popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

e9374bbefcce30c811d2f0091f1886c3.exe

Cobalt Strike Darkside Ransomware Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 11, 2021, 2:58 p.m. Sept. 11, 2021, 3:14 p.m.
Size 739.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e9374bbefcce30c811d2f0091f1886c3
SHA256 fc9ff1351c41668d1e590c1a0cb471743e4e71d82e6011946cfe189c75980b00
CRC32 D1113DA5
ssdeep 12288:OiiM1YOcKlCm+43fZWZKLiaC67+BefHtkXfVWEEZ16GQKOsK2npi8Yd+5V:KM1aKG43QZGJ+qHtcCrQRsK2nxYSV
PDB Path C:\zuvicukudezum\noji\xahi\zexinacukezu_gexixo\lutuz\milu.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\zuvicukudezum\noji\xahi\zexinacukezu_gexixo\lutuz\milu.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 503808
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0300e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 856064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0007b000', u'virtual_address': u'0x00026000', u'entropy': 7.988378348431419, u'name': u'.data', u'virtual_size': u'0x02783c5c'} entropy 7.98837834843 description A section with a high entropy has been found
entropy 0.666215301286 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
CAT-QuickHeal Ransom.Stop.Z5
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7GW Trojan ( 00581f861 )
Cybereason malicious.9c9ec4
BitDefenderTheta Gen:NN.ZexaF.34142.UuW@ayL3jBjO
Symantec Packed.Generic.620
ESET-NOD32 a variant of Win32/Kryptik.HMKH
APEX Malicious
Paloalto generic.ml
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Lockbit.bc
FireEye Generic.mg.e9374bbefcce30c8
Ikarus Trojan.Win32.Azorult
MaxSecure Trojan.Malware.300983.susgen
Microsoft Trojan:Win32/Azorult!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!E9374BBEFCCE
VBA32 BScope.Trojan.AET.281105
Rising Trojan.Kryptik!1.D975 (CLASSIC)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_92%
CrowdStrike win/malicious_confidence_100% (D)