popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

server.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 10:57 p.m. June 24, 2021, 11:48 p.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3702ad7cc7ea7c7333c67896a78ec921
SHA256 68a0604d6a5338e5e76380dd45cf06469db18baad72f83675623ba4bccd2bd29
CRC32 99C6CF93
ssdeep 24576:tMsvlcRdvYjnhQrs2kI7wP37P+BgXSPJ5KIbH4SQ2ZGG:tFvlAiyok8P7+0IJwIDYG
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73cc2000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_PORTUGUESE filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00081724 size 0x000010a8
name RT_GROUP_ICON language LANG_PORTUGUESE filetype data sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x002258ec size 0x00000014
name RT_MANIFEST language LANG_PORTUGUESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_PORTUGUESE_BRAZILIAN offset 0x00225900 size 0x00000169