popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

tram.exe

MPRESS UPX PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 20, 2023, 5:31 p.m. April 20, 2023, 5:35 p.m.
Size 2.7MB
Type MS-DOS executable, MZ for MS-DOS
MD5 20974e780438e87cf0fab2e4c10aa72a
SHA256 9f35ecf414df4f8e3d0bfa41cea9ebf0827a271941555cabaf22530d774bd999
CRC32 3A5D3193
ssdeep 49152:izUKp+KxzGMns8LyGuD7wdwrYvihsZqkWo9pG7XnkMcfWzE65Gl9R/4xEozse:iYKpbxZDyGuDkdRiOZRd9e5KW4aGd/6N
Yara
  • UPX_Zero - UPX packed file
  • MPRESS_Zero - MPRESS packed file
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895
stacktrace+0x84 memdup-0x1af @ 0x73980470
hook_in_monitor+0x45 lde-0x133 @ 0x739742ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb
tram+0x1fcb05 @ 0x129cb05
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff
0x872fff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x76d80895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 4255432
registers.rsi: 26296320
registers.r10: 0
registers.rbx: 1992371952
registers.rsp: 4257688
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 4256776
registers.r12: 0
registers.rbp: 0
registers.rdi: 17432943
registers.rax: 4255112
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x002ad800', u'virtual_address': u'0x00001000', u'entropy': 7.999938455129823, u'name': u'.MPRESS1', u'virtual_size': u'0x00874000'} entropy 7.99993845513 description A section with a high entropy has been found
entropy 0.996185286104 description Overall entropy of this PE file is high
Lionic Trojan.Win32.ClipBanker.Z!c
Elastic malicious (high confidence)
Malwarebytes Generic.Malware/Suspicious
Sangfor Trojan.Win32.Agent.V252
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win64/Packed.Themida.OY
APEX Malicious
Kaspersky UDS:Trojan-Banker.Win64.ClipBanker.gen
Avast FileRepMalware [Misc]
McAfee-GW-Edition BehavesLike.Win64.Generic.vc
Trapmine malicious.high.ml.score
FireEye Generic.mg.20974e780438e87c
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Gridinsoft Ransom.Win64.Sabsik.sa
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:Trojan-Banker.Win64.ClipBanker.gen
McAfee Artemis!20974E780438
Cylance unsafe
Rising Trojan.ClipBanker!8.5FB (CLOUD)
Fortinet W32/PossibleThreat
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS