popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Nulti.exe

PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 24, 2021, 11:10 p.m. June 24, 2021, 11:20 p.m.
Size 978.0KB
Type MS-DOS executable, MZ for MS-DOS
MD5 9985f01fc09605c9cd959a7564606f2c
SHA256 f587e0f32012fccf9a735edc91cb29d4853a7355d6fa3a1af94f2219884be447
CRC32 B997FDB6
ssdeep 24576:LrGmyRFY+Sg5w4SlFeFSkefIS/WC8uw5p1fncv:WHFsgO4SGFSkeZeC8uj
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77210895
stacktrace+0x84 memdup-0x1af @ 0x72e10470
hook_in_monitor+0x45 lde-0x133 @ 0x72e042ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x72e23603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd6e3243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd6e31fb
nulti+0xc6167 @ 0x1400c6167
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76e42ef0
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff
0x313fff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x77210895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 4388408
registers.rsi: 5371940864
registers.r10: 0
registers.rbx: 1994665712
registers.rsp: 4390664
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 4389752
registers.r12: 0
registers.rbp: 0
registers.rdi: 5368709487
registers.rax: 4388088
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x000e0800', u'virtual_address': u'0x00001000', u'entropy': 7.999781607228168, u'name': u'.MPRESS1', u'virtual_size': u'0x00315000'} entropy 7.99978160723 description A section with a high entropy has been found
entropy 0.918670076726 description Overall entropy of this PE file is high
host 172.217.25.14
MicroWorld-eScan Trojan.GenericKD.37137168
McAfee RDN/Generic.grp
Sangfor Trojan.Win32.GenericKD.37137168
CrowdStrike win/malicious_confidence_60% (W)
Alibaba Trojan:Win32/Generic.2c32ea26
K7GW Trojan ( 0054d8df1 )
K7AntiVirus Trojan ( 0054d8df1 )
ESET-NOD32 Win32/AHK.CU
APEX Malicious
Avast Win64:Trojan-gen
BitDefender Trojan.GenericKD.37137168
Ad-Aware Trojan.GenericKD.37137168
McAfee-GW-Edition BehavesLike.Win64.Injector.dc
FireEye Trojan.GenericKD.37137168
Emsisoft Trojan.GenericKD.37137168 (B)
Ikarus Trojan.Win32.AHK
GData Trojan.GenericKD.37137168
MAX malware (ai score=85)
AegisLab Trojan.Win32.Generic.4!c
Cynet Malicious (score: 100)
Fortinet W32/AHK.CU!tr
AVG Win64:Trojan-gen