popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

W8vQdbz8.exe

ftp PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 11, 2023, 1:59 p.m. Oct. 11, 2023, 1:59 p.m.
Size 9.9MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 63c85f130b60b2c292e0eaf9794fe897
SHA256 43ab825086c6cb0ffccc887273a2acd37f81e0b48de001334579278f7da8e54a
CRC32 82A8D683
ssdeep 196608:NZwPMaUMd+JHUG/3m5i5EXF1kBHmUKbf+3y797xmyXpR:N6JUMiUG/3m5i54rkBHmbbG3y7Zx
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • ftp_command - ftp command

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000830000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0
section {u'size_of_data': u'0x009c4600', u'virtual_address': u'0x0001f000', u'entropy': 7.654366263158296, u'name': u'.data', u'virtual_size': u'0x009c4500'} entropy 7.65436626316 description A section with a high entropy has been found
entropy 0.985126816055 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware.64
Lionic Trojan.Win64.Reflo.tspy
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.68355540
FireEye Trojan.GenericKD.68355540
ALYac Trojan.GenericKD.68355540
Malwarebytes Crypt.Trojan.MSIL.DDS
Zillya Trojan.GenKryptik.Win64.9648
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005a508c1 )
Alibaba Trojan:Win64/Reflo.06e26e25
K7GW Trojan ( 005a508c1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D41305D4
VirIT Trojan.Win64.Agent.BBZ
Cyren W64/Injector.BMR.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/TrojanDropper.Agent.IH
Cynet Malicious (score: 100)
ClamAV Win.Packed.Tedy-10005655-0
Kaspersky Trojan.Win64.Reflo.ctm
BitDefender Trojan.GenericKD.68355540
NANO-Antivirus Trojan.Win64.Nekark.jxtzst
Avast Win64:Evo-gen [Trj]
Tencent Malware.Win32.Gencirc.13eabf43
Emsisoft Trojan.GenericKD.68355540 (B)
F-Secure Trojan.TR/AD.Nekark.hsxiq
DrWeb Trojan.Siggen21.12169
VIPRE Trojan.GenericKD.68355540
TrendMicro TROJ_GEN.R002C0DGO23
McAfee-GW-Edition BehavesLike.Win64.Generic.tc
Sophos Mal/Generic-S
Ikarus Trojan.Win64.Krypt
Jiangmin Trojan.Reflo.kt
Webroot W32.Trojan.Gen
Avira TR/AD.Nekark.hsxiq
MAX malware (ai score=100)
Antiy-AVL Trojan/Win64.GenKryptik
Gridinsoft Trojan.Win64.Kryptik.cl
Xcitium Malware@#2ythuk44b1uai
Microsoft Trojan:Win32/Xmrig!ic
ZoneAlarm Trojan.Win64.Reflo.ctm
GData Trojan.GenericKD.68355540
Google Detected
AhnLab-V3 Trojan/Win.Generic.R570073
VBA32 TrojanDownloader.Heracles
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0DGO23
Rising Trojan.Kryptik!8.8 (TFE:5:tSjl4DNY5BP)