Summary | ZeroBOX

rdpcllp.exe

Generic Malware UPX Malicious Library Anti_VM PE64 PE File
Category Machine Started Completed
FILE s1_win7_x6403_us July 20, 2023, 9:33 a.m. July 20, 2023, 9:39 a.m.
Size 9.8MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 b938598941bc685645ce1a2f7ae93e86
SHA256 544e42d33423d4dc27edf3acb6edc56c77346e833a71b353c393e5bb7f8ccf85
CRC32 24D0714C
ssdeep 196608:jgULpiWPCJcHhcdEkCu9g2LCseyu1WjUee7DJiSn616R/K:jt/icHhcd1C8ayu18U961r
Yara
  • UPX_Zero - UPX packed file
  • IsPE64 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • themida_packer - themida packer
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section
section .themida
section .boot
resource name AVI
resource name SVG
resource name TIS
resource name XML
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d
rdpcllp+0xdb6aa4 @ 0x140ab6aa4
rdpcllp+0xde54cc @ 0x140ae54cc
HeapWalk-0x1ce0 kernel32+0x0 @ 0x76fc0000
0x34f898
0x34f898
0x34f898

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 42141
exception.address: 0x7fefdbfa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3469712
registers.rsi: 2004499152
registers.r10: 0
registers.rbx: 0
registers.rsp: 3471520
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3471544
registers.rdi: 5376139264
registers.rax: 2001397645
registers.r13: 0
1 0 0
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00a11284 size 0x00000298
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00a11284 size 0x00000298
section {u'size_of_data': u'0x0000d400', u'virtual_address': u'0x00001000', u'entropy': 7.979989158589741, u'name': u' ', u'virtual_size': u'0x0001ebb0'} entropy 7.97998915859 description A section with a high entropy has been found
section {u'size_of_data': u'0x00697e00', u'virtual_address': u'0x00020000', u'entropy': 7.9336027987725055, u'name': u' ', u'virtual_size': u'0x0099f8e0'} entropy 7.93360279877 description A section with a high entropy has been found
section {u'size_of_data': u'0x00002200', u'virtual_address': u'0x009c0000', u'entropy': 7.9203656298437135, u'name': u' ', u'virtual_size': u'0x00004e50'} entropy 7.92036562984 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x009c5000', u'entropy': 7.471348647266452, u'name': u' ', u'virtual_size': u'0x00001920'} entropy 7.47134864727 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000400', u'virtual_address': u'0x00a13000', u'entropy': 7.164945560738718, u'name': u' ', u'virtual_size': u'0x00000330'} entropy 7.16494556074 description A section with a high entropy has been found
section {u'size_of_data': u'0x002d5a00', u'virtual_address': u'0x00e62000', u'entropy': 7.935579369609848, u'name': u'.boot', u'virtual_size': u'0x002d5a00'} entropy 7.93557936961 description A section with a high entropy has been found
entropy 0.973070203291 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

__anomaly__

tid: 2060
message: Encountered 65537 exceptions, quitting.
subcategory: exception
function_name:
1 0 0
MicroWorld-eScan Trojan.GenericKD.68212372
ALYac Trojan.GenericKD.68212372
Sangfor Trojan.Win32.Agent.Vdjl
K7AntiVirus Trojan ( 0059d1641 )
K7GW Trojan ( 0059d1641 )
Cybereason malicious.fb1f82
Arcabit Trojan.Generic.D410D694
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenCBL.DHF
Cynet Malicious (score: 99)
Kaspersky Trojan.Win64.Miner.lhdg
BitDefender Trojan.GenericKD.68212372
Avast Win64:Evo-gen [Trj]
Tencent Malware.Win32.Gencirc.13ea3454
Emsisoft Trojan.GenericKD.68212372 (B)
F-Secure Trojan.TR/AD.Nekark.tvors
VIPRE Trojan.GenericKD.68212372
McAfee-GW-Edition BehavesLike.Win64.Obfuscated.tc
Trapmine suspicious.low.ml.score
FireEye Trojan.GenericKD.68212372
Sophos Mal/Generic-S
Webroot W32.Trojan.Win64.Miner.Lhdg
Avira TR/AD.Nekark.tvors
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.GenCBL
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm Trojan.Win64.Miner.lhdg
GData Win64.Trojan.Agent.76VE5P
McAfee Artemis!B938598941BC
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0DGG23
Rising Trojan.GenCBL!8.12138 (CLOUD)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenCBL.DHF!tr
AVG Win64:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)