popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

file.exe

Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 24, 2021, 9:07 a.m. Sept. 24, 2021, 9:20 a.m.
Size 233.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c8aa942d50814189f92ca4a01620b4ed
SHA256 eb9aba41f979b8da5bd42d7e7d248daaa23014db0ad5593bbf4967327cd651ae
CRC32 A06659C5
ssdeep 3072:t6nvzh7T3Oj1tXS80EBuxgztanuqgdbENxHBnmgQLgk52Bb7CRG8e:t6vzh7Tejf74uCqbWH4eB6R
PDB Path C:\napusawovusat\54-guwejuxuv fuxivituzo25 yezamuse-mewo.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\napusawovusat\54-guwejuxuv fuxivituzo25 yezamuse-mewo.pdb
resource name NABINIGEPUFELEHEKEZEZAFUFOGE
resource name WOVUWIZAWASEHIYOZEGEMOW
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 151552
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005cc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1660
region_size: 286720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name NABINIGEPUFELEHEKEZEZAFUFOGE language LANG_SAAMI filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_ARABIC_LIBYA offset 0x000bdcc0 size 0x00000685
name WOVUWIZAWASEHIYOZEGEMOW language LANG_SAAMI filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_ARABIC_LIBYA offset 0x000be348 size 0x00000636
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000c0518 size 0x00000224
name RT_ACCELERATOR language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000be9b8 size 0x00000020
name RT_ACCELERATOR language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000be9b8 size 0x00000020
section {u'size_of_data': u'0x0002c800', u'virtual_address': u'0x00001000', u'entropy': 7.915936599355705, u'name': u'.text', u'virtual_size': u'0x0002c620'} entropy 7.91593659936 description A section with a high entropy has been found
entropy 0.765591397849 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
FireEye Generic.mg.c8aa942d50814189
Malwarebytes Trojan.MalPack
Sangfor Trojan.Win32.Save.a
K7GW Hacktool ( 700007861 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZexaF.34170.oq0@ayfj6wjO
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FLCE
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Emotet.dc
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!C8AA942D5081
VBA32 BScope.Backdoor.Androm
Cylance Unsafe
Panda Trj/Genetic.gen