popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sufile.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 12, 2021, 9:13 a.m. Aug. 12, 2021, 9:27 a.m.
Size 487.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5cde664f12547b26f2f59237c49b9acf
SHA256 9f3805a821c12122b67395c50e390d35c70e83d5b82a6e5741e56c0087960a60
CRC32 D57D44B8
ssdeep 12288:zSttX3l7WdYcDh2ZSvE3By5IciAiENqeKmukJnym:Gbnl7WdvTi1iAmRy
PDB Path C:\puje\89\wup24\dag_vewuhezotanan\reyaye.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\puje\89\wup24\dag_vewuhezotanan\reyaye.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d5a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1760
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00300000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526218 size 0x00000468
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x00526680 size 0x0000005a
section {u'size_of_data': u'0x0003b600', u'virtual_address': u'0x00034000', u'entropy': 7.949248949462728, u'name': u'.data', u'virtual_size': u'0x004eefe8'} entropy 7.94924894946 description A section with a high entropy has been found
entropy 0.488683127572 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.5cde664f12547b26
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.f45729
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Generic.gc
Ikarus Trojan.Win32.Crypt
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Artemis!5CDE664F1254
Rising Trojan.Kryptik!1.C6FC (CLASSIC)
SentinelOne Static AI - Suspicious PE
eGambit Unsafe.AI_Score_98%
BitDefenderTheta Gen:NN.ZexaF.34058.EuW@aSkYwDgH
Qihoo-360 HEUR/QVM10.1.341B.Malware.Gen
CrowdStrike win/malicious_confidence_100% (D)
MaxSecure Trojan.Malware.300983.susgen