popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

app.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 2, 2021, 4:11 p.m. July 2, 2021, 4:13 p.m.
Size 4.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0d73057e0fd6162523e71e00fa093ea7
SHA256 1ec59ef98051b6098ad1ad689eb8ae6c9f2423fc4f58ace048aa1f9b29dea11f
CRC32 AE96626D
ssdeep 98304:uwtQiPoxVb6drlD/nP04tApoA+w4G1DKqiHzn2FxRICGj:uwtQVxZ6vDnMfpoA+wRKQn6nj
PDB Path C:\bifas\vizidirefumoh\rasuv\vejitanixig.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\bifas\vizidirefumoh\rasuv\vejitanixig.pdb
resource name DAXEGAJOBAREHOKEZOPUKE
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4440064
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b00000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 232
region_size: 9592832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name DAXEGAJOBAREHOKEZOPUKE language LANG_SERBIAN filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x043eead0 size 0x00000685
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x043ee628 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x043ee628 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x043ee628 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x043ee628 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x043f1c20 size 0x00000292
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x043f1c20 size 0x00000292
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x043ef158 size 0x00000008
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x043eea90 size 0x0000003e
section {u'size_of_data': u'0x0044b800', u'virtual_address': u'0x00001000', u'entropy': 7.998972043691967, u'name': u'.text', u'virtual_size': u'0x0044b690'} entropy 7.99897204369 description A section with a high entropy has been found
entropy 0.978094073168 description Overall entropy of this PE file is high
host 172.217.25.14
Elastic malicious (high confidence)
FireEye Generic.mg.0d73057e0fd61625
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.2be2ce
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast FileRepMalware
McAfee-GW-Edition Artemis!Trojan
Sophos Troj/Kryptik-YY
Microsoft Trojan:Win32/Wacatac.B!ml
Gridinsoft Trojan.Gen.dd!c
Cynet Malicious (score: 100)
McAfee Artemis!0D73057E0FD6
Malwarebytes Trojan.MalPack.GS
Rising Trojan.Generic@ML.90 (RDML:h2rvN60e75QNeRjGJZJAvw)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
AVG FileRepMalware