popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

clip64.dll

UPX Admin Tool (Sysinternals etc ...) Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 14, 2023, 7:27 p.m. June 14, 2023, 7:31 p.m.
Size 89.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 77a6fdd6c731f7da07ffc412c9f17347
SHA256 9f564eb9675e6159111b6d0b1ddf6389dc3d93cefd314443bf5a2b7e73c59946
CRC32 68F4DE1F
ssdeep 1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUzKaB89p:QoUCWbBNpplToUs1uNhj25LJUOaB89p
PDB Path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734a4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734a4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bff000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73414000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bd1000
process_handle: 0xffffffff
1 0 0
Bkav W32.NataDecoAAT.Trojan
Lionic Trojan.Win32.Agent.Y!c
MicroWorld-eScan Gen:Variant.Zusy.446682
CAT-QuickHeal Trojan.GenericPMF.S29595454
ALYac Gen:Variant.Zusy.446682
Cylance unsafe
VIPRE Gen:Variant.Zusy.446682
Sangfor Downloader.Win32.Amadey.V55m
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanDownloader:Win32/Amadey.93ef8b63
BitDefenderTheta Gen:NN.ZedlaF.36250.fu4@aqrRw@ni
Cyren W32/Agent.GPBN-4848
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.H
Cynet Malicious (score: 99)
APEX Malicious
ClamAV Win.Malware.Zusy-10001339-0
Kaspersky HEUR:Trojan.Win32.Agent.gen
BitDefender Gen:Variant.Zusy.446682
NANO-Antivirus Trojan.Win32.Clipper.juivsg
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Avast Win32:BotX-gen [Trj]
Rising Trojan.Generic@AI.99 (RDML:UOvjVOFWo3+5kBV55m4AZg)
Emsisoft Gen:Variant.Zusy.446682 (B)
F-Secure Heuristic.HEUR/AGEN.1301048
TrendMicro TROJ_GEN.R002C0DF723
McAfee-GW-Edition Trojan-FUUW!77A6FDD6C731
FireEye Gen:Variant.Zusy.446682
Sophos Troj/Amadey-K
Jiangmin Trojan.Agent.ejvu
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1301048
MAX malware (ai score=87)
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Arcabit Trojan.Zusy.D6D0DA
ViRobot Trojan.Win.Z.Zusy.91136.AJ
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
GData Gen:Variant.Zusy.446682
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5355012
McAfee Trojan-FUUW!77A6FDD6C731
TACHYON Trojan/W32.Agent.91136.ADU
Malwarebytes Amadey.Trojan.Downloader.DDS
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002C0DF723
Tencent Malware.Win32.Gencirc.13cbf0d9
Ikarus Trojan.Win32.Amadey
Fortinet W32/Amadey.H!tr
AVG Win32:BotX-gen [Trj]