popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ipfile.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 10, 2021, 6:01 p.m. Nov. 10, 2021, 6:03 p.m.
Size 501.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1629965aff3a7f0a6f815053fcd32755
SHA256 0c02263e82d0885e9562dc4445f462fe2896b44f63808ca51ce0ef4ef15c75f9
CRC32 1118E7CD
ssdeep 12288:g63oe/I4JvIUiOcZzVIBFxIe9DpDeO2t0BunnbtN:xZ/I4JgUivzVo/DKt0KbtN
PDB Path C:\gadaboke62\dikitidala81\bajakusamovoc_hividali-rerakuro\dis.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\gadaboke62\dikitidala81\bajakusamovoc_hividali-rerakuro\dis.pdb
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2324
region_size: 323584
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2324
region_size: 585728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_ICON language LANG_LATVIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00082ef0 size 0x00000468
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x00076310 size 0x0000004c
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x00076310 size 0x0000004c
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x00076310 size 0x0000004c
name RT_GROUP_ICON language LANG_LATVIAN filetype data sublanguage SUBLANG_DEFAULT offset 0x00076310 size 0x0000004c
section {u'size_of_data': u'0x0005be00', u'virtual_address': u'0x00001000', u'entropy': 7.945830681281753, u'name': u'.text', u'virtual_size': u'0x0005bcf0'} entropy 7.94583068128 description A section with a high entropy has been found
entropy 0.741675075681 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.31421
FireEye Generic.mg.1629965aff3a7f0a
Cylance Unsafe
Cyren W32/Kryptik.FOQ.gen!Eldorado
Symantec Packed.Generic.528
ESET-NOD32 a variant of Win32/GenCBL.BCO
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:DangerousSig [Trj]
Sophos ML/PE-A
Emsisoft MalCert-S.ML (A)
Ikarus Trojan-Ransom.StopCrypt
Microsoft Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3 Trojan/Win.MalPe.R449286
McAfee Artemis!1629965AFF3A
VBA32 Malware-Cryptor.2LA.gen
Malwarebytes Trojan.MalPack.GS
APEX Malicious
Rising Trojan.Generic@ML.82 (RDML:rO2mz8mj3q+AZVEArNdn8A)
SentinelOne Static AI - Malicious PE
AVG Win32:DangerousSig [Trj]