Trojan.GenericKD.46502573 (B)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_97%
Avira TR/AD.StellarStealer.cznhv
MAX malware (ai score=100)
Kingsoft Win32.Troj.Chapak.ez.(kcloud)
Microsoft Trojan:Win32/Bunitucrypt.RTA!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm Trojan.Win32.Chapak.ezrb
GData Trojan.GenericKD.37118746
Cynet Malicious (score: 100)
ALYac Trojan.GenericKD.37118746
VBA32 BScope.Trojan.Chapak
Malwarebytes Spyware.RaccoonStealer
Ikarus Trojan-Spy.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat.PALLAS.H
AVG Win32:PWSX-gen [Trj]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_80% (W)