popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

CCleaner.exe

Emotet Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 20, 2023, 6:02 p.m. Oct. 20, 2023, 6:04 p.m.
Size 2.6MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 15a712903d393839edde2bd426c16172
SHA256 46615ee15d060fbd0c1874a3a0179dcb5668cdc6d59b489a15d564e358e2c698
CRC32 C0FFFFC3
ssdeep 49152:iDjA6pGHZAMdkDi4pWzUro5tKqE9JKXLSdCFy8kwLsY1RIfH2cunBoc5YLN:Sd+sYWWcuBoc5m
PDB Path D:\a\1\s\x64\Release\BGInfo64.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet
  • OS_Processor_Check_Zero - OS Processor Check
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
pdb_path D:\a\1\s\x64\Release\BGInfo64.pdb
section _RDATA
resource name RTF
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
description CCleaner.exe tried to sleep 660 seconds, actually delayed analysis time by 0 seconds