popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

clip64.dll

UPX Admin Tool (Sysinternals etc ...) Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 27, 2023, 10:18 a.m. March 27, 2023, 10:56 a.m.
Size 89.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 104ac57c9dda07fb60fb09f4f2a638f4
SHA256 a442435cae73cad982699e95cf9c91b956dd0c13d16a41a3d28f52bc35e88d0b
CRC32 C0614339
ssdeep 1536:puON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUIZaI89p:puhVZbtvbpxLHoUsYuNhV25LJUIZaI8P
PDB Path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734a4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734a4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73414000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2736
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd1000
process_handle: 0xffffffff
1 0 0
Bkav W32.NataDecoAAT.Trojan
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.GenericPMF.S29595454
ALYac Trojan.Agent.Amadey
Zillya Trojan.Sdum.Win32.9748
Sangfor Trojan.Win32.Amadey.V648
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Gen:Variant.Zusy.446682
K7GW Riskware ( 00584baa1 )
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZedlaF.36344.fu4@aep357li
VirIT Trojan.Win32.Genus.NMA
Cyren W32/Agent.GPBN-4848
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win32/Agent.AFGA
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Agent.gen
Alibaba Trojan:Win32/Amadey.ec9e3f0e
NANO-Antivirus Trojan.Win32.Clipper.juivsg
ViRobot Trojan.Win32.Z.Zusy.91136.G
MicroWorld-eScan Gen:Variant.Zusy.446682
Avast Win32:TrojanX-gen [Trj]
Rising Backdoor.Convagent!8.123DC (CLOUD)
TACHYON Trojan/W32.Agent.91136.ADV
Emsisoft Gen:Variant.Zusy.446682 (B)
VIPRE Gen:Variant.Zusy.446682
TrendMicro TROJ_GEN.R002C0DAH23
McAfee-GW-Edition Trojan-FUUW!104AC57C9DDA
FireEye Gen:Variant.Zusy.446682
Sophos Troj/Amadey-K
GData Gen:Variant.Zusy.446682
Jiangmin Trojan.Agent.ejvu
Avira HEUR/AGEN.1301048
Antiy-AVL Trojan[Backdoor]/Win32.Convagent
Gridinsoft Trojan.Win32.Agent.cl
Arcabit Trojan.Zusy.D6D0DA
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Microsoft Trojan:Win32/Amadey.MA!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5355012
McAfee Artemis!104AC57C9DDA
MAX malware (ai score=83)
VBA32 Trojan.Sdum
TrendMicro-HouseCall TROJ_GEN.R002C0DAH23
Tencent Malware.Win32.Gencirc.10be3141
Yandex Trojan.Agent!L35ilSkswbw
Ikarus Trojan.Win32.Amadey
MaxSecure Trojan.Malware.771626.susgen