popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mix.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 2, 2021, 12:12 p.m. Nov. 2, 2021, 12:19 p.m.
Size 295.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 863db22615785c834f8ac8ed325404e4
SHA256 e80010838ebfc7d949c7ce73355bf5ee912d03dfe7dfe136746bed711c970a1b
CRC32 E81F72FE
ssdeep 6144:XFqLqsRKblxC3f5l8V2ZX7RKzBSwgFe6mUixCGfQ:XFqLqEKblAvr8wB7RRdhuCGo
PDB Path C:\bofuciwesumure\fucizuxi-zubatepovome-vov\100\jexajawe.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\bofuciwesumure\fucizuxi-zubatepovome-vov\100\jexajawe.pdb
section .kefiwiw
resource name AFX_DIALOG_LAYOUT
resource name None
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 176128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00038a00', u'virtual_address': u'0x00001000', u'entropy': 7.8713856963772795, u'name': u'.text', u'virtual_size': u'0x000388e0'} entropy 7.87138569638 description A section with a high entropy has been found
entropy 0.770408163265 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.863db22615785c83
McAfee Artemis!863DB2261578
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7GW Hacktool ( 700007861 )
Cybereason malicious.a8e13c
BitDefenderTheta Gen:NN.ZexaF.34236.su0@ayBEVcpG
Cyren W32/Kryptik.FOQ.gen!Eldorado
Symantec Packed.Generic.528
ESET-NOD32 a variant of Win32/GenKryptik.FMYB
Kaspersky UDS:Trojan-Spy.Win32.Stealer.gen
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Lockbit.dc
APEX Malicious
eGambit Unsafe.AI_Score_89%
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
VBA32 Malware-Cryptor.2LA.gen
Ikarus Trojan.Win32.Crypt
Rising Malware.Heuristic!ET#93% (RDMK:cmRtazpv7MU59KEC6+AWBOx0Et+i)
SentinelOne Static AI - Malicious PE
CrowdStrike win/malicious_confidence_100% (W)