popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

denver.exe

Emotet MPRESS UPX PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 15, 2023, 7:23 a.m. June 15, 2023, 7:26 a.m.
Size 3.5MB
Type MS-DOS executable, MZ for MS-DOS
MD5 539a444f8dff3d9719e36fd9db31b799
SHA256 2c5c3ba7eba30cc358b40d494fda79d9d2a6df152bdb7eb1aceb36f3fbcf60c3
CRC32 68D09BEC
ssdeep 98304:GrZtcyQgVa9BjWmic5fcD75vuHgdtZgC:GsRgVa9ltc35WHG7
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE64 - (no description)
  • MPRESS_Zero - MPRESS packed file
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
resource name None
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x77710895
stacktrace+0x84 memdup-0x1af @ 0x749a0470
hook_in_monitor+0x45 lde-0x133 @ 0x749942ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x749b3603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefdc03243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefdc031fb
denver+0x1fcb05 @ 0xe4cb05
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76fc2ef0
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff
0x7eafff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x77710895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 3732632
registers.rsi: 21217280
registers.r10: 0
registers.rbx: 1996238576
registers.rsp: 3734888
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 3733976
registers.r12: 0
registers.rbp: 0
registers.rdi: 12910959
registers.rax: 3732312
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x0033e400', u'virtual_address': u'0x00001000', u'entropy': 7.999944420724998, u'name': u'.MPRESS1', u'virtual_size': u'0x007ec000'} entropy 7.99994442072 description A section with a high entropy has been found
entropy 0.93946251768 description Overall entropy of this PE file is high