popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dufs.exe

UPX Malicious Library Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 2, 2023, 9:52 a.m. Aug. 2, 2023, 10:13 a.m.
Size 2.3MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 20a308e65c20ff7de1f2a1cd047464b5
SHA256 ad91669c04a71d1adedd3800fcfb505734e442a891a532e1ad18c54b05acc98d
CRC32 C599B99C
ssdeep 49152:zJWNjg2jZws6aBeNio8njOpQ7EsIU6iHWm2lOZjS:zajgKZwieH8aqW+V
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Listening on:
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: http://127.0.0.1:5000/ http://192.168.56.103:5000/
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: http://[::1]:5000/
console_handle: 0x00000007
1 1 0
Bkav W32.AIDetectMalware
Symantec ML.Attribute.HighConfidence
Rising Trojan.Generic@AI.100 (RDML:g9tlQQ3qcgqApBUE3kO1nw)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 62
family: 0
1 0 0
section {u'size_of_data': u'0x000be400', u'virtual_address': u'0x00183000', u'entropy': 6.816886953809066, u'name': u'.rdata', u'virtual_size': u'0x000be22e'} entropy 6.81688695381 description A section with a high entropy has been found
entropy 0.321300401098 description Overall entropy of this PE file is high