popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rot13.exe

Gen1 Malicious Library UPX Anti_VM ftp PE64 PE File OS Processor Check ZIP Format DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 8, 2023, 4:30 p.m. Sept. 8, 2023, 4:39 p.m.
Size 13.4MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 7fe90dcf5c49fd85ce12939b8cc3315c
SHA256 60ee0d0e9f0799545b6d1739f6554a1591bf62c6efaee94f48fea42e7d4e4f1f
CRC32 A41557A7
ssdeep 196608:PnEZYDwGcsAgejtcGfcY3gtywIf7E5MsFwMF8SMjdeuFtU3gjcHu6wpE/U:f4Yk3meBcGfdlYMO8KuF23gjqur5
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • ftp_command - ftp command
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8
0x7fef7c97ef8

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x7fef7c97ef8
registers.r14: 0
registers.r15: 196974
registers.rcx: 196974
registers.rsi: 1
registers.r10: 196974
registers.rbx: 0
registers.rsp: 2975832
registers.r11: 0
registers.r8: 1
registers.r9: 0
registers.rdx: 28
registers.r12: 0
registers.rbp: 9803024
registers.rdi: 0
registers.rax: 2975936
registers.r13: 28
1 0 0
file C:\Users\test22\AppData\Local\Temp\_MEI20602\libssl-3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI20602\python311.dll
file C:\Users\test22\AppData\Local\Temp\_MEI20602\VCRUNTIME140.dll
file C:\Users\test22\AppData\Local\Temp\_MEI20602\libffi-8.dll
file C:\Users\test22\AppData\Local\Temp\_MEI20602\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\_MEI20602\libcrypto-3.dll
Bkav W32.AIDetectMalware.64
Cynet Malicious (score: 100)
Cylance unsafe
Symantec Trojan.Gen.MBT
APEX Malicious
Alibaba TrojanPSW:Win32/Almi_Disco.b
Zillya Trojan.Disin.Script.64
Sophos Mal/Generic-S
Ikarus Trojan-Spy.Python.CStealer
Jiangmin TrojanSpy.Agent.aftb
Avira TR/PSW.Agent.gdafr
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win64.Packed.oa!s1
ZoneAlarm HEUR:Trojan.Python.Disin.a
Malwarebytes Generic.Malware/Suspicious
Tencent Win32.Trojan.Disin.Mgil
Yandex Trojan.PyInstaller!dKg+NrCh7Rg
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)