popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

c808d765c682f1c26f06e0891b803750.exe

Cobalt Strike Darkside Ransomware Admin Tool (Sysinternals etc ...) Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 12, 2021, 2:44 p.m. Sept. 12, 2021, 3 p.m.
Size 740.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c808d765c682f1c26f06e0891b803750
SHA256 24d277d8c080aadf18227eca5e5a18b247466e4e53fcc975a7894e8af6717ae2
CRC32 C2860905
ssdeep 12288:JNsis2a0gbMqzIFO46Xj6mmqpRnZAYtIRzHlhxxTz8lvecTCUBW:nsVdbXNj6gnKUIRr19gvecmUBW
PDB Path C:\guwama.pdb
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\guwama.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 499712
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0027e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 896
region_size: 856064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04480000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0007ae00', u'virtual_address': u'0x00027000', u'entropy': 7.987834164319252, u'name': u'.data', u'virtual_size': u'0x02783a1c'} entropy 7.98783416432 description A section with a high entropy has been found
entropy 0.664638269101 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Chapak.4!c
FireEye Generic.mg.c808d765c682f1c2
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZexaF.34142.UuW@ay4ozHgO
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Kryptik.HMKW
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:DropperX-gen [Drp]
Rising Trojan.Kryptik!1.D975 (CLASSIC)
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Dropper.bc
Ikarus Trojan.Win32.Azorult
eGambit Unsafe.AI_Score_52%
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.MalPE.C4630413
Acronis suspicious
McAfee Artemis!C808D765C682
VBA32 BScope.Trojan.Wacatac
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet Malicious_Behavior.SB
AVG Win32:DropperX-gen [Drp]
Cybereason malicious.c146fe