popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

Generic Malware PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 6, 2021, 9:58 a.m. July 6, 2021, 10 a.m.
Size 515.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 03b05d8cc99932a1a6e476927be4e70a
SHA256 ef9e7a24f9c512ed4ea4d194b4c25398b85f0458fa7b1224d6108e0845d8c5d2
CRC32 D9932CFF
ssdeep 12288:lfGBwJKPjWbG7fFxI9SteBSBG6DOIjfsi:lOaoqyJxI9TYBx5
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
185.215.113.32 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.32:4000 -> 192.168.56.101:49202 2400025 ET DROP Spamhaus DROP Listed Traffic Inbound group 26 Misc Attack

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
resource name None
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13728092160
free_bytes_available: 13728092160
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000128
filepath: C:\Windows\Tasks\wow64.job
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Windows\Tasks\wow64.job
create_options: 100 (FILE_NON_DIRECTORY_FILE|FILE_SEQUENTIAL_ONLY|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 5 (FILE_SHARE_READ|FILE_SHARE_DELETE)
1 0 0
host 185.215.113.32
file C:\Windows\Tasks\wow64.job
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Bsymem.4!c
MicroWorld-eScan Trojan.GenericKD.46578267
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0057c8d41 )
Alibaba Trojan:Win32/Injector.eb3711cb
K7GW Trojan ( 0057c8d41 )
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EPIZ
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Generic-9875799-0
Kaspersky HEUR:Trojan.Win32.Bsymem.gen
BitDefender Trojan.GenericKD.46578267
Avast Win32:MalwareX-gen [Trj]
Tencent Win32.Trojan.Bsymem.Fhw
Ad-Aware Trojan.GenericKD.46578267
Sophos Mal/Generic-S
DrWeb Trojan.DownLoader40.26566
TrendMicro TROJ_GEN.R002C0DG521
McAfee-GW-Edition BehavesLike.Win32.Worm.hh
FireEye Generic.mg.03b05d8cc99932a1
Emsisoft Trojan.Injector (A)
SentinelOne Static AI - Malicious PE
Avira TR/Injector.anqje
MAX malware (ai score=87)
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Win32/Bunitucrypt.RTA!MTB
GData Win32.Trojan.BSE.1G1WENW
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Qbot.C4542384
McAfee GenericRXAA-AA!03B05D8CC999
VBA32 BScope.Trojan.Scar
Malwarebytes Malware.AI.4255186162
TrendMicro-HouseCall TROJ_GEN.R002C0DG521
Rising Trojan.Generic@ML.80 (RDML:qfDad7TmDLok08Pi3/KzKw)
Ikarus Trojan.Win32.Injector
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Injector.EPIZ!tr
BitDefenderTheta Gen:NN.ZelphiF.34790.GGW@ay91i1bi
AVG Win32:MalwareX-gen [Trj]
Panda Trj/GdSda.A
Qihoo-360 Win32/Trojan.Bsymem.HgIASX0A