popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

notepad.exe

Emotet MPRESS UPX PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 10, 2023, 6:10 p.m. July 10, 2023, 6:12 p.m.
Size 4.4MB
Type MS-DOS executable, MZ for MS-DOS
MD5 f2e100f576b44fdb37d874db2e48085c
SHA256 77530f67cff4fc2456c0b27abf28d1ab1f4f10fd9be039783adfa25ed1f7f196
CRC32 87BA09AD
ssdeep 98304:fqemq9DObUSOLZ27MJuUfg7Jb/0RCh2fc/xVzVALUx:PzD3SFEuUfcLwCh2Q/RAY
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • MPRESS_Zero - MPRESS packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
resource name WAIT
resource name None
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895
stacktrace+0x84 memdup-0x1af @ 0x73980470
hook_in_monitor+0x45 lde-0x133 @ 0x739742ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb
notepad+0x1fcb05 @ 0x158cb05
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff
0x91efff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x76d80895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 3600920
registers.rsi: 30081024
registers.r10: 0
registers.rbx: 1992371952
registers.rsp: 3603176
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 3602264
registers.r12: 0
registers.rbp: 0
registers.rdi: 20513135
registers.rax: 3600600
registers.r13: 0
1 0 0
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e35e8 size 0x00000144
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00920b48 size 0x00000042
section {u'size_of_data': u'0x00427c00', u'virtual_address': u'0x00001000', u'entropy': 7.9999543335491285, u'name': u'.MPRESS1', u'virtual_size': u'0x00920000'} entropy 7.99995433355 description A section with a high entropy has been found
entropy 0.954142841126 description Overall entropy of this PE file is high
Lionic Trojan.Win32.ClipBanker.Z!c
Elastic malicious (high confidence)
ClamAV Win.Packed.Ulise-10004320-0
McAfee Artemis!F2E100F576B4
Cylance unsafe
Sangfor Trojan.Win32.Agent.Vkfe
CrowdStrike win/malicious_confidence_70% (W)
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win64/Packed.Themida.PJ
APEX Malicious
Kaspersky Trojan-Banker.Win32.ClipBanker.yuw
Avast PWSX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win64.Trojan.rc
Trapmine malicious.high.ml.score
FireEye Generic.mg.f2e100f576b44fdb
Sophos Mal/Generic-S
Gridinsoft Malware.Win64.Laplas.bot
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm Trojan-Banker.Win32.ClipBanker.yuw
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5412061
Rising Trojan.ClipBanker!8.5FB (CLOUD)
Ikarus Trojan.Win32.Generic
AVG PWSX-gen [Trj]
DeepInstinct MALICIOUS