popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

SP_MASTER_v112.exe

VMProtect UPX Malicious Library PE64 PE File OS Processor Check MZP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 10, 2024, 9:15 p.m. April 10, 2024, 9:15 p.m.
Size 6.7MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 a73a7c7d0a0cc88bde17aa70f80eedbe
SHA256 b64916db4b5eafd0c923e7b04c9013928073159ba835aa7d214e5a8b2ff61b81
CRC32 0D91B291
ssdeep 98304:lapmx5gq1QojNjloj0bUf1MnyONuaUCtGV8p54DULPWLPrxTHxjOKiIQMdK0:lape5g2oyOayXak8QDUDKz5xjOcM0
Yara
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • VMProtect_Zero - VMProtect packed file
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .didata
section .vmp0
section .vmp1
section .vmp2
section {u'size_of_data': u'0x0068fa00', u'virtual_address': u'0x00840000', u'entropy': 7.9155114798385515, u'name': u'.vmp2', u'virtual_size': u'0x0068f880'} entropy 7.91551147984 description A section with a high entropy has been found
section {u'size_of_data': u'0x00016e00', u'virtual_address': u'0x00ed0000', u'entropy': 7.288499073153538, u'name': u'.rsrc', u'virtual_size': u'0x00016d64'} entropy 7.28849907315 description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
section .vmp2 description Section name indicates VMProtect
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Bulz.4!c
CAT-QuickHeal Trojan.Emotet
Skyhigh BehavesLike.Win64.Sality.vc
Cylance unsafe
Sangfor Trojan.Win32.Agent.V2h1
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/Packed.VMProtect.L suspicious
Avast FileRepMalware
Rising Hacktool.Activator!8.1118B (CLOUD)
FireEye Generic.mg.a73a7c7d0a0cc88b
Sophos Generic Reputation PUA (PUA)
Antiy-AVL Trojan[Packed]/Win64.VMProtect
Microsoft HackTool:Win32/Activator
McAfee Artemis!A73A7C7D0A0C
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
SentinelOne Static AI - Suspicious PE
AVG FileRepMalware
CrowdStrike win/malicious_confidence_90% (W)
alibabacloud VirTool:Win/Packed.VMProtect.AAG(dyn)