popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

BalomaKeaft.exe

VMProtect PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 2, 2021, 9:15 a.m. July 2, 2021, 9:19 a.m.
Size 5.4MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 c0de5b33ab30d3257451f2aff84d4e51
SHA256 5ac7fc154a948a26d0b7469dda7495f712cb15d055692e6cd989c07c92fee9f7
CRC32 E83485E2
ssdeep 98304:BhAvjJHXMQtJPpe7gM9vJR4YWUH1NUzqRYzczRBV7XYRhhY812kCU3ItR:BhQJHXMQvPWzLR4YfH1NEAY49BBeY814
Yara
  • IsPE32 - (no description)
  • VMProtect_Zero - VMProtect packed file
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .vmp0
section .vmp1
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1896
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00360000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_CHINESE filetype PGP symmetric key encrypted data - Plaintext or unencrypted data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008da0a0 size 0x0000018c
section {u'size_of_data': u'0x0056ca00', u'virtual_address': u'0x0036c000', u'entropy': 7.952973181095118, u'name': u'.vmp1', u'virtual_size': u'0x0056c9c0'} entropy 7.9529731811 description A section with a high entropy has been found
entropy 0.999460188934 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.524488
Qihoo-360 Win32/Trojan.Gofot.HgIASXMA
ALYac Gen:Variant.Bulz.524488
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 7000001c1 )
Alibaba Trojan:Win32/Gofot.1cb8de4b
K7GW Trojan ( 7000001c1 )
Cybereason malicious.3ab30d
BitDefenderTheta Gen:NN.ZexaF.34770.@F0@aiYfI1ej
Cyren W32/Trojan.ACMF-4583
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan.Win32.Gofot.pcw
BitDefender Gen:Variant.Bulz.524488
AegisLab Trojan.Win32.Gofot.4!c
Avast Win32:Malware-gen
Rising Trojan.Generic@ML.93 (RDML:61evESLAVBOadQ1jZN0D/w)
Ad-Aware Gen:Variant.Bulz.524488
Emsisoft Gen:Variant.Bulz.524488 (B)
TrendMicro TROJ_GEN.R049C0RFS21
McAfee-GW-Edition BehavesLike.Win32.Trojan.tc
FireEye Generic.mg.c0de5b33ab30d325
Sophos Mal/Generic-R + Mal/VMProtBad-A
GData Gen:Variant.Bulz.524488
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
ZoneAlarm Trojan.Win32.Gofot.pcw
Microsoft Trojan:Win32/Tnega!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.C4530249
McAfee Artemis!C0DE5B33AB30
MAX malware (ai score=82)
VBA32 TScope.Malware-Cryptor.SB
Cylance Unsafe
TrendMicro-HouseCall TROJ_GEN.R049C0RFS21
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/VMProtBad.A
AVG Win32:Malware-gen
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_100% (W)