popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

timeSync.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 29, 2024, 7:42 a.m. March 29, 2024, 7:45 a.m.
Size 233.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8240488d2fcb690ee31e00fef612eb3a
SHA256 d8f34a356c371556db67aa56face23daaef53a1d3a204bdc862a485116dd584a
CRC32 531EA8FD
ssdeep 3072:teFLPBig2ADwDa/ZwPmUVrEwWBMA0j+NkpHxgT2PBtXs8:tsBigR0Da/ZpUKwyMA0jFRaT2PBtXs
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ee000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2072
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealerc.1m!c
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Lockbit.dh
Cylance unsafe
Sangfor Ransom.Win32.Save.a
K7AntiVirus Trojan ( 003e58dd1 )
K7GW Trojan ( 003e58dd1 )
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
APEX Malicious
Avast FileRepMalware [Pws]
ClamAV Win.Dropper.Glupteba-10025041-0
Kaspersky UDS:DangerousObject.Multi.Generic
Rising Trojan.SmokeLoader!1.F900 (CLASSIC)
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.8240488d2fcb690e
Sophos Troj/Krypt-ADH
Google Detected
Kingsoft malware.kb.a.1000
Microsoft Trojan:Win32/DllCheck.A!MSR
ZoneAlarm UDS:DangerousObject.Multi.Generic
AhnLab-V3 Trojan/Win.PWSX-gen.R642038
BitDefenderTheta Gen:NN.ZexaF.36802.oq0@a0ZD6mS
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HKBB!tr
AVG FileRepMalware [Pws]
CrowdStrike win/malicious_confidence_100% (W)