popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xo.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 13, 2023, 9:30 a.m. April 13, 2023, 9:33 a.m.
Size 332.3KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 18116ef04d182e14002d6d0928bf4283
SHA256 fba662522184e09bb7d8a627fcc53832eae9ed93cd0dbacf8d161005ef5e99fc
CRC32 237F4318
ssdeep 6144:pcwb2Ri1orQooWMmTdGY/DXYUxEjRavtloK/IcFlm:pcM2JrDTdFX5mwvDn/IcFU
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00450000
process_handle: 0xffffffff
1 0 0
Lionic Trojan.Win32.Stealer.12!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.457021
McAfee Artemis!18116EF04D18
Cylance unsafe
Alibaba TrojanSpy:Win32/Stealer.bf82b461
CrowdStrike win/malicious_confidence_90% (W)
Cyren W32/Babar.W.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HTHJ
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Gen:Variant.Zusy.457021
Avast Win32:CrypterX-gen [Trj]
Tencent Win32.Trojan.FalseSign.Yfow
Emsisoft Gen:Variant.Zusy.457021 (B)
VIPRE Gen:Variant.Babar.188869
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.high.ml.score
FireEye Gen:Variant.Zusy.457021
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Crypt
GData Win32.Trojan-Stealer.Cordimik.GTOMIA
Gridinsoft Malware.Win32.RedLine.bot
Arcabit Trojan.Babar.D2E1C5
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
Microsoft Ransom:Win32/Aicat.A!ml
Google Detected
AhnLab-V3 Packed/Win.Katusha.C5409373
VBA32 BScope.TrojanSpy.Stealer
ALYac Gen:Variant.Babar.188869
MAX malware (ai score=87)
Malwarebytes Spyware.RedLineStealer
Panda Trj/Genetic.gen
Rising Trojan.Generic@AI.84 (RDML:AsGiQv31gDQ+i/UO9zG9Kw)
MaxSecure Trojan.W32.Strab.gen_260344
Fortinet W32/Kryptik.HTHJ!tr
BitDefenderTheta Gen:NN.ZexaE.36132.uq2@aKIypNai
AVG Win32:CrypterX-gen [Trj]
DeepInstinct MALICIOUS