popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

data.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 22, 2021, 9:02 a.m. Oct. 22, 2021, 9:14 a.m.
Size 284.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e82a74fe0732ee10589a80df730a19a4
SHA256 08652e620baff815f8d1c1b10889d2407da4a79b264925efeeeb90a89070ff80
CRC32 F8205896
ssdeep 6144:anYB2Fzu9L2hHGL7T8dvP701yxyYN0Wpdjg7Fubn:yYBjL8GfcvT9y45pdjV
PDB Path C:\jujus-yakug-dabadu\vejegomupona75\puzisedixa\wosunama1.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\jujus-yakug-dabadu\vejegomupona75\puzisedixa\wosunama1.pdb
resource name XASOBEZEHAMUHEYENEXUT
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00904000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0003b400', u'virtual_address': u'0x00001000', u'entropy': 6.957040859945959, u'name': u'.text', u'virtual_size': u'0x0003b3be'} entropy 6.95704085995 description A section with a high entropy has been found
entropy 0.837455830389 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
FireEye Generic.mg.e82a74fe0732ee10
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
Baidu Win32.Trojan.Kryptik.jm
Symantec ML.Attribute.HighConfidence
APEX Malicious
Rising Trojan.Kryptik!1.D9FE (CLASSIC)
Sophos ML/PE-A
McAfee-GW-Edition Packed-GDT!E82A74FE0732
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
McAfee Packed-GDT!E82A74FE0732
Malwarebytes Trojan.MalPack.GS
Cybereason malicious.a7b19e
MaxSecure Trojan.Malware.300983.susgen