popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sefile.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2021, 9:29 a.m. Aug. 12, 2021, 9:31 a.m.
Size 388.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9008fe6b62bc7b920591cf8cb77d6f85
SHA256 a7d3eb2d7b7efef08b2fa839a08c94249f51e53edf64a443c6c66a47b220c68c
CRC32 07EAE0FA
ssdeep 6144:ZUbRSrxYjmI6sFTppewQnaFOe9OtXZ6sj6JamMndZExTV3ZdDryDcZ6lM:ySrmXXFNEtaF7+ZICdZChZdDWDcZ5
PDB Path C:\zotat_pihigikebidug_goranuz82_tukow\87\sogu82.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\zotat_pihigikebidug_goranuz82_tukow\87\sogu82.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 139264
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009ca000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e218 size 0x00000468
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0050e680 size 0x0000005a
section {u'size_of_data': u'0x00022a00', u'virtual_address': u'0x00034000', u'entropy': 7.890620360056609, u'name': u'.data', u'virtual_size': u'0x004d6468'} entropy 7.89062036006 description A section with a high entropy has been found
entropy 0.357881136951 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.9008fe6b62bc7b92
McAfee Artemis!9008FE6B62BC
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Rising Trojan.Kryptik!1.C6FC (CLASSIC)
McAfee-GW-Edition BehavesLike.Win32.MultiPlug.fh
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_98%
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34058.yuW@a8DN6viH
Ikarus Trojan.Win32.Crypt
Cybereason malicious.4ab7c6
Qihoo-360 HEUR/QVM10.1.34CF.Malware.Gen