popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

prof-xmr.exe

Malicious Library PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 10, 2021, 8:18 a.m. Nov. 10, 2021, 8:20 a.m.
Size 6.9MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 fea27ec625bc1404776fd452be4d52f9
SHA256 b23fb46fbb5d1d9d97ff697e1666b417e545610b8a5fc17c4e91887a6e007ba7
CRC32 4959A142
ssdeep 98304:ALweZEPQxF425ffUytPje9DOHT1WD7FSAYfyy7cwwLTiSu4Wcq3lYB:WEP4np8yti9SfyyIwwLTiSu4X0lYB
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .ewe0
section .ewe1
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        90 68 de 33 a1 da e8 da 66 13 00 68 33 70 1e 55
        

      
        exception.instruction:
        nop
        

      
        exception.module:
        prof-xmr.exe
        

      
        exception.exception_code:
        0x80000004
        

      
        exception.offset:
        11431130
        

      
        exception.address:
        0xee6cda
        

      
    
  
    
      
        registers.r14:
        0
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        3735929054
        

      
        registers.rsi:
        0
        

      
        registers.r10:
        -1979317952
        

      
        registers.rbx:
        0
        

      
        registers.rsp:
        1245264
        

      
        registers.r11:
        84
        

      
        registers.r8:
        655420
        

      
        registers.r9:
        43840
        

      
        registers.rdx:
        25
        

      
        registers.r12:
        0
        

      
        registers.rbp:
        1244976
        

      
        registers.rdi:
        0
        

      
        registers.rax:
        3094358503
        

      
        registers.r13:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x006f2400', u'virtual_address': u'0x00545000', u'entropy': 7.940800838513496, u'name': u'.ewe1', u'virtual_size': u'0x006f22c0'}
                                        
                                    
                                        
                                            entropy
                                            7.94080083851
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.999859432106
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win64/Packed.VMProtect.NO
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    UDS:DangerousObject.Multi.Generic
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-R
                                    
                                


                            

                        

                            

                                

                                    McAfee-GW-Edition
                                    BehavesLike.Win64.BadFile.vc
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.fea27ec625bc1404
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Suspicious PE
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Heur!.02294123
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Sabsik.TE.B!ml
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.82165a
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Trojan.Malware.300983.susgen