popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rw001ext.exe

Generic Malware UPX Malicious Library PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 21, 2023, 10:09 a.m. March 21, 2023, 10:17 a.m.
Size 6.9MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 0ad8d4cffac5f713a2ef3b2c72a84e29
SHA256 d1bd5a14d886e71aa5855ce74c84aa7cefa1f782e32cd2140c3a10d91084105d
CRC32 AB39C828
ssdeep 196608:HUNWu+zM+o+OVv8ZTN4OPF4pzR1X7/kBV5DEp:0gOiZT1F4/1/si
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Generic_Malware_Zero - Generic Malware
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
CrowdStrike win/malicious_confidence_60% (W)
ESET-NOD32 a variant of Win32/Injector.ESUM
Paloalto generic.ml
Avast FileRepMalware
DrWeb Program.Unwanted.5405
McAfee-GW-Edition Artemis!Trojan
Microsoft Trojan:Win32/Casdet!rfn
AVG FileRepMalware
section {u'size_of_data': u'0x00530400', u'virtual_address': u'0x00141000', u'entropy': 7.750734335472162, u'name': u'.rdata', u'virtual_size': u'0x0053028c'} entropy 7.75073433547 description A section with a high entropy has been found
entropy 0.758079474923 description Overall entropy of this PE file is high