popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspub1.exe

Malicious Library UPX AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 30, 2023, 12:52 p.m. Sept. 30, 2023, 1:03 p.m.
Size 245.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0da78f6ac7f81956c6b3b73aa43ef60d
SHA256 82531f8bfc703bdac635684b3446aa011bc320b4542683499163ab644e2dfef7
CRC32 A73F6166
ssdeep 3072:NXrf43UsH7MoLYwal8tJrPM2+h0yA5ZEFW9IPEYa0H+6528Tp33YT8p:JD4PHYF+rR5ZEFoFn4p33YT8
PDB Path C:\yuwew18\ragicucucekajo\culayetuhe\dosayuhebihebi\zaf.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\yuwew18\ragicucucekajo\culayetuhe\dosayuhebihebi\zaf.pdb
section {u'size_of_data': u'0x00029200', u'virtual_address': u'0x00001000', u'entropy': 7.550079808690322, u'name': u'.text', u'virtual_size': u'0x0002903c'} entropy 7.55007980869 description A section with a high entropy has been found
entropy 0.674180327869 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0

LdrGetDllHandle

 module_name: snxhk
module_address: 0x00000000
stack_pivoted: 0
3221225781 0
Bkav W32.AIDetectMalware
FireEye Generic.mg.0da78f6ac7f81956
CAT-QuickHeal Ransom.Stop.P5
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005690671 )
K7GW Trojan ( 005690671 )
Cybereason malicious.533e60
Cyren W32/Kryptik.KSR.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky VHO:Trojan.Win32.Agent.gen
Avast BotX-gen [Trj]
Tencent Trojan.Win32.Obfuscated.gen
McAfee-GW-Edition BehavesLike.Win32.Lockbit.dh
Trapmine malicious.moderate.ml.score
Ikarus Trojan-Spy.Agent
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.bot!n
Microsoft Ransom:Win32/StopCrypt!ml
ZoneAlarm VHO:Trojan.Win32.Agent.gen
Google Detected
VBA32 BScope.Trojan.GenKryptik
Cylance unsafe
Rising Trojan.SmokeLoader!1.EB63 (CLASSIC)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
AVG BotX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)