popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

prof-eth.exe

Malicious Library PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 10, 2021, 8:08 a.m. Nov. 10, 2021, 8:12 a.m.
Size 6.8MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 4151ed1d9fe87cc363b01e33a162395d
SHA256 caaf5afd05109a9523e59ceb6a07d1ba16052b6ea564697c901fe9bc6aba5c86
CRC32 F20ED10D
ssdeep 196608:pxqSvkr/SNYQEwgVgANoIWfYuFudDsMXxMBz:pxq6gSLEZbogAMXxM
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .tty0
section .tty1
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        90 68 e4 8b fa 03 e8 cd c0 0c 00 68 91 a0 fa 83
        

      
        exception.instruction:
        nop
        

      
        exception.module:
        prof-eth.exe
        

      
        exception.exception_code:
        0x80000004
        

      
        exception.offset:
        11045632
        

      
        exception.address:
        0xe88b00
        

      
    
  
    
      
        registers.r14:
        0
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        3735929054
        

      
        registers.rsi:
        0
        

      
        registers.r10:
        -1981460361
        

      
        registers.rbx:
        0
        

      
        registers.rsp:
        1245264
        

      
        registers.r11:
        84
        

      
        registers.r8:
        655420
        

      
        registers.r9:
        43840
        

      
        registers.rdx:
        41
        

      
        registers.r12:
        0
        

      
        registers.rbp:
        1244976
        

      
        registers.rdi:
        0
        

      
        registers.rax:
        496215823
        

      
        registers.r13:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x006c2e00', u'virtual_address': u'0x00516000', u'entropy': 7.940250001522475, u'name': u'.tty1', u'virtual_size': u'0x006c2d60'}
                                        
                                    
                                        
                                            entropy
                                            7.94025000152
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.999855585241
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Lionic
                                    Trojan.Multi.Generic.4!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.8b6fb9
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    Trojan.Gen.2
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win64/Packed.VMProtect.NO
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Paloalto
                                    generic.ml
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    UDS:DangerousObject.Multi.Generic
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    ML/PE-A
                                    
                                


                            

                        

                            

                                

                                    McAfee-GW-Edition
                                    BehavesLike.Win64.Trojan.vc
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.4151ed1d9fe87cc3
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Heur!.02294123
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Sabsik.FL.B!ml
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!4151ED1D9FE8
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Suspicious PE
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Trojan.Malware.300983.susgen
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    Malicious_Behavior.SB