popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Project15.exe

UPX Downloader Malicious Library PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 18, 2023, 6:21 p.m. July 18, 2023, 6:39 p.m.
Size 1.4MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 2f8a3dfa7e89ffc2fd4166dc2db5bbe7
SHA256 8df2fc7eab6cc0ca190d0ffe2e58956727a8cd614ba4e7f361904f4ec0416762
CRC32 C497F052
ssdeep 6144:hkdT8kRK5AnIEyfjRohRqINPhFWi5gXhm9+utCeU4:SdbmAnYtouEhRSi+KX
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Network_Downloader - File Downloader
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
162.55.60.2 Active Moloch
116.62.11.90 Active Moloch

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
section _RDATA
suspicious_features Connection to IP address suspicious_request GET http://116.62.11.90/main.exe
request GET http://116.62.11.90/main.exe
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000685b8 size 0x00000468
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00068a20 size 0x000000a0
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00068ac0 size 0x000002c0
file C:\Users\Public\main.exe
host 162.55.60.2
host 116.62.11.90
Bkav W32.Common.87D16A5C
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.68224320
FireEye Generic.mg.2f8a3dfa7e89ffc2
McAfee Artemis!2F8A3DFA7E89
Sangfor Trojan.Win32.Save.a
Arcabit Trojan.Generic.D4110540
Cyren W64/ABRisk.NIOH-4450
Symantec ML.Attribute.HighConfidence
Cynet Malicious (score: 100)
APEX Malicious
BitDefender Trojan.GenericKD.68224320
Emsisoft Trojan.GenericKD.68224320 (B)
DrWeb BackDoor.AsyncRAT.12
McAfee-GW-Edition BehavesLike.Win64.Infected.tz
Antiy-AVL Trojan/Win32.SGeneric
Gridinsoft Trojan.Win64.AsyncRAT.bot
GData Win32.Trojan-Downloader.Generic.YI5WVX
Google Detected
Acronis suspicious
MAX malware (ai score=82)
Malwarebytes Backdoor.AsyncRAT
Panda Trj/Chgt.AD
SentinelOne Static AI - Suspicious PE
Fortinet PossibleThreat.MU
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)