popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

reestr.exe

Malicious Packer PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 7, 2021, 11:20 a.m. Sept. 7, 2021, 11:20 a.m.
Size 31.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e369a4ae59ce3b82b5ed8054f0597341
SHA256 560d1e1c846bb66402c793a3e44991b637d82d1ce3ef6c89e443b9b2602b6e3b
CRC32 F58946C9
ssdeep 768:zqsy0fTaccrlrZZ6pi1kBl1ckdLuBph9S8t5Azi:usy8TcRrZZ6EkBlCFV9SG
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section {u'size_of_data': u'0x00007a00', u'virtual_address': u'0x00001000', u'entropy': 7.830518001709398, u'name': u'.text', u'virtual_size': u'0x00007911'} entropy 7.83051800171 description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ser.Razy.7042
ALYac Gen:Variant.Ser.Razy.7042
Cylance Unsafe
K7AntiVirus Trojan ( 00536d121 )
Alibaba Trojan:Win32/Smokeloader.e994aa1f
K7GW Trojan ( 00536d121 )
Cybereason malicious.e59ce3
Arcabit Trojan.Ser.Razy.D1B82
ESET-NOD32 a variant of Win32/Smokeloader.J
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Ser.Razy.7042
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Generic.Airp
Ad-Aware Gen:Variant.Ser.Razy.7042
Sophos Mal/Generic-R + Mal/Behav-204
F-Secure Trojan.TR/Crypt.XPACK.Gen
VIPRE Trojan.Win32.Winwebsec.m (v)
McAfee-GW-Edition BehavesLike.Win32.VirRansom.nc
FireEye Generic.mg.e369a4ae59ce3b82
Emsisoft Gen:Variant.Ser.Razy.7042 (B)
Ikarus Trojan.Win32.SmokeLoader
Avira TR/Crypt.XPACK.Gen
Kingsoft Win32.Heur.KVMH008.a.(kcloud)
Gridinsoft Malware.Win32.GenericMC.cc
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Ser.Razy.7042
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Smokeldr.C3129113
Acronis suspicious
McAfee RDN/Generic PWS.y
MAX malware (ai score=82)
VBA32 BScope.TrojanPSW.Spy
Malwarebytes Trojan.Agent
Rising Trojan.Generic@ML.100 (RDMK:sZoKbcwB8LNt2M7TN0pUzw)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_100%
Fortinet W32/Smokeloader.J!tr
BitDefenderTheta AI:Packer.DB63FFA21E
AVG Win32:Trojan-gen
Panda Generic Suspicious
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.300983.susgen