popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1012.exe

WinRAR OS Processor Check GIF Format PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 7:25 p.m. June 24, 2021, 8:09 p.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cb6be429e44c8ccf5da692250f76358a
SHA256 7f929f0938bca9f62d0e002b519f9930bdb05857108126154cb40efd0112fc15
CRC32 4A2069D7
ssdeep 24576:U2G/nvxW3Ww0tr9xaOcJXT0IGF7jY3wZ1OBR6XOG5dSHDdoTGRV:UbA30DaOcT0z7IW1yefGuTwV
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728c2000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 0
free_bytes_available: 13720481792
root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer
total_number_of_bytes: 0
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13721468928
free_bytes_available: 13721468928
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\Desktop\Conquer Down Under.lnk
file C:\Users\test22\Desktop\Conquer Down Under.lnk
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46507303
ALYac Trojan.GenericKD.46507303
Zillya Trojan.ScriptKD.JS.10
Sangfor Trojan.Win32.GenericKD.46507303
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Generic.72283605
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_60% (W)
APEX Malicious
Avast Win32:Malware-gen
BitDefender Trojan.GenericKD.46507303
Ad-Aware Trojan.GenericKD.46507303
Sophos Generic ML PUA (PUA)
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
FireEye Generic.mg.cb6be429e44c8ccf
Emsisoft Trojan.GenericKD.46507303 (B)
Microsoft Program:Win32/Uwamson.A!ml
Arcabit Trojan.Generic.D2C5A527
GData Trojan.GenericKD.46507303
Cynet Malicious (score: 100)
McAfee Artemis!CB6BE429E44C
Malwarebytes Malware.AI.1666531520
TrendMicro-HouseCall TROJ_GEN.R011H09FK21
MAX malware (ai score=85)
AVG Win32:Malware-gen
Panda Trj/CI.A