Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 8, 2021, 9:02 a.m.	Sept. 8, 2021, 9:04 a.m.

Size	180.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`010394a473e77f7d72f63507b383f05c`
SHA256	`32d76f1f822f9b6b25f0e5444f67abda433f2830016f2c96b5b4a55f462ed810`
CRC32	`BB3387A5`
ssdeep	`3072:/xI3EIFJlAkpn/lEEIJUCA0h5sQGupkHzZdirw/uYd/Z9:0FJlAk9lEEIJUC7iWcp`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file IsPE32 - (no description)

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 8, 2021, 9:02 a.m.		1	1	0

resource name

CUSTOM

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 8, 2021, 9:02 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 8, 2021, 9:02 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74013000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 8, 2021, 9:02 a.m.	process_identifier: 1608 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 8, 2021, 9:02 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00510000 process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x00024000', u'virtual_address': u'0x00001000', u'entropy': 7.086690693596991, u'name': u'.text', u'virtual_size': u'0x00023834'}

entropy

7.0866906936

description

A section with a high entropy has been found

entropy

0.818181818182

description

Overall entropy of this PE file is high

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!010394A473E7
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_70% (W)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
FireEye	Generic.mg.010394a473e77f7d
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
SentinelOne	Static AI - Malicious PE
BitDefenderTheta	Gen:NN.ZevbaF.34126.lm0@a8UmLddi
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

kvi.exe