popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

BattingsTruncate_2021-08-15_17-02.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 16, 2021, 5:05 p.m. Aug. 16, 2021, 5:07 p.m.
Size 279.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ed55b31cd1e8ce41e33d6fc8bd4540b7
SHA256 befa68725fca25ee31ae8e52d2dd67ae3eb3a4073c46bbd260f4f8601050648f
CRC32 9D0C07F8
ssdeep 6144:MoLCZ70tVt7xBd2NCEh5hkMxRvwec/mn:MoWZ70V08G5ym1C
PDB Path C:\mipabumil44\xiwacokaw19_cux.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\mipabumil44\xiwacokaw19_cux.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 139264
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e9d000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1468
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2080 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2bc8 size 0x00000156
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2bc8 size 0x00000156
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2bc8 size 0x00000156
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2bc8 size 0x00000156
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2588 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2588 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2588 size 0x00000028
name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d2588 size 0x00000028
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_ARABIC_ALGERIA offset 0x028d24e8 size 0x00000068
section {u'size_of_data': u'0x0002c800', u'virtual_address': u'0x00001000', u'entropy': 7.875015946018315, u'name': u'.text', u'virtual_size': u'0x0002c680'} entropy 7.87501594602 description A section with a high entropy has been found
entropy 0.640287769784 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky VHO:Backdoor.Win32.Mokes.gen
Rising Trojan.Kryptik!1.B40D (CLASSIC)
TrendMicro Mal_HPGen-50
McAfee-GW-Edition BehavesLike.Win32.Emotet.dc
FireEye Generic.mg.ed55b31cd1e8ce41
Sophos ML/PE-A
Gridinsoft Trojan.Win32.Packed.vl!heur
Microsoft Trojan:Win32/Azorult.RS!MTB
GData Gen:Variant.Jaik.47376
Cynet Malicious (score: 100)
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34058.rq0@aGnKhPaG
VBA32 BScope.Trojan.Eb
TrendMicro-HouseCall Mal_HPGen-50
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_96%
CrowdStrike win/malicious_confidence_100% (D)
Qihoo-360 HEUR/QVM10.1.48F7.Malware.Gen