popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

file4.exe

Malicious Library UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 25, 2021, 10:56 a.m. July 25, 2021, 11:14 a.m.
Size 338.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 f3cf8f5fb6694a2facf07326cc1df2ce
SHA256 ec4d2c37d638ce4e6ae1053a1429e40cd5ad55c4821dc4959ddc09b9c6d06ffc
CRC32 0334E376
ssdeep 6144:CPmWEG5XNQbKfBIJKsjnwd4PMBPAnpQx5AH:CPmoXK+GJxjnw6MBPAi
PDB Path C:\mabozod.pdb
Yara
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\mabozod.pdb
resource name SEJUWUSIZABUTUXAKAYUPIGIGEYOKAHA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1412
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 139264
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a2c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1412
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name SEJUWUSIZABUTUXAKAYUPIGIGEYOKAHA language LANG_SERBIAN filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x004bb430 size 0x000008bd
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x004baf50 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004bda28 size 0x0000014a
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004bda28 size 0x0000014a
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004bbd28 size 0x00000010
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004bbd28 size 0x00000010
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004ae358 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004ae358 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004ae358 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004ae358 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x004ae358 size 0x00000068
section {u'size_of_data': u'0x0002fa00', u'virtual_address': u'0x00001000', u'entropy': 7.786138433790015, u'name': u'.text', u'virtual_size': u'0x0002f9e6'} entropy 7.78613843379 description A section with a high entropy has been found
entropy 0.56528189911 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
FireEye Generic.mg.f3cf8f5fb6694a2f
McAfee Artemis!F3CF8F5FB669
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0049f6ae1 )
Alibaba Ransom:Win32/GandCrab.b8856b7c
K7GW Riskware ( 0049f6ae1 )
Symantec Packed.Generic.525
ESET-NOD32 a variant of Win32/GenKryptik.FHWZ
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:DropperX-gen [Drp]
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Ikarus Trojan-Spy.MSIL.Agent
Webroot W32.Trojan.Gen
Microsoft Trojan:Win32/Azorult!ml
Acronis suspicious
Malwarebytes Trojan.MalPack.GS
Rising Trojan.Kryptik!1.D82C (CLASSIC)
SentinelOne Static AI - Malicious PE
Fortinet W32/GenKryptik.ERHN!tr
AVG Win32:DropperX-gen [Drp]
Panda Trj/Genetic.gen
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Win32/Heur.Generic.HwoCzicA