popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nscvhost.exe

Generic Malware Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 24, 2021, 5:04 p.m. Sept. 24, 2021, 5:08 p.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 341e63d0f0934ba186bd27a5e43ede35
SHA256 0cbc99017336a7e835494b822f84821254a78b0ae7dea476ed98bca861b1936b
CRC32 56289A86
ssdeep 24576:vDM1/AEuX8yyzgNBGLaKgiq6x1LLDdjLYetXxE:y1uXcgGLaKghG1n5jkQXxE
PDB Path C:\mujipefako.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\mujipefako.pdb
resource name BIR
resource name HOXOVIGUBUPUWILUSI
resource name MAZAYAJOFEXE
resource name PEBEGOFELUGIMIVIXOZOXITACAPILEN
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2972
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 978944
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e50000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2972
region_size: 1073152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000efe00', u'virtual_address': u'0x00023000', u'entropy': 7.997199302877785, u'name': u'.data', u'virtual_size': u'0x0283420c'} entropy 7.99719930288 description A section with a high entropy has been found
entropy 0.815554611135 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.341e63d0f0934ba1
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Cybereason malicious.723680
Symantec ML.Attribute.HighConfidence
APEX Malicious
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Ikarus Trojan.Win32.Crypt
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!341E63D0F093
VBA32 Malware-Cryptor.Azorult.gen
Rising Trojan.Generic@ML.98 (RDML:TA5Uahl+XE63ljPj9uZgSg)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
BitDefenderTheta Gen:NN.ZexaF.34170.jz0@amu6mlkO
CrowdStrike win/malicious_confidence_90% (W)