Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 4, 2024, 4:34 p.m.	Feb. 4, 2024, 4:38 p.m.

Size	345.8KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`268cf16a004a6b7515bec416b64ee904`
SHA256	`124adb0a0efcf7f8306fd05d4c13ee429f79a0065778fa19207d9f6ddd3fb0de`
CRC32	`66BF04BC`
ssdeep	`6144:NDKW1Fgbdl0TBBvjc/xqFbCfgJFPA7rtPNdxGrP0n8DdFd8EiylyckrTrT:lh1Fk70TnvjcpgVBAnpcDfGz`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

dffdfdf.exe "C:\Users\test22\AppData\Local\Temp\dffdfdf.exe"
1932

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 4, 2024, 4:34 p.m.			0	0
IsDebuggerPresent Feb. 4, 2024, 4:34 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (4 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 4, 2024, 4:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00830e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00830e98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00830ed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 4, 2024, 4:34 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00830ed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 4, 2024, 4:34 p.m.		1	1	0

One or more processes crashed (50 events)

Time & API	Arguments	Status
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: dffdfdf+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 12	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1553	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1521	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1489	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1457	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1425	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1393	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1361	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1329	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1297	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4390832 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1265	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4394928 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1233	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4399024 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1201	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4403120 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1169	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4407216 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1137	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4411312 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1105	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4415408 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1073	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4419504 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1041	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4423600 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 1009	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4427696 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 977	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4431792 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 945	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4435888 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 913	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4439984 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 881	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4444080 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 849	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4448176 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 817	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4452272 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 785	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4456368 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 753	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4460464 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 721	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4464560 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 689	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4468656 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 657	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4472752 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 625	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4476848 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 593	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4480944 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 561	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4485040 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 529	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4489136 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 497	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4493232 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 465	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4497328 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 433	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4501424 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 401	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4505520 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 369	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4509616 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 337	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4513712 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 305	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4517808 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 273	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4521904 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 241	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4526000 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 209	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4530096 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 177	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4534192 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 145	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4538288 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 113	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4542384 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 81	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4546480 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 49	1
__exception__ Feb. 4, 2024, 4:34 p.m.	stacktrace: dffdfdf+0xf054 @ 0x40f054 dffdfdf+0xf0a0 @ 0x40f0a0 dffdfdf+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: dffdfdf+0xefff exception.address: 0x40efff exception.module: dffdfdf.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4550576 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 27 registers.ebx: 0 registers.esi: 31588424 registers.ecx: 17	1

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02400000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02382000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0239f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 4, 2024, 4:34 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00031e00', u'virtual_address': u'0x00026000', u'entropy': 7.99730469196897, u'name': u'.rsrc', u'virtual_size': u'0x00031da8'}

entropy

7.99730469197

description

A section with a high entropy has been found

entropy

0.596412556054

description

Overall entropy of this PE file is high

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vgki
Cybereason	malicious.bb5792
Symantec	Trojan Horse
APEX	Malicious
McAfee	Artemis!268CF16A004A
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	Trojan-Spy.Win32.Stealer.fccc
Rising	Trojan.Generic@AI.100 (RDML:IfX6BqPY9rvG50IyjHRTdg)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEBCZ
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Kingsoft	Win32.Troj.Undef.a
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	Backdoor:Win32/Bladabindi!ml
ZoneAlarm	Trojan-Spy.Win32.Stealer.fccc
GData	MSIL.Trojan-Stealer.MetaStealer.G67FRN
BitDefenderTheta	Gen:NN.ZexaF.36744.vq2@aWGxh3j
DeepInstinct	MALICIOUS
VBA32	Trojan.Dynara
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEBCZ
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (W)

dffdfdf.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All