popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ds.exe

Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 29, 2021, 10:06 a.m. Sept. 29, 2021, 10:17 a.m.
Size 117.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1d29d6cd39010976adcb9fcba517f3bc
SHA256 c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec
CRC32 9FB1198E
ssdeep 1536:KWNxxYnM24WxbpPxwGOFJBszdNoyNA2kjh3uJp+Q7Jgz70xWAcfz:KqYsWY2zduyNA2kxqfPxjcfz
PDB Path C:\vikofoyad_voguwoka\bowu\razu_tog\98 kifu42\kavuyuxayu\y.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.67.188.154 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\vikofoyad_voguwoka\bowu\razu_tog\98 kifu42\kavuyuxayu\y.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0065c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2088
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_STRING language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000a34c8 size 0x00000424
name RT_ACCELERATOR language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000a32f8 size 0x00000020
name RT_ACCELERATOR language LANG_SAAMI filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x000a32f8 size 0x00000020
section {u'size_of_data': u'0x0000d600', u'virtual_address': u'0x00001000', u'entropy': 7.391362939953981, u'name': u'.text', u'virtual_size': u'0x0000d4a0'} entropy 7.39136293995 description A section with a high entropy has been found
entropy 0.459227467811 description Overall entropy of this PE file is high
host 172.67.188.154
Lionic Trojan.Win32.Convagent.m!c
Elastic malicious (high confidence)
FireEye Generic.mg.1d29d6cd39010976
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (W)
BitDefenderTheta Gen:NN.ZexaF.34170.hq0@ae@PnUdO
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HMQC
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast FileRepMalware
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Emotet.ch
Emsisoft Trojan.Crypt (A)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Racealer.Q!MTB
Acronis suspicious
McAfee Packed-GDT!1D29D6CD3901
Malwarebytes MachineLearning/Anomalous.95%
TrendMicro-HouseCall TROJ_GEN.R002H0CIR21
Rising Trojan.Kryptik!1.D9C1 (CLASSIC)
eGambit Unsafe.AI_Score_96%
Fortinet W32/Kryptik.HMPX!tr
AVG FileRepMalware