popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

6sev8udq1h.dll

UPX Malicious Library PE64 PE File dll OS Processor Check DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 14, 2023, 7:03 p.m. Sept. 14, 2023, 7:09 p.m.
Size 1.1MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 3a96a42f6d6334a36d2ea26abb0a2c95
SHA256 131cee43a6f14bd9133246e87828275c30b2ad9d3036b4fcd4a08001903fa7e7
CRC32 C3180F0A
ssdeep 12288:VOQRLO3Bp/U4uxkfRZ2qKoWep2F0D02lHoSrcrb+OArPFJz9N4xvYb8:VOQR63XMxkpkqKZ+e0Z8uprPrf4xQo
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • DllRegisterServer_Zero - execute regsvr32.exe
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .gfids
resource name None
section {u'size_of_data': u'0x00041a00', u'virtual_address': u'0x00010000', u'entropy': 7.094175684645338, u'name': u'.rdata', u'virtual_size': u'0x000419c6'} entropy 7.09417568465 description A section with a high entropy has been found
entropy 0.240384615385 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware.64
FireEye Generic.mg.3a96a42f6d6334a3
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.NO
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Avast InjectorX-gen [Trj]
McAfee-GW-Edition BehavesLike.Win64.PinkSbot.th
ZoneAlarm UDS:DangerousObject.Multi.Generic
Acronis suspicious
AVG InjectorX-gen [Trj]
DeepInstinct MALICIOUS