popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

faster4upusa.exe

PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 6, 2021, 8:14 a.m. Sept. 6, 2021, 8:20 a.m.
Size 589.9KB
Type MS-DOS executable, MZ for MS-DOS
MD5 9eff1fa203474d2c90d490415fd380c9
SHA256 df135888390b1095d03f34e73f600e51f27a338503b99794507749340dac7518
CRC32 AB5C3545
ssdeep 12288:a7iuUvUF2Jx92MoBFJ+Vy2S7Y/BQdx3LpYV/Fd9:a7iuUveDJ+V/S8ZOx7pKNd9
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77210895
stacktrace+0x84 memdup-0x1af @ 0x74420470
hook_in_monitor+0x45 lde-0x133 @ 0x744142ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x74433603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd6e3243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd6e31fb
faster4upusa+0xc1ab7 @ 0x1400c1ab7
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76e42ef0
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff
0x13afff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x77210895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 4388408
registers.rsi: 5370003456
registers.r10: 0
registers.rbx: 1994665712
registers.rsp: 4390664
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 4389752
registers.r12: 0
registers.rbp: 0
registers.rdi: 5368709487
registers.rax: 4388088
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00063400', u'virtual_address': u'0x00001000', u'entropy': 7.999529557850438, u'name': u'.MPRESS1', u'virtual_size': u'0x0013c000'} entropy 7.99952955785 description A section with a high entropy has been found
entropy 0.685073339085 description Overall entropy of this PE file is high