popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Calculator.exe

Emotet Gen1 Generic Malware UPX ASPack Malicious Library PE64 PE File OS Processor Check ZIP Format DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 1, 2023, 4:27 p.m. May 1, 2023, 4:29 p.m.
Size 19.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 53817d095edd0763941ea1fb8af644a1
SHA256 6227340282692b6d2787579afad74ac6cd11dad74d6068469f7c132f85cbc2cc
CRC32 322CE745
ssdeep 393216:QqPoLFCSpkBwQpDOETgsgXfGNkBX4wLpcuS3:RPqFCknQoEgw5L
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE64 - (no description)
  • ASPack_Zero - ASPack packed file
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
file C:\Users\test22\AppData\Local\Temp\_MEI25682\MSVCP140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-filesystem-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-memory-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-convert-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-util-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\VCRUNTIME140_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\ucrtbase.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-math-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-libraryloader-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-handle-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-stdio-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-sysinfo-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-string-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l2-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-rtlsupport-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-profile-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-timezone-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-heap-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processthreads-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processenvironment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-utility-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-synch-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-runtime-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-multibyte-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-localization-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\mfc140u.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\pywin32_system32\pywintypes310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-locale-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\python310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-debug-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-process-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-conio-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-errorhandling-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\python3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\pywin32_system32\pythoncom310.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-namedpipe-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-environment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-processthreads-l1-1-1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-string-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-synch-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-datetime-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-heap-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-time-l1-1-0.dll
section {u'size_of_data': u'0x0000f600', u'virtual_address': u'0x00052000', u'entropy': 7.555572206814071, u'name': u'.rsrc', u'virtual_size': u'0x0000f498'} entropy 7.55557220681 description A section with a high entropy has been found
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\PublicKey\_x25519.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_poly1305.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\MSVCP140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\aiohttp\_http_parser.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-convert-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_SHA256.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\importlib_metadata-6.5.0.dist-info\top_level.txt
file C:\Users\test22\AppData\Local\Temp\_MEI25682\setuptools-65.5.0.dist-info\LICENSE
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_ARC4.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-libraryloader-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_RIPEMD160.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\PublicKey\_ec_ws.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_MD2.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\importlib_metadata-6.5.0.dist-info\METADATA
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-rtlsupport-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\cryptography-38.0.4.dist-info\LICENSE.BSD
file C:\Users\test22\AppData\Local\Temp\_MEI25682\_cffi_backend.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\markupsafe\_speedups.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_raw_ofb.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\importlib_metadata-6.5.0.dist-info\WHEEL
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_raw_eksblowfish.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_raw_cast.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_MD4.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\win32ui.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\yarl\_quoting_c.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\_win32sysloader.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\charset_normalizer\md.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-errorhandling-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-core-file-l1-2-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\wheel-0.40.0.dist-info\INSTALLER
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_Salsa20.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-environment-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_raw_ctr.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\_lzma.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\PIL\_imagingcms.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_MD5.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-time-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\cryptography\hazmat\bindings\_openssl.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\cryptography-38.0.4.dist-info\LICENSE.PSF
file C:\Users\test22\AppData\Local\Temp\_MEI25682\setuptools-65.5.0.dist-info\RECORD
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Cipher\_pkcs1_decode.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\multidict\_multidict.cp310-win_amd64.pyd
file C:\Users\test22\AppData\Local\Temp\_MEI25682\api-ms-win-crt-filesystem-l1-1-0.dll
file C:\Users\test22\AppData\Local\Temp\_MEI25682\cryptography-38.0.4.dist-info\LICENSE.APACHE
file C:\Users\test22\AppData\Local\Temp\_MEI25682\cryptography-38.0.4.dist-info\WHEEL
file C:\Users\test22\AppData\Local\Temp\_MEI25682\Crypto\Hash\_SHA384.pyd
DrWeb Python.Stealer.737
McAfee Artemis!53817D095EDD
Malwarebytes Malware.AI.4288665136
Cyren W64/PY_Stealer.A.gen!Eldorado
Elastic malicious (high confidence)
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba TrojanSpy:Win64/Disin.357c96f1
Avast Python:Agent-IR [Trj]
F-Secure Trojan.TR/Spy.Agent.odara
McAfee-GW-Edition Artemis
Sophos Mal/Generic-S
Jiangmin Trojan.Generic.horqm
Avira TR/Spy.Agent.odara
ZoneAlarm HEUR:Trojan.Python.Agent.gen
Microsoft Trojan:Win32/Casdet!rfn
Cynet Malicious (score: 99)
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0DDT23
Tencent Win64.Trojan-PSW.Disco.Ogil
Ikarus Trojan-Spy.Python.TokenGrabber
MaxSecure Trojan.Malware.121218.susgen
Fortinet Python/Stealer.645!tr
AVG Python:Agent-IR [Trj]
DeepInstinct MALICIOUS