popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bestunderstandingresspro.exe

Emotet Gen1 Malicious Library UPX PE64 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 30, 2023, 1:44 p.m. Sept. 30, 2023, 1:46 p.m.
Size 6.8MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 c64258c1d7fef95b76f9aca64d707ac7
SHA256 f9b1bbb2af4c0144cd395dfe7837c03c0b5b0b13a51b3c405203dca76cb11534
CRC32 1D5435F1
ssdeep 196608:N84x+muhu+fN7ZITVmLRgEZjrErDENuOd0TGM:CPfhu+l7iViRZjoARLM
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path wextract.pdb
resource name AVI
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\bestunderstandingress.exe
section {u'size_of_data': u'0x006c9e00', u'virtual_address': u'0x0000f000', u'entropy': 7.998391916557444, u'name': u'.rsrc', u'virtual_size': u'0x006ca000'} entropy 7.99839191656 description A section with a high entropy has been found
entropy 0.993852312531 description Overall entropy of this PE file is high
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\bestunderstandingress.exe
Bkav W32.AIDetectMalware.64
Cybereason malicious.3becaf
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent_AGen.AZI
Cynet Malicious (score: 100)
APEX Malicious
Avast FileRepMalware [Misc]
Trapmine malicious.high.ml.score
FireEye Generic.mg.c64258c1d7fef95b
SentinelOne Static AI - Suspicious SFX
Microsoft Program:Win32/Wacapew.C!ml
Cylance unsafe
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS