popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nok.exe

Generic Malware UPX MSOffice File PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 14, 2021, 3:58 p.m. Sept. 14, 2021, 4 p.m.
Size 6.2MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 5930b25610cc3ebdc2543cf8a1bf1906
SHA256 df567fbec321a3828643118c5b8f28e9ca7a70d416be9463d267389ec80595ca
CRC32 5E3468B5
ssdeep 98304:Djv+PGv4y17elko0DU9hsiEsn1cHmyY1/b4Kwz1ua/Ea4UFikLPr1:f+xy17elBcU9hf1ywJkKwrc+iG
Yara
  • UPX_Zero - UPX packed file
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
file C:\Users\test22\AppData\Roaming\WindowsDefender\WindowsDefender.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\eventvwr.msc
parameters:
filepath: C:\Windows\System32\eventvwr.msc
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000124
process_name: mobsync.exe
process_identifier: 2060
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000124
process_name: pw.exe
process_identifier: 1552
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000124
process_name: nok.exe
process_identifier: 2216
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000124
process_name: WindowsDefender.exe
process_identifier: 2696
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000124
process_name:
process_identifier: 13596974
0 0
Elastic malicious (high confidence)
Cylance Unsafe
ESET-NOD32 a variant of WinGo/Agent.AG
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky not-a-virus:VHO:NetTool.Win32.TorTool.gen
McAfee-GW-Edition BehavesLike.Win64.Trickbot.vc
Avira HEUR/AGEN.1141600
MaxSecure Trojan.Malware.300983.susgen
section {u'size_of_data': u'0x0063be00', u'virtual_address': u'0x00b99000', u'entropy': 7.894060106566324, u'name': u'UPX1', u'virtual_size': u'0x0063c000'} entropy 7.89406010657 description A section with a high entropy has been found
entropy 0.999843370663 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
file C:\Users\test22\AppData\Roaming\WindowsDefender\WindowsDefender.exe