popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

BeatriceServer_packed.img

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 25, 2021, 9:35 a.m. June 25, 2021, 9:43 a.m.
Size 4.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2dddac86aa8164a0428f861ca2afa2e0
SHA256 f9b5ba6fa9a50456ab0a1ce5cce09c507aabaab602db653668ee555d6f9d99ff
CRC32 C195B072
ssdeep 98304:VsGA9TQy6fND1awJzq8E2aTBYebQXkrmgS+6eIZtmhNqdwfLemSI3588a:VsG8Uy61QUzqlikrmgS+6BZteNPp88a
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section ABLrX0M
section 8drfD
section FmyIUj
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 7388
region_size: 1740800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7388
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x01f422e0 size 0x000002c8
section {u'size_of_data': u'0x003bea00', u'virtual_address': u'0x01b84000', u'entropy': 7.9997776754521395, u'name': u'8drfD', u'virtual_size': u'0x003bea00'} entropy 7.99977767545 description A section with a high entropy has been found
entropy 0.880890104331 description Overall entropy of this PE file is high
host 172.217.25.14
Time & API Arguments Status Return Repeated

SetWindowsHookExW

 thread_identifier: 0
callback_function: 0x745dc951
hook_identifier: 14 (WH_MOUSE_LL)
module_address: 0x745d0000
1 68944577 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.386268
ALYac Gen:Variant.Zusy.386268
Cylance Unsafe
VIPRE Trojan.Crypt.Krap (v)
Cybereason malicious.6aa816
BitDefenderTheta Gen:NN.ZexaF.34758.@p0@amwO9joO
Cyren W32/Agent.CYU.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Malware.Zusy-9864465-0
BitDefender Gen:Variant.Zusy.386268
Paloalto generic.ml
Ad-Aware Gen:Variant.Zusy.386268
Emsisoft Gen:Variant.Zusy.386268 (B)
Comodo Packed.Win32.MNSP.Gen@2697wr
McAfee-GW-Edition BehavesLike.Win32.BadFile.rc
FireEye Gen:Variant.Zusy.386268
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Suspicious PE
Avira TR/Crypt.ASPM.Gen
MAX malware (ai score=89)
Microsoft Trojan:Win32/Hynamer.A!ml
Gridinsoft Trojan.Heur!.032524E1
Arcabit Trojan.Zusy.D5E4DC
GData Gen:Variant.Zusy.386268
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Agent.C108865
McAfee Artemis!2DDDAC86AA81
VBA32 TScope.Malware-Cryptor.SB
TrendMicro-HouseCall TROJ_GEN.R06CH0CFJ21
Rising Malware.Heuristic!ET#93% (RDMK:cmRtazqBrJ7zWGBBgyUx2QphxJLE)
Ikarus Worm.Win32.ServStart
Fortinet W32/PossibleThreat
AVG Win32:MalwareX-gen [Trj]
Panda Trj/Genetic.gen
CrowdStrike win/malicious_confidence_80% (W)