popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

assignment2.exe

Gen1 Generic Malware UPX Malicious Library Malicious Packer Anti_VM PE64 PE File OS Processor Check ZIP Format DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 13, 2023, 3:22 a.m. March 13, 2023, 3:22 a.m.
Size 11.1MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 28f81fad984a66e7078ffa11a1000d0d
SHA256 45395baba9c6357668204056cf6bb84b02561032af99fac7a2da807b142393ca
CRC32 82A8608A
ssdeep 196608:2pB2jchX5P7zj9AKm6gUU8gBk6cICteEroXxnwNE+sKsXXg6J41EOLksBs1jXUz3:jq3GH6YkDInEroXssKkXg6J4SzgqoN1
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-synch-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-filesystem-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-memory-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-convert-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-util-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-datetime-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\ucrtbase.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-math-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-libraryloader-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-handle-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-stdio-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-sysinfo-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-string-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l2-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-rtlsupport-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-profile-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-heap-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-errorhandling-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processthreads-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processenvironment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-utility-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-runtime-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-localization-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-debug-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-locale-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\python310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\pywintypes310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\pythoncom310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-timezone-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-conio-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\python3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-namedpipe-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-environment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processthreads-l1-1-1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-string-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-synch-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-heap-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-time-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-process-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-interlocked-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-console-l1-1-0.dll
Alibaba Trojan:Win32/Almi_Agent.f
CrowdStrike win/malicious_confidence_70% (D)
APEX Malicious
McAfee-GW-Edition BehavesLike.Win64.Backdoor.wc
Gridinsoft Ransom.Win64.Wacatac.sa
Microsoft Program:Win32/Wacapew.C!ml
TrendMicro-HouseCall TROJ_GEN.R002H01BL23
section {u'size_of_data': u'0x0000f200', u'virtual_address': u'0x0004b000', u'entropy': 7.356228328729334, u'name': u'.rsrc', u'virtual_size': u'0x0000f004'} entropy 7.35622832873 description A section with a high entropy has been found
entropy 0.212280701754 description Overall entropy of this PE file is high