popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

active_desktop_launcher.exe

Generic Malware UPX Downloader ASPack Antivirus Malicious Library Malicious Packer PE File MZP Format dll OS Processor Check PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 12, 2024, 3:05 p.m. April 12, 2024, 3:05 p.m.
Size 1.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d031811330bfc6c08a0251a1797876db
SHA256 dbf34eb9776e206ffdaa99021d314e1dbd7bc6b4c971868ac1d87e14fdb2b264
CRC32 82AA7D81
ssdeep 24576:fnsJ39LyjbJkQFMhmC+6GD9FYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnKyz03axwx:fnsHyjtk2MYC5GDLYREXSVMDi3qqxwx
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • ASPack_Zero - ASPack packed file
  • PE_Header_Zero - PE File Signature
  • DllRegisterServer_Zero - execute regsvr32.exe
  • Malicious_Packer_Zero - Malicious Packer
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x001f1c18 size 0x000047d3
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x001f6478 size 0x00000014
name RT_VERSION language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x001f648c size 0x00000304
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
CAT-QuickHeal Sus.Nocivo.E0011
Skyhigh BehavesLike.Win32.Obfuscated.th
ALYac Win32.Comet.A
Cylance unsafe
VIPRE Win32.Comet.A
Sangfor Trojan.Win32.Killer.swycb
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Win32.Comet.A
K7GW Trojan ( 000112511 )
K7AntiVirus Trojan ( 000112511 )
Arcabit HEUR.VBA.Trojan.d
Symantec W32.Zorex
Elastic malicious (high confidence)
ESET-NOD32 Win32/Delf.NBX
APEX Malicious
McAfee W32/Synaptics
Avast Win32:Malware-gen
ClamAV Win.Malware.Farfli-9832713-0
Kaspersky Backdoor.Win32.DarkKomet.hqxy
Alibaba Backdoor:Win32/DarkKomet.353
NANO-Antivirus Trojan.Win32.DarkKomet.fazbwq
MicroWorld-eScan Win32.Comet.A
Rising Virus.Synaptics!1.E51C (CLASSIC)
Emsisoft Win32.Comet.A (B)
F-Secure Malware.W2000M/Dldr.Agent.17651006
DrWeb Win32.HLLW.Siggen.10555
Zillya Trojan.Delf.Win32.76144
TrendMicro Virus.Win32.NAPWHICH.B
FireEye Generic.mg.d031811330bfc6c0
Sophos Mal/Farfli-Y
Ikarus Virus.Win32.Delf
Jiangmin Win32/Synaptics.Gen
Google Detected
Avira TR/Agent.aiot
MAX malware (ai score=83)
Antiy-AVL Virus/Win32.DarkKomet.a
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.Win32.Gen.tr
Xcitium Virus.Win32.Agent.DE@74b38h
Microsoft Worm:Win32/AutoRun!atmn
ViRobot Win32.Zorex.A
ZoneAlarm Backdoor.Win32.DarkKomet.hqxy
GData Win32.Backdoor.Agent.AXS
Varist W32/Backdoor.OAZM-5661
AhnLab-V3 Win32/Zorex.X1799
Acronis suspicious
BitDefenderTheta AI:Packer.F5AF03D517
DeepInstinct MALICIOUS