popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pub3.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 29, 2021, 9:05 a.m. Oct. 29, 2021, 9:14 a.m.
Size 341.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dc0d13a11537c91ee0436e1cdaaef2ed
SHA256 5a981120d186267256661c1e7a8f473be7eb285d09b0e77efb0223ea5eee2889
CRC32 FEE07847
ssdeep 6144:vxUb00E/kklj2yS0q851Be9Cbvze+grFm6aA5SQ:vWs5R7SB9CbvzpgraAY
PDB Path C:\gogiweluxiyita20\puwebu\haya\canoguy\36-jagusijogi-jobocu puhu.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\gogiweluxiyita20\puwebu\haya\canoguy\36-jagusijogi-jobocu puhu.pdb
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 69632
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02cfe000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2948
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0003cc00', u'virtual_address': u'0x00001000', u'entropy': 6.991390797954228, u'name': u'.text', u'virtual_size': u'0x0003caec'} entropy 6.99139079795 description A section with a high entropy has been found
entropy 0.714705882353 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Jaik.48956
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Cybereason malicious.bfaf87
Arcabit Trojan.Jaik.DBF3C
Cyren W32/Kryptik.FPK.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender Gen:Variant.Jaik.48956
Ad-Aware Gen:Variant.Jaik.48956
Sophos ML/PE-A + Troj/Krypt-DY
Baidu Win32.Trojan.Kryptik.jm
FireEye Generic.mg.dc0d13a11537c91e
Emsisoft Gen:Variant.Jaik.48956 (B)
Ikarus Trojan-Spy.Agent
eGambit Unsafe.AI_Score_95%
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Gen:Variant.Jaik.48956
Cynet Malicious (score: 100)
Acronis suspicious
MAX malware (ai score=82)
Malwarebytes Trojan.MalPack.GS
Rising Malware.Heuristic!ET#86% (RDMK:cmRtazq3k3XQnH/KbtHnmz7ITSSW)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
CrowdStrike win/malicious_confidence_90% (W)