popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

7870_1636781441_9630.exe

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 14, 2021, 6:08 p.m. Nov. 14, 2021, 6:29 p.m.
Size 168.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d985b4cfdceecc3c0fe4f3e4fda4e416
SHA256 a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
CRC32 BFE3F77F
ssdeep 3072:X7UuBgLClgxDRXr8FszykHszuubqbgLt0ODpZa9uD6Vdyhkd:2LClgxDVwq4r4gRVwVf
PDB Path C:\wojumacaburamo2-nigahe74\dilon22\gaxa.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\wojumacaburamo2-nigahe74\dilon22\gaxa.pdb
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2296
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2296
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00015c00', u'virtual_address': u'0x00001000', u'entropy': 7.4159862566690675, u'name': u'.text', u'virtual_size': u'0x00015aa0'} entropy 7.41598625667 description A section with a high entropy has been found
entropy 0.520958083832 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.47398019
FireEye Generic.mg.d985b4cfdceecc3c
McAfee Lockbit-FSWW!D985B4CFDCEE
Malwarebytes Trojan.MalPack.GS
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Kryptik.199edc5d
K7GW Trojan ( 0058a5d91 )
K7AntiVirus Trojan ( 0058a5d91 )
Cyren W32/Kryptik.FOQ.gen!Eldorado
ESET-NOD32 a variant of Win32/Kryptik.HNHS
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Packed.Fragtor-9908420-0
BitDefender Trojan.GenericKD.47398019
Rising Trojan.Generic@ML.96 (RDML:PBn+Xk+pWpxG/xVVbIIZow)
Ad-Aware Trojan.GenericKD.47398019
Sophos Mal/Generic-R
DrWeb Trojan.DownLoader43.63787
Emsisoft Trojan.GenericKD.47398019 (B)
Paloalto generic.ml
Webroot W32.Trojan.Gen
Avira TR/Crypt.Agent.bxidk
Kingsoft Win32.Troj.Undef.(kcloud)
Arcabit Trojan.Generic.D2D33C83
Cynet Malicious (score: 100)
AhnLab-V3 CoinMiner/Win.Glupteba.R449923
Acronis suspicious
ALYac Trojan.GenericKDZ.80058
VBA32 Malware-Cryptor.2LA.gen
TrendMicro-HouseCall TROJ_GEN.R002C0WKD21
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.FOQ!tr
AVG Win32:TrojanX-gen [Trj]
Panda Trj/GdSda.A