popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

watchdog.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 5, 2021, 10:40 a.m. Nov. 5, 2021, 10:43 a.m.
Size 2.0MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5 e0a50c60a85bfbb9ecf45bff0239aaa3
SHA256 fc8d064e05ebe37d661aeccb78f91085845e9e28ccff1f9b08fd373830e38b7f
CRC32 4BF2375D
ssdeep 49152:1+yuly+dcYwIx9qadRmAYBfo9hazz2Du5VDyn:1Cy+qa9qWmAYBQfazzpDy
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 2021/11/05 10:40:55 failed to install service: set service version: The system cannot find the file specified.
console_handle: 0x0000000b
1 1 0
packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
file C:\Windows\windefender.exe
file C:\Windows\windefender.exe
section {u'size_of_data': u'0x00201000', u'virtual_address': u'0x002d8000', u'entropy': 7.879904978379114, u'name': u'UPX1', u'virtual_size': u'0x00201000'} entropy 7.87990497838 description A section with a high entropy has been found
entropy 0.999756394641 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
file C:\Windows\windefender.exe
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x0018fe3d
function_name: wine_get_version
module: ntdll
module_address: 0x772b0000
3221225785 0

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x0018fe3d
function_name: wine_get_version
module: ntdll
module_address: 0x772b0000
3221225785 0
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Agent.b!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37878877
CAT-QuickHeal TrojanDropper.Agent
ALYac Trojan.Glupteba.gen
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005775601 )
Alibaba TrojanDropper:Win32/RanumBot.0c12f55f
K7GW Trojan ( 005775601 )
Arcabit Trojan.Generic
Cyren W32/RanumBot.P.gen!Eldorado
ESET-NOD32 a variant of WinGo/RanumBot.AM
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan-Dropper.Win32.Agent.tetsyj
BitDefender Trojan.GenericKD.37878877
Avast Win32:Trojan-gen
Tencent Win32.Trojan-dropper.Agent.Ajbh
Ad-Aware Trojan.GenericKD.37878877
Sophos Generic ML PUA (PUA)
Comodo Malware@#3ddqd6gop855p
TrendMicro TROJ_GEN.R049C0WJI21
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
FireEye Generic.mg.e0a50c60a85bfbb9
Emsisoft Trojan.GenericKD.37878877 (B)
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.MSIL.culd
Webroot W32.Trojan.Gen
Avira TR/Crypt.XPACK.eocey
Antiy-AVL Trojan/Generic.ASBOL.C687
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Malware.Win32.GenericMC.cc
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Trojan.GenericKD.37878877
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Sabsik.C4714301
McAfee Artemis!E0A50C60A85B
MAX malware (ai score=88)
VBA32 TrojanDropper.Agent
Malwarebytes Trojan.Ranumbot
TrendMicro-HouseCall TROJ_GEN.R049C0WJI21
Ikarus Trojan.WinGo.Ranumbot
Fortinet W32/RanumBot.V!tr
BitDefenderTheta Gen:NN.ZexaF.34266.aoGfae2TXep
AVG Win32:Trojan-gen
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.300983.susgen