popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ppp.exe

UPX PE32 PE File .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 29, 2023, 6:08 p.m. March 29, 2023, 6:09 p.m.
Size 273.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a82baff8213bd78f398420e6ed3d58aa
SHA256 e5be75b9889d30d6d369e60f1f870e812443066d84fea72ea6f97b8b3652e495
CRC32 301F7BD4
ssdeep 6144:dgBHDQRYClBdKlwpiKPAn61xMazDPiNZDXcbMbwx1PS:dgBjQuClMPQ+61zzc13bwx1P
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00425000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00427000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00416000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00501000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00417000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00502000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00503000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d8130b
process_handle: 0xffffffff
3221225713 0

NtAllocateVirtualMemory

 process_identifier: 2628
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00830000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
name RT_VERSION language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_CYRILLIC offset 0x00046310 size 0x00000308
file C:\Users\test22\AppData\Local\Temp\pee bin.exe
section {u'size_of_data': u'0x00033600', u'virtual_address': u'0x00002000', u'entropy': 7.931602780518816, u'name': u'.text', u'virtual_size': u'0x000335d3'} entropy 7.93160278052 description A section with a high entropy has been found
entropy 0.754128440367 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Generic.mgtv
DrWeb Trojan.Siggen20.16305
MicroWorld-eScan Gen:Heur.MSIL.Jalapeno.J.36
FireEye Generic.mg.a82baff8213bd78f
CAT-QuickHeal Trojan.Agent
McAfee Artemis!A82BAFF8213B
Malwarebytes Malware.AI.4238811965
Zillya Dropper.Jalapeno.Win32.1
Sangfor Suspicious.Win32.Save.a
Alibaba TrojanSpy:MSIL/Jalapeno.c7f5f1e9
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.MSIL.Jalapeno.J.36
BitDefenderTheta Gen:NN.ZemsilF.36344.rm0@aOj@u7DH
Cyren W32/ABRisk.OOTH-8942
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender Gen:Heur.MSIL.Jalapeno.J.36
Avast Win32:PWSX-gen [Trj]
Tencent Msil.Trojan-Spy.Noon.Rsmw
Sophos ML/PE-A
VIPRE Gen:Heur.MSIL.Jalapeno.J.36
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.moderate.ml.score
Emsisoft Gen:Heur.MSIL.Jalapeno.J.36 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Dropper.MSIL.Gen
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Tiggre!rfn
GData MSIL.Malware.FakeGoogle.B
Google Detected
AhnLab-V3 Trojan/Win.Jalapeno.C5398063
Acronis suspicious
VBA32 TScope.Trojan.MSIL
ALYac Gen:Heur.MSIL.Jalapeno.J.36
MAX malware (ai score=89)
Cylance unsafe
TrendMicro-HouseCall TROJ_GEN.R002H09CK23
Rising Malware.Obfus/MSIL@AI.83 (RDM.MSIL2:2wG+/e0QB3GzjiJwtjhdpg)
Yandex Trojan.DR.MSIL!RwFr7XWFA9s
Ikarus Trojan.MSIL.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet PossibleThreat
AVG Win32:PWSX-gen [Trj]
Panda Trj/Chgt.AD