popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rollerkind.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 14, 2021, 9:38 a.m. Aug. 14, 2021, 9:46 a.m.
Size 666.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cde93187ac7d9c6905b6cc747bf339d3
SHA256 dee6f22761c93a7b4db42c9a007975433eeaadf3b0a7720b3b07dec433cd53a6
CRC32 5B744331
ssdeep 12288:WIK/cZ4KdqEZkcylzf+JFtl1yvQMuzEg/+sEyrVrEdYE6QfsqW:WCZ4KpFA6Iir6dSQ0qW
PDB Path C:\guxut96\nicuhukizopod.pdb
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
95.181.155.150 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\guxut96\nicuhukizopod.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 438272
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d89000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2040
region_size: 835584
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00960000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055bb10 size 0x00000468
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055c0f8 size 0x0000005a
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SINGAPORE offset 0x0055c0f8 size 0x0000005a
section {u'size_of_data': u'0x0006bc00', u'virtual_address': u'0x00032000', u'entropy': 7.98110969025153, u'name': u'.data', u'virtual_size': u'0x0051f6c8'} entropy 7.98110969025 description A section with a high entropy has been found
entropy 0.647633358377 description Overall entropy of this PE file is high
host 95.181.155.150
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
FireEye Generic.mg.cde93187ac7d9c69
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
APEX Malicious
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
Sophos ML/PE-A
Ikarus Trojan.Win32.Azorult
MaxSecure Trojan.Malware.300983.susgen
Microsoft Trojan:Win32/Azorult!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Artemis!CDE93187AC7D
Malwarebytes Trojan.Downloader
Rising Malware.Obscure/Heur!1.A89F (CLASSIC)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_99%
Cybereason malicious.a02971
Qihoo-360 HEUR/QVM10.1.400F.Malware.Gen