popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

game-installer.torrent.exe

Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 19, 2022, 11:15 a.m. May 19, 2022, 11:27 a.m.
Size 392.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 15de4c1a25c5466f420f48738f10dc29
SHA256 c30d60761ed35693c686d0909060d14e5f08f4c072c424511a11bfeea491cb6a
CRC32 BF47489E
ssdeep 12288:fEYFiXD59MDO6mqbJhnT5v6w3tXL0/JGZV:fboXymql5Vvf3tqE
PDB Path C:\xamanateb\kof\celukav koverena_77\dop\co.pdb
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
121.254.136.57 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\xamanateb\kof\celukav koverena_77\dop\co.pdb
resource name MIMELA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2324
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 172032
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00620000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2324
region_size: 225280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0002a600', u'virtual_address': u'0x00029000', u'entropy': 7.951583813697821, u'name': u'.data', u'virtual_size': u'0x000695c8'} entropy 7.9515838137 description A section with a high entropy has been found
entropy 0.433503836317 description Overall entropy of this PE file is high
host 121.254.136.57
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Stealer.l!c
tehtris Generic.Malware
MicroWorld-eScan Trojan.GenericKD.48942640
McAfee RDN/Generic.tfr
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
Alibaba Ransom:Win32/StopCrypt.9055ff39
K7GW Riskware ( 00584baa1 )
Cybereason malicious.1011c0
Cyren W32/Kryptik.GKO.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HPLK
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Filerepmalware-9947507-0
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Trojan.GenericKD.48942640
Avast Win32:AceCrypter-W [Cryp]
Tencent Win32.Trojan-spy.Stealer.Dzuk
Ad-Aware Trojan.GenericKD.48942640
TACHYON Trojan-Spy/W32.InfoStealer.401408.E
Sophos ML/PE-A + Troj/Krypt-FV
DrWeb Trojan.DownLoader44.58078
Zillya Trojan.Kryptik.Win32.3750410
TrendMicro TrojanSpy.Win32.REDLINE.YXCEOZ
McAfee-GW-Edition BehavesLike.Win32.Worm.fc
FireEye Generic.mg.15de4c1a25c5466f
Emsisoft Trojan.GenericKD.48942640 (B)
Ikarus Trojan-Ransom.StopCrypt
GData Win32.Trojan.PSE.1EY5IPD
Jiangmin TrojanSpy.Stealer.ucs
Webroot W32.Trojan.Gen
Avira TR/AD.GenSHCode.blrby
Gridinsoft Ransom.Win32.STOP.sa
Arcabit Trojan.Generic.D2EACE30
Microsoft Ransom:Win32/StopCrypt.PBL!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.MalPE.R488463
VBA32 Trojan.Sabsik
ALYac Trojan.GenericKD.48942640
MAX malware (ai score=88)
Malwarebytes Trojan.MalPack.GS
TrendMicro-HouseCall TrojanSpy.Win32.REDLINE.YXCEOZ
Rising Backdoor.Mokes!8.619 (CLOUD)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Packed.GEE!tr