popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 29, 2023, 5:33 p.m. March 29, 2023, 5:44 p.m.
Size 610.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 05d614ae9941dc597f918230c0938d11
SHA256 069823eb52c902e7e4c80cb0ad2395d38eb0f98d1de05d6d054b20149f9bf556
CRC32 30ECAC90
ssdeep 6144:BVPLGN8jlL7aYv2hQOrRpvSmy68IcScoVCNohy/2eyLZxSeFVSt4DoQqdqsZ5WVs:PVLGu2hQMRYmb8I03oI/8Xn0d/K4f9
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section _RDATA
name RT_ICON language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x0009c5c8 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x0009c5c8 size 0x000010a8
name RT_GROUP_ICON language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x0009d670 size 0x00000022
name RT_VERSION language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x0009d698 size 0x000002f4
CrowdStrike win/malicious_confidence_90% (W)
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition Artemis!Trojan
Trapmine suspicious.low.ml.score
FireEye Generic.mg.05d614ae9941dc59
ZoneAlarm UDS:DangerousObject.Multi.Generic
McAfee Artemis!05D614AE9941
section {u'size_of_data': u'0x00031a00', u'virtual_address': u'0x00063000', u'entropy': 6.952108843986761, u'name': u'.data', u'virtual_size': u'0x00033c0c'} entropy 6.95210884399 description A section with a high entropy has been found
entropy 0.325676784249 description Overall entropy of this PE file is high