popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

index.php

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 3, 2021, 9:25 a.m. Nov. 3, 2021, 9:49 a.m.
Size 610.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 76f8db098c44eb289d6e98bb973219d5
SHA256 8d8deecbe3d8f0a3cb2c18762105966621373d7aa021bdf3bb0664cf8b593f68
CRC32 D5152B8A
ssdeep 12288:nQ1EUk+ao4HgkoXGdxnxKuTmvUp1Y3y7/XxudMu2MhUA2Z1xcm4:Qio4vxK1vKyyjXcMZi
PDB Path C:\yuyuka\cozu\zucemahasika.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\yuyuka\cozu\zucemahasika.pdb
section .lodipi
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2764
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 397312
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a5e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 438272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0008c400', u'virtual_address': u'0x00001000', u'entropy': 7.7321631051388025, u'name': u'.text', u'virtual_size': u'0x0008c300'} entropy 7.73216310514 description A section with a high entropy has been found
entropy 0.920426579163 description Overall entropy of this PE file is high