popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

index.php

Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 15, 2023, 12:05 p.m. March 15, 2023, 12:15 p.m.
Size 185.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 21741dcd7562d956577d753d43d38830
SHA256 6fcfc6e9c3504129087f399f02026f0857e51702803c00e15c16a98d94414974
CRC32 FBF71C68
ssdeep 3072:GdcWaMfEQNIwYQ21b7G++C0D3qKGmD19RxP:6aMfEACb7AlDD1R
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name COCUSONO
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00012c00', u'virtual_address': u'0x0000d000', u'entropy': 7.856005024870952, u'name': u'.data', u'virtual_size': u'0x000901a4'} entropy 7.85600502487 description A section with a high entropy has been found
entropy 0.406504065041 description Overall entropy of this PE file is high
Elastic malicious (high confidence)
FireEye Generic.mg.21741dcd7562d956
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Backdoor.MSIL.Agent.gen
Avast CrypterX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win32.Lockbit.ch
Trapmine malicious.high.ml.score
Sophos ML/PE-A
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
Cylance unsafe
Rising Trojan.Generic@AI.100 (RDML:EcQJR00yNa+M+P7FuqcCyw)
Ikarus Trojan.Win32.Crypt
MaxSecure Trojan.Malware.300983.susgen
AVG CrypterX-gen [Trj]