popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

WeaponGrand.exe

VMProtect PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 1, 2021, 6:06 p.m. July 1, 2021, 6:09 p.m.
Size 5.4MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 db2f659dc03c430d809eff66e99c42f8
SHA256 b4949bab111ac8d8e02355953e179e395541d5dfcc23682d60efc7499074018f
CRC32 11C46C6B
ssdeep 98304:NFlS9ZuvFerXLR4pHitnG7Nvg/cH7vEoxAC/tewIOjmuCJwmQCQIJb8g:NXogFerF4UtnQvgUbsaAC/cwc5QCQI
Yara
  • IsPE32 - (no description)
  • VMProtect_Zero - VMProtect packed file
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .vmp0
section .vmp1
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_CHINESE filetype PGP symmetric key encrypted data - Plaintext or unencrypted data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008de0a0 size 0x0000018c
section {u'size_of_data': u'0x00570200', u'virtual_address': u'0x0036c000', u'entropy': 7.959180739134619, u'name': u'.vmp1', u'virtual_size': u'0x00570060'} entropy 7.95918073913 description A section with a high entropy has been found
entropy 0.999461545365 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.524488
FireEye Generic.mg.db2f659dc03c430d
CAT-QuickHeal Trojan.Gofot
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 7000001c1 )
BitDefender Gen:Variant.Bulz.524488
K7GW Trojan ( 7000001c1 )
Cybereason malicious.dc03c4
Arcabit Trojan.Bulz.D800C8
BitDefenderTheta Gen:NN.ZexaF.34758.@F0@amxgdgij
Cyren W32/Trojan.LKNO-7208
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.EBRZWEX
APEX Malicious
Paloalto generic.ml
Alibaba Trojan:Win32/Gofot.e4884965
Rising Trojan.Generic@ML.94 (RDMK:okUlmWh58GnN+FTAdcaxmA)
Ad-Aware Gen:Variant.Bulz.524488
Emsisoft Gen:Variant.Bulz.524488 (B)
TrendMicro TROJ_GEN.R002C0RFN21
Sophos Mal/Generic-R + Mal/VMProtBad-A
Ikarus Trojan.Gofot
Jiangmin Trojan.Gofot.bcp
MAX malware (ai score=89)
Antiy-AVL Trojan/Generic.ASMalwS.33A4103
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/Tnega!ml
ZoneAlarm Trojan.Win32.Gofot.pcr
GData Gen:Variant.Bulz.524488
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4530249
VBA32 TScope.Malware-Cryptor.SB
ALYac Gen:Variant.Bulz.524488
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002C0RFN21
Tencent Win32.Trojan.Gofot.Wrgp
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_98%
Fortinet W32/Gofot.PCR!tr
AVG Win32:Malware-gen
Avast Win32:Malware-gen
CrowdStrike win/malicious_confidence_100% (W)