popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

trxV9376

Malicious Library UPX Malicious Packer PE64 PE File DLL OS Processor Check dll DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 22, 2023, 5:42 p.m. Aug. 22, 2023, 5:42 p.m.
Size 561.5KB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 c901c8089c5e017f8e9b4b15c8ef154f
SHA256 fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a
CRC32 B6229C5F
ssdeep 12288:chQZR06Fy1F5YqSDZ9ma2aCStos1F3uD2Hescq2mc:jT08y1F5YqSDZ9ma21Str3cTX
Yara
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • DllRegisterServer_Zero - execute regsvr32.exe
  • Malicious_Packer_Zero - Malicious Packer

  • regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AFxNCNDhpJUjLGSUBdyJAlirW__APgLpQbnGOFg__AaVQghYMoDvlcIkoDhwOzm__AbGiqsZapYXQEJBQNrWj__AcIMOdUMWKfNaHjlQaJhaKDTvv__AjmdNJiPaRsRtAqadcjQnlCAvv__AmhroJJBvgsvk__BdxxRGs__BgAFcJi__BlIVCeEMUhTYUniUkHlJscB__BleGyOkIaepldUi__BoepXZDDjhOrSbcuQncJB__BpzeaEnGa__BwCjRp__CFIstcx__CJsqCnAMpj__CNPpdSVcuSzviIZhvCWSTfhZ__COOXnQoQSaTGSpWIAaSzo__CSUruSgGDFRVUvVHcTu__CTCQAClHYzuiPWfwqyQYV__CeHgsCxOuoDTDrP__CpbkGyHjPVYKKbevwuabtfos__DIczDdVVlD__DXtcAMkZFB__DahoeOjCy__DdmfNyLzGBEZdhjuVaLnGLAC__DllRegisterServer__EDirxlezljynQMb__EJrkYuGqWKJxcbkEWFxWuj__EOCBExEDvmpuiTSdISaFTJpbnD__ERdHSxbrluXBmlg__EWqRXzEYZJPwDvIiOC__EbquiojgkxAH__EjCrzK__FSJZHjqXtVCcouB__FmgnZSs__FwGMzFvmlRhqfdgYj__GEakZdngEgkQEMUw__GIucseXHMrRrXPFeKw__GNoduqRICMxxYLScjzRR__GTdkEFQtZIyifVPtMw__GUUIOYFVBkCRKKGPM__GabGyY__GlmIPNFEUxGfzccoGbGvt__GqxGeRkjCFW__GrnXAG__GsRUyGCvRhXYbBNdoXgMoD__GyQSbTrVGUQXgOfZOvlwGGJOZ__HCaLEQxCPhokiggZc__HETlXz__HRQNzHLCNHYjXY__HbOXELXYC__ISKZiApGwwqfPxy

    2556

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name TZU
section {u'size_of_data': u'0x0002b200', u'virtual_address': u'0x00065000', u'entropy': 7.772240674390569, u'name': u'.rsrc', u'virtual_size': u'0x0002b060'} entropy 7.77224067439 description A section with a high entropy has been found
entropy 0.307760927743 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware.64
Lionic Trojan.Win32.Emotet.L!c
MicroWorld-eScan Gen:Variant.Ulise.405919
FireEye Gen:Variant.Ulise.405919
McAfee Emotet-FUD!C901C8089C5E
Cylance unsafe
Zillya Trojan.Emotet.Win64.712
Sangfor Spyware.Win64.Emotet.Vjsd
K7AntiVirus Trojan ( 0059b58d1 )
Alibaba TrojanBanker:Win64/Emotet.f53d6a7c
K7GW Trojan ( 0059b58d1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Ulise.D6319F
VirIT Trojan.Win64.Emotet.DPQ
Cyren W64/Emotet.BGN.gen!Eldorado
Symantec Trojan Horse
Elastic malicious (high confidence)
ESET-NOD32 Win64/Emotet.AL
Cynet Malicious (score: 99)
Kaspersky Trojan-Banker.Win64.Emotet.cmvs
BitDefender Gen:Variant.Ulise.405919
NANO-Antivirus Trojan.Win64.Emotet.jvobvn
Avast Win64:BankerX-gen [Trj]
Tencent Malware.Win32.Gencirc.118bf89d
Emsisoft Gen:Variant.Ulise.405919 (B)
F-Secure Trojan.TR/Agent.aogi
DrWeb Trojan.Emotet.1310
VIPRE Gen:Variant.Ulise.405919
TrendMicro TrojanSpy.Win64.EMOTET.YXDCQZ
McAfee-GW-Edition Emotet-FUD!C901C8089C5E
Sophos Troj/Emotet-DCT
Jiangmin Trojan.Banker.Emotet.scv
Webroot W32.Trojan.Emotet
Avira TR/Agent.aogi
Antiy-AVL Trojan/Win64.GenKryptik
Gridinsoft Malware.Win64.Emotet.bot
Xcitium Malware@#1f2osespawys
Microsoft Trojan:Win32/Emotet!ic
ZoneAlarm Trojan-Banker.Win64.Emotet.cmvs
GData Gen:Variant.Ulise.405919
Google Detected
AhnLab-V3 Trojan/Win.Emotet.R564334
VBA32 TrojanBanker.Emotet
ALYac Trojan.Agent.Emotet
MAX malware (ai score=100)
Malwarebytes Crypt.Trojan.MSIL.DDS
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win64.EMOTET.YXDCQZ
Rising Trojan.Kryptik!8.8 (TFE:5:F5gXdyKd7lN)
Yandex Trojan.Emotet!NeE/T5E6Ku8