Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 1, 2023, 8:05 a.m.	Aug. 1, 2023, 8:10 a.m.

Size	326.7KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f8e6425f51d262f94758c86fe2b936bf`
SHA256	`291885e66da48c5ea16c3552a947993bda7f8fcf6572aad611adc59ed276897f`
CRC32	`218A5727`
ssdeep	`6144:q13X1BF0UX0AFE15FT6L4muuUdyvz7v80hpSrDHJCxha4fB13QxCxQ:eVLrE/m0ROz7U0hpSPJCLa4fL3QsK`
PDB Path	C:\Users\PC\Downloads\Wallet\Wallet\Wallet\obj\Debug\Wallet.pdb
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

Wallet.exe "C:\Users\test22\AppData\Local\Temp\Wallet.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 1, 2023, 8:05 a.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 8:05 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\PC\Downloads\Wallet\Wallet\Wallet\obj\Debug\Wallet.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 1, 2023, 8:05 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 8:05 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ffd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 8:06 a.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00045800', u'virtual_address': u'0x00002000', u'entropy': 7.980950312607914, u'name': u'.text', u'virtual_size': u'0x00045790'}

entropy

7.98095031261

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00005e00', u'virtual_address': u'0x00048000', u'entropy': 6.866824817283987, u'name': u'.rsrc', u'virtual_size': u'0x00005d3b'}

entropy

6.86682481728

description

A section with a high entropy has been found

entropy

0.998344370861

description

Overall entropy of this PE file is high

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Bkav	W32.Common.A7693D17
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.68442163
FireEye	Generic.mg.f8e6425f51d262f9
McAfee	Artemis!F8E6425F51D2
VIPRE	Trojan.GenericKD.68442163
Sangfor	Trojan.Win32.Agent.V7r0
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Generic.D4145833
Symantec	ML.Attribute.HighConfidence
BitDefender	Trojan.GenericKD.68442163
Avast	FileRepMalware [Misc]
Emsisoft	Trojan.GenericKD.68442163 (B)
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Webroot	W32.Trojan.GenKD
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Casdet!rfn
GData	Trojan.GenericKD.68442163
Google	Detected
BitDefenderTheta	Gen:NN.ZemsilF.36318.um2@a8rbevdi
VBA32	Downloader.MSIL.Pabin.Heur
Panda	Trj/Chgt.AD
Ikarus	Trojan-Downloader.MSIL.Tiny
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat
AVG	FileRepMalware [Misc]
Cybereason	malicious.a1b30b
DeepInstinct	MALICIOUS

Wallet.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All