popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

%E9%80%A0%E5%B0%8F%E4%BA%BA.exe

VMProtect Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 2, 2021, 9:09 a.m. Aug. 2, 2021, 9:11 a.m.
Size 2.9MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 21614cd641f1b0564630a4dffe6c54e2
SHA256 eb60897607eb5872e6ed502463d4cdcc888bce8df09352d6708c69d18b3e0005
CRC32 7F857130
ssdeep 49152:TjJbync8SbRnTYSCePIWcQMcdAdGPq1a3EcFdR8GTkCHV/zj8JX6x/Bco7HN:TNOc8mnTqelzC4HXF7NkYrj8t6xKMt
Yara
  • VMProtect_Zero - VMProtect packed file
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
47.96.15.92 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .vmp0
section .vmp1
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73cc2000
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x007420a0 size 0x00010828
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x007528c8 size 0x00000014
section {u'size_of_data': u'0x002ce000', u'virtual_address': u'0x00473000', u'entropy': 7.99238588002946, u'name': u'.vmp1', u'virtual_size': u'0x002cdf80'} entropy 7.99238588003 description A section with a high entropy has been found
entropy 0.977036911039 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
host 47.96.15.92
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ursu.809962
FireEye Generic.mg.21614cd641f1b056
ALYac Gen:Variant.Ursu.809962
Cylance Unsafe
K7AntiVirus Trojan ( 7000001c1 )
K7GW Trojan ( 7000001c1 )
Cybereason malicious.641f1b
ESET-NOD32 a variant of Win32/Packed.VMProtect.AB
APEX Malicious
ClamAV Win.Malware.Vmprotect-6824127-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Ursu.809962
Ad-Aware Gen:Variant.Ursu.809962
Sophos Generic ML PUA (PUA)
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
Emsisoft Gen:Variant.Ursu.809962 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Black.Gen2
Microsoft Trojan:Win32/Tnega!ml
GData Gen:Variant.Ursu.809962
Cynet Malicious (score: 100)
McAfee Packed-GV!21614CD641F1
MAX malware (ai score=85)
VBA32 TScope.Malware-Cryptor.SB
Rising Trojan.Generic@ML.98 (RDML:eEmGNJUlBmVtXjLIv5In6A)
Ikarus Trojan.Win32.VMProtect
MaxSecure Trojan.Malware.300983.susgen
BitDefenderTheta Gen:NN.ZexaF.34050.3YW@aWEn0Bmb
CrowdStrike win/malicious_confidence_80% (D)
Qihoo-360 Win32/Packed.Black.HxMBItIA