Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 9, 2021, 9:48 a.m.	Sept. 9, 2021, 9:55 a.m.

Size	281.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cbdd7e3ccea8e6cfae0dddf8fe6f6599`
SHA256	`349d8acfa7f788d6c886016688df9857ee7a915f7690871231c8ca39a5bf2948`
CRC32	`3FC7F77F`
ssdeep	`6144:SU34+HN5h87kcCYjPKs16qiAi6DyHhBkMmvsg:j4+H7h87kcCYjFIT6DEg`
PDB Path	C:\rosihugayegasi.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

pdb_path

C:\rosihugayegasi.pdb

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 9, 2021, 9:48 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002fe000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 9, 2021, 9:48 a.m.	process_identifier: 2648 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x00011000', u'virtual_address': u'0x0002a000', u'entropy': 7.741031873525825, u'name': u'.data', u'virtual_size': u'0x02719b88'}

entropy

7.74103187353

description

A section with a high entropy has been found

entropy

0.242424242424

description

Overall entropy of this PE file is high

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.cbdd7e3ccea8e6cf
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.34142.rqW@a06WqefO
Cyren	W32/Kryptik.EYC.gen!Eldorado
APEX	Malicious
Kaspersky	VHO:Exploit.Win32.Convagent.gen
Sophos	ML/PE-A
SentinelOne	Static AI - Suspicious PE
Microsoft	Trojan:Win32/Sabsik.FL.A!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
Malwarebytes	Trojan.MalPack.GS
Rising	Trojan.Generic@ML.92 (RDML:X0+zDvf/MAF5HoyZ2O4rHw)
Ikarus	Trojan.Win32.Glupteba
eGambit	Unsafe.AI_Score_90%
Cybereason	malicious.224f00
MaxSecure	Trojan.Malware.300983.susgen

clip.exe