popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

7215.exe

Gen1 Malicious Library ASPack UPX Malicious Packer PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 24, 2021, 12:32 p.m. Aug. 24, 2021, 12:36 p.m.
Size 8.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5 aeac57103b3c82c0c09cc0521db58362
SHA256 ade278b6d405437ee6048371f3175f7e9eeb257c6d1f8e6c8612b0316a516f25
CRC32 AA40A958
ssdeep 196608:D1zSWo0hLdTDRwa3VFy0FQzOkGOU47EpHiO:EadTDRd32GQzOIJ7IH/
PDB Path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737d2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73513000
process_handle: 0xffffffff
1 0 0
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000559bc size 0x000001ce
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00056250 size 0x00000052
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcr100d.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Analyst.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Conquer.exe
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcp100d.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\GameData.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\xConquer.exe
file C:\Users\test22\AppData\Local\Temp\Env_DX9\GameShield.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Chat.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcp100.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcr100.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcp100.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\GameShield.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcp100d.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Analyst.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\xConquer.exe
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Conquer.exe
file C:\Users\test22\AppData\Local\Temp\Env_DX9\Chat.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\GameData.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcr100.dll
file C:\Users\test22\AppData\Local\Temp\Env_DX9\msvcr100d.dll
Lionic Virus.Win32.Nimnul.n!c
FireEye Win32.VJadtre.3
McAfee W32/Kudj
Cylance Unsafe
Sangfor Virus.Win32.Nimnul.f
K7AntiVirus Virus ( 0040f7441 )
Alibaba Virus:Win32/Nimnul.f15b5b18
K7GW Virus ( 0040f7441 )
Cybereason malicious.03b3c8
Baidu Win32.Virus.Otwycal.d
Cyren W32/PatchLoad.E
Symantec Trojan.Gen.6
ESET-NOD32 Win32/Wapomi.BA
ClamAV Win.Trojan.Downloader-64720
Kaspersky Virus.Win32.Nimnul.f
BitDefender Win32.VJadtre.3
NANO-Antivirus Trojan.Win32.Banload.cstqaj
Avast Other:Malware-gen [Trj]
Rising Trojan.Generic@ML.88 (RDML:0/fv1yB8CFNfNzB/iJwCSA)
Emsisoft Win32.VJadtre.3 (B)
Comodo Virus.Win32.Wali.KA@558nxg
DrWeb BackDoor.Darkshell.246
Zillya Virus.Nimnul.Win32.5
TrendMicro PE_WAPOMI.BM
McAfee-GW-Edition BehavesLike.Win32.Generic.rc
Sophos Mal/Generic-R + W32/Nimnul-A
Ikarus Trojan-Downloader.Win32.Small
Jiangmin Backdoor.Xtreme.blw
Avira W32/Jadtre.D
Antiy-AVL Trojan/Generic.ASVirus.14D
Gridinsoft Trojan.Win32.CoinMiner.bot!s4
Microsoft Virus:Win32/Mikcer.B
GData Win32.Virus.Wapomi.A
BitDefenderTheta AI:FileInfector.991137D00F
ALYac Win32.VJadtre.3
MAX malware (ai score=81)
VBA32 Virus.Nimnul.19209
Malwarebytes Malware.AI.2431598375
TrendMicro-HouseCall PE_WAPOMI.BM
SentinelOne Static AI - Malicious SFX
MaxSecure Trojan.Malware.3891915.susgen
Fortinet W32/CoinMiner.EC2B!tr
AVG Other:Malware-gen [Trj]