popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rere.exe

UPX PWS OS Processor Check PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 19, 2021, 5:51 p.m. July 19, 2021, 5:54 p.m.
Size 1.2MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 734b3fcc06d0a0eda6b83de9165636ac
SHA256 13d8429d500e20be8588f250449f70a6e8f8f34df9423b2897fd33bbb8712c5f
CRC32 AEF9CDB4
ssdeep 24576:gHd6lUVuUP3ElxHDu1lD4XtAGIHB+g7lpynB:gHdLug3EHHAkXKfB3vS
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Win32_PWS_Loki_Zero - Win32 PWS Loki

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .00cfg
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000735bc000
process_handle: 0xffffffffffffffff
1 0 0
Cyren W64/Trojan.LFYS-7213
Antiy-AVL Trojan/Generic.ASMalwS.335A0EF
Malwarebytes Trojan.Rozena
section {u'size_of_data': u'0x00053800', u'virtual_address': u'0x000e6000', u'entropy': 7.821187563754582, u'name': u'.rsrc', u'virtual_size': u'0x00053798'} entropy 7.82118756375 description A section with a high entropy has been found
entropy 0.27276439363 description Overall entropy of this PE file is high