popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

AlCapone99.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 21, 2023, 10:04 a.m. March 21, 2023, 10:06 a.m.
Size 261.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 3db6d94b8df4916aa7cb0d67f2bba3f6
SHA256 15b31a3a4ab58991a4e7c7e2cc49fdec1002ea907effb2402b949263dcf0a0bd
CRC32 C8AED405
ssdeep 3072:UvmEID31U40ByUrwJ9Cfo25a1Ts0f1BiAHon3aLOoPTrXkVmPvFPtoHwKqZJxIxB:4m5lUF1wJ9CfoR1TsC1NwQ/emXFiHwKn
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c4c000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0002d400', u'virtual_address': u'0x00011000', u'entropy': 6.983649043506621, u'name': u'.data', u'virtual_size': u'0x0002dffc'} entropy 6.98364904351 description A section with a high entropy has been found
entropy 0.724 description Overall entropy of this PE file is high
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.234085
FireEye Gen:Variant.Fragtor.234085
McAfee Artemis!3DB6D94B8DF4
Cylance unsafe
VIPRE Gen:Variant.Fragtor.234085
Sangfor Trojan.Win32.Kryptik.V8k2
Alibaba Trojan:Win32/Kryptik.1ef7e3c3
Arcabit Trojan.Fragtor.D39265
BitDefenderTheta Gen:NN.ZexaE.36344.qu2@aiIzsQei
Cyren W32/Kryptik.JFM.gen!Eldorado
Symantec Trojan Horse
ESET-NOD32 a variant of Win32/Kryptik.HTCD
Paloalto generic.ml
Cynet Malicious (score: 99)
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Gen:Variant.Fragtor.234085
Avast Win32:CrypterX-gen [Trj]
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.RedLineSteal.otvog
DrWeb Trojan.PWS.Siggen3.28526
TrendMicro TrojanSpy.Win32.REDLINE.YXDCTZ
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.high.ml.score
Emsisoft Gen:Variant.Fragtor.234085 (B)
Ikarus Trojan.Win32.Crypt
Avira TR/AD.RedLineSteal.otvog
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Malware.Win32.RedLine.bot
Xcitium Malware@#w7vshkzta1l
Microsoft Trojan:Win32/Redline.CAC!MTB
ViRobot Trojan.Win.Z.Fragtor.267768.E
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
GData Gen:Variant.Fragtor.234085
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5397075
ALYac Gen:Variant.Fragtor.234085
MAX malware (ai score=83)
Malwarebytes Trojan.Crypt
TrendMicro-HouseCall TrojanSpy.Win32.REDLINE.YXDCTZ
Rising Trojan.Kryptik!8.8 (TFE:5:fK4e4rRai8M)
SentinelOne Static AI - Suspicious PE
Fortinet PossibleThreat.PALLASNET.H
AVG Win32:CrypterX-gen [Trj]