popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

s.exe

Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 15, 2023, 12:04 p.m. March 15, 2023, 12:07 p.m.
Size 187.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5aed2df2d2d32d11c3b0c5b50b3ba279
SHA256 998d5a48c323a1050e3fb0848703fb3f14a970a70bbff59f02fb59ed16d5d724
CRC32 DD9E1618
ssdeep 3072:vVU2Nhs8A/IE33pL9OgYWMDWOnhvf0YPGP:PNhs8CHpLsgODWOnl0Ym
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name COCUSONO
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002bc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00013400', u'virtual_address': u'0x0000d000', u'entropy': 7.858122732338592, u'name': u'.data', u'virtual_size': u'0x00090984'} entropy 7.85812273234 description A section with a high entropy has been found
entropy 0.412868632708 description Overall entropy of this PE file is high
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Avast CrypterX-gen [Trj]
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Lockbit.ch
Trapmine malicious.high.ml.score
FireEye Generic.mg.5aed2df2d2d32d11
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Google Detected
MAX malware (ai score=81)
Cylance unsafe
Rising Trojan.Generic@AI.100 (RDML:DjSjwEWEyPcLzmxDQ1MwsQ)
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Malware.300983.susgen
AVG CrypterX-gen [Trj]