popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

file.exe

Cobalt Strike Darkside Ransomware Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 10, 2021, 9:14 a.m. Sept. 10, 2021, 9:27 a.m.
Size 391.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e74e8f9adb0df482c191aa372d520587
SHA256 9e1d4eeff067d03371c7464e2fe9879deed0633968fc745ec88458ebb198f3f0
CRC32 491C5FE4
ssdeep 6144:iV+ikfIr0kBURxKr4I9CPM2RhgNhuBLGey40LzABHvsA1:dnfIr0kQx6TglquBCey40/ARvs
PDB Path C:\bejewap69\zec\16\xegezizopoyaw\ludugezat29.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\bejewap69\zec\16\xegezizopoyaw\ludugezat29.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 147456
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02fee000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1684
region_size: 258048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00023e00', u'virtual_address': u'0x00026000', u'entropy': 7.916117160349771, u'name': u'.data', u'virtual_size': u'0x0272c99c'} entropy 7.91611716035 description A section with a high entropy has been found
entropy 0.367948717949 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
CAT-QuickHeal Ransom.Stop.Z5
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.56dc79
BitDefenderTheta Gen:NN.ZexaF.34142.yuW@a4xwVtfO
Symantec Packed.Generic.620
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast FileRepMalware
Rising Trojan.Kryptik!1.D975 (CLASSIC)
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Dropper.fh
FireEye Generic.mg.e74e8f9adb0df482
Ikarus Trojan.Win32.Azorult
eGambit Unsafe.AI_Score_97%
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Trojan:Win32/Sabsik.TE.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!E74E8F9ADB0D
VBA32 BScope.Trojan.AET.281105
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG FileRepMalware
CrowdStrike win/malicious_confidence_100% (D)