popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

syncUpd.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 4, 2023, 3:33 p.m. Dec. 4, 2023, 3:33 p.m.
Size 260.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ccb3c4b013b8ff72994e4c799503894f
SHA256 ff4ed729ebb2b43278de37bf45c4be315cb46c276786f0a091f875b182d0f675
CRC32 A15294FB
ssdeep 3072:2fhWD2hkga6oomHn7WwB6nWF0NVp6Yt9DxHFL8YL1m61DGOHMDtRlcn:CsDgRmHn71B6gA0YjDxl35tlsDj
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name RUWATUFOLUSAJOMEYOVUZOLIYE
name RUWATUFOLUSAJOMEYOVUZOLIYE language LANG_SERBIAN filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798630 size 0x0000196b
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_ICON language LANG_SERBIAN filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_SERBIAN_LATIN offset 0x00798150 size 0x00000468
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_LATIN offset 0x0079ab58 size 0x00000164
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_LATIN offset 0x0079ab58 size 0x00000164
name RT_STRING language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_LATIN offset 0x0079ab58 size 0x00000164
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_LATIN offset 0x007985b8 size 0x00000076
name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage SUBLANG_SERBIAN_LATIN offset 0x007985b8 size 0x00000076
section {u'size_of_data': u'0x00016e00', u'virtual_address': u'0x00021000', u'entropy': 7.185901408085545, u'name': u'.data', u'virtual_size': u'0x0076e330'} entropy 7.18590140809 description A section with a high entropy has been found
entropy 0.352601156069 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
tehtris Generic.Malware
FireEye Generic.mg.ccb3c4b013b8ff72
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.dh
Sangfor Ransom.Win32.Save.a
K7AntiVirus Trojan ( 00516fdf1 )
K7GW Trojan ( 00516fdf1 )
CrowdStrike win/malicious_confidence_100% (D)
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
Kaspersky VHO:Backdoor.Win32.Mokes.gen
Tencent Trojan.Win32.Obfuscated.gen
Trapmine malicious.high.ml.score
Sophos Troj/Krypt-VK
SentinelOne Static AI - Malicious PE
Google Detected
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.tr!n
ZoneAlarm VHO:Backdoor.Win32.Mokes.gen
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R626207
Acronis suspicious
VBA32 BScope.Trojan.Yakes
Cylance unsafe
APEX Malicious
Rising Trojan.Generic@AI.100 (RDML:m0NAlql6hCzYEU3asNppdg)
MaxSecure Trojan.Malware.300983.susgen
Cybereason malicious.04376e
DeepInstinct MALICIOUS