popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Talking-Points-with-China-PLAAF.exe

PhysicalDrive Generic Malware UPX ASPack Malicious Library Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 22, 2023, 9:16 a.m. Feb. 22, 2023, 9:30 a.m.
Size 2.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d51e8ebb04a5849f46514dcaef7f4c32
SHA256 3a573796b5e6f1cc3a92eef7e268fa4e74aeddf34f5dd62f7b02109fe560ecd2
CRC32 820988EF
ssdeep 12288:3iSHMv8y+XQcA6AJPe+kDuOlwflEzQBxfQPoQaM010P4AiwlUpq+C3AXwvYzcOFG:3K+XQcA6Z7vglEE1Qv3qUTQLwurLM
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • OS_Processor_Check_Zero - OS Processor Check
  • Generic_Malware_Zero - Generic Malware
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • PhysicalDrive_20181001 - (no description)
  • ASPack_Zero - ASPack packed file
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section {u'size_of_data': u'0x00077a00', u'virtual_address': u'0x00019000', u'entropy': 7.991375654681285, u'name': u'.data', u'virtual_size': u'0x0007bc14'} entropy 7.99137565468 description A section with a high entropy has been found
entropy 0.227154046997 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000090
filepath: \??\PhysicalDrive0
desired_access: 0x00100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 0 (FILE_SUPERSEDED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

DeviceIoControl

 input_buffer:
control_code: 458752 (IOCTL_DISK_GET_DRIVE_GEOMETRY)
device_handle: 0x00000090
output_buffer: Q ÿ?
1 1 0
MicroWorld-eScan Trojan.GenericKD.65602383
FireEye Trojan.GenericKD.65602383
Malwarebytes Backdoor.Remcos
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Agent.AFAK
APEX Malicious
BitDefender Trojan.GenericKD.65602383
Emsisoft Trojan.GenericKD.65602383 (B)
McAfee-GW-Edition Artemis!Trojan
Microsoft VirTool:Win32/Sysdupate.M!MTB
Gridinsoft Trojan.Win32.Remcos.bot
Xcitium TrojWare.Win32.TrojanDownloader.Onkods.Q@52urg7
Arcabit Trojan.Generic.D3E9034F
GData Trojan.GenericKD.65602383
McAfee Artemis!D51E8EBB04A5
MAX malware (ai score=84)
VBA32 BScope.Trojan.Downloader
Cylance Unsafe
Rising Trojan.Agent!8.B1E (CLOUD)
Fortinet W32/Agent.AFAK!tr
CrowdStrike win/malicious_confidence_60% (W)