popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

msvs.exe

Emotet MPRESS UPX PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 19, 2023, 7:16 a.m. July 19, 2023, 7:21 a.m.
Size 4.0MB
Type MS-DOS executable, MZ for MS-DOS
MD5 e1cd1c30f4761a2bf4c878ef0a723435
SHA256 b20d74c759e6d677148c3cf1ddac1056631d69ec738f098d2c8103782d8d82c6
CRC32 4156BC32
ssdeep 98304:jBFr1GYY6ihQXeuhAgNcpdWK07pWUd/nwdAS:1/7kdEQUd/nwuS
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • MPRESS_Zero - MPRESS packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .MPRESS1
section .MPRESS2
resource name WAIT
resource name None
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895 @ 0x76d80895
stacktrace+0x84 memdup-0x1af @ 0x73980470
hook_in_monitor+0x45 lde-0x133 @ 0x739742ea
New_ntdll_NtProtectVirtualMemory+0x34 New_ntdll_NtQueryAttributesFile-0x151 @ 0x73993603
VirtualProtectEx+0x33 MapViewOfFile-0x2d kernelbase+0x13243 @ 0x7fefd503243
VirtualProtect+0x1b VirtualProtectEx-0x15 kernelbase+0x131fb @ 0x7fefd5031fb
msvs+0x1fcb05 @ 0xf4cb05
GetProcessAffinityMask+0x80 SetThreadContext-0x20 kernel32+0x2ef0 @ 0x76c12ef0
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff
0x924fff

exception.instruction_r: 0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29
exception.symbol: RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895
exception.address: 0x76d80895
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 329877
registers.r14: 0
registers.r15: 0
registers.rcx: 3273112
registers.rsi: 23552000
registers.r10: 0
registers.rbx: 1992371952
registers.rsp: 3275368
registers.r11: 514
registers.r8: 64
registers.r9: 4
registers.rdx: 3274456
registers.r12: 0
registers.rbp: 0
registers.rdi: 13959535
registers.rax: 3272792
registers.r13: 0
1 0 0
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008e6618 size 0x00000144
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
name None language LANG_CHINESE filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00926b50 size 0x00000042
section {u'size_of_data': u'0x003c7800', u'virtual_address': u'0x00001000', u'entropy': 7.999952201492042, u'name': u'.MPRESS1', u'virtual_size': u'0x00926000'} entropy 7.99995220149 description A section with a high entropy has been found
entropy 0.947020677842 description Overall entropy of this PE file is high