popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pub33.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 5, 2021, 10:41 a.m. Nov. 5, 2021, 11 a.m.
Size 342.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bd1b477a9483e240ef5eef54145a13cd
SHA256 4f55e7e034f8e3b0fd976f6992244c2d30f89e28d50f827ec7517de0ad103898
CRC32 F9605EA5
ssdeep 6144:9hWwxWz6Yo7GBYrpkV59oRQss0aKHDqIk4BaG+7C5ZLS:fRxWCuYrKV59oRQss0aK04Bm
PDB Path C:\tekufa\yibuvogecupefa\kogavijaga.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\tekufa\yibuvogecupefa\kogavijaga.pdb
section .fef
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cfe000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2324
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00040400', u'virtual_address': u'0x00001000', u'entropy': 6.9678238051664305, u'name': u'.text', u'virtual_size': u'0x00040278'} entropy 6.96782380517 description A section with a high entropy has been found
entropy 0.752562225476 description Overall entropy of this PE file is high
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
Cylance Unsafe
Cybereason malicious.436190
Arcabit Trojan.Jaik.DBFA3
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan.Win32.Convagent.gen
BitDefender Gen:Variant.Jaik.49059
MicroWorld-eScan Gen:Variant.Jaik.49059
Ad-Aware Gen:Variant.Jaik.49059
Sophos ML/PE-A
Baidu Win32.Trojan.Kryptik.jm
McAfee-GW-Edition BehavesLike.Win32.Trojan.fh
FireEye Generic.mg.bd1b477a9483e240
Emsisoft Gen:Variant.Jaik.49059 (B)
Ikarus Trojan.Agent
MAX malware (ai score=89)
Microsoft Trojan:Win32/DllCheck.A!MSR
GData Gen:Variant.Jaik.49059
Acronis suspicious
VBA32 BScope.Trojan.Sabsik.FL
ALYac Gen:Variant.Jaik.49059
Malwarebytes Trojan.MalPack.GS
Rising Malware.Heuristic!ET#75% (RDMK:cmRtazqBhBoBI8YlppaNBouHlOlf)
SentinelOne Static AI - Suspicious PE
eGambit Unsafe.AI_Score_95%
CrowdStrike win/malicious_confidence_90% (W)
MaxSecure Trojan.Malware.300983.susgen