Summary | ZeroBOX

reestr.exe

PE32 PE File
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 5, 2021, 8:52 a.m. Sept. 5, 2021, 9:03 a.m.
Size 31.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e369a4ae59ce3b82b5ed8054f0597341
SHA256 560d1e1c846bb66402c793a3e44991b637d82d1ce3ef6c89e443b9b2602b6e3b
CRC32 F58946C9
ssdeep 768:zqsy0fTaccrlrZZ6pi1kBl1ckdLuBph9S8t5Azi:usy8TcRrZZ6EkBlCFV9SG
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section {u'size_of_data': u'0x00007a00', u'virtual_address': u'0x00001000', u'entropy': 7.830518001709398, u'name': u'.text', u'virtual_size': u'0x00007911'} entropy 7.83051800171 description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LdrGetDllHandle

module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ser.Razy.7042
McAfee Artemis!E369A4AE59CE
Cylance Unsafe
CrowdStrike win/malicious_confidence_100% (D)
K7GW Trojan ( 00536d121 )
K7AntiVirus Trojan ( 00536d121 )
Arcabit Trojan.Ser.Razy.D1B82
ESET-NOD32 a variant of Win32/Smokeloader.J
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Ser.Razy.7042
Ad-Aware Gen:Variant.Ser.Razy.7042
Sophos ML/PE-A + Mal/Behav-204
F-Secure Trojan.TR/Crypt.XPACK.Gen
VIPRE Trojan.Win32.Winwebsec.m (v)
McAfee-GW-Edition BehavesLike.Win32.VirRansom.nc
FireEye Generic.mg.e369a4ae59ce3b82
Emsisoft Gen:Variant.Ser.Razy.7042 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Crypt.XPACK.Gen
MAX malware (ai score=82)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Ser.Razy.7042
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Smokeldr.C3129113
Acronis suspicious
VBA32 BScope.TrojanPSW.Spy
ALYac Gen:Variant.Ser.Razy.7042
Malwarebytes Malware.Heuristic.1004
Rising Trojan.Generic@ML.100 (RDML:4k6vv/Hyh/52VtHyOmO3Jg)
eGambit Unsafe.AI_Score_100%
BitDefenderTheta AI:Packer.DB63FFA21E
Cybereason malicious.e59ce3
MaxSecure Trojan.Malware.300983.susgen