popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sefile.exe

Cobalt Strike Darkside Ransomware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 13, 2021, 11:11 a.m. Nov. 13, 2021, 11:18 a.m.
Size 451.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e05a1928cd4ad6e8ffd8258bf653670b
SHA256 0f8e043385e5b08919a340fdf4d1178e7e8c9c2a6272bda0710e47468b0656c3
CRC32 62335BF9
ssdeep 12288:zLMvCZsSClU95RL4zhsN6wohblWZcGJ2:zLN2Soq5RLohw/F66
PDB Path C:\hij\jusujodewexegu-dimi.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\hij\jusujodewexegu-dimi.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 176128
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00056a00', u'virtual_address': u'0x00001000', u'entropy': 7.440753313486823, u'name': u'.text', u'virtual_size': u'0x00056966'} entropy 7.44075331349 description A section with a high entropy has been found
entropy 0.77 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
FireEye Generic.mg.e05a1928cd4ad6e8
Cylance Unsafe
Cybereason malicious.bea988
Cyren W32/Kryptik.FSC.gen!Eldorado
Symantec Packed.Generic.620
Kaspersky UDS:Trojan-Spy.Win32.Stealer.gen
Sophos ML/PE-A + Troj/Krypt-DY
Baidu Win32.Trojan.Kryptik.jm
Ikarus Trojan.Win32.Azorult
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Acronis suspicious
Malwarebytes Trojan.MalPack.GS
APEX Malicious
Rising Malware.Heuristic!ET#90% (RDMK:cmRtazppjpupT5vzmNCPwr2BvvYN)
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_96%
CrowdStrike win/malicious_confidence_80% (D)
MaxSecure Trojan.Malware.300983.susgen