popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dirtquire.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 23, 2024, 7:46 a.m. April 23, 2024, 7:48 a.m.
Size 273.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 e795115169cc800de0392d6a675d58fd
SHA256 17f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
CRC32 3722974E
ssdeep 6144:s/wl9dobdtMJNPX459l2/FpnovRWf1RdSxWbkHg6O0:HdoRtMJRkQp2MY0QO0
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75
        

      
        exception.symbol:
        dirtquire+0x43e9b
        

      
        exception.instruction:
        cmp dword ptr [esi], 0x64616f4c
        

      
        exception.module:
        dirtquire.exe
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.offset:
        278171
        

      
        exception.address:
        0xed3e9b
        

      
    
  
    
      
        registers.esp:
        12385456
        

      
        registers.edi:
        1969008856
        

      
        registers.eax:
        1968766976
        

      
        registers.ebp:
        637
        

      
        registers.edx:
        1969006304
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        1970143252
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1932
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00ed3000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00017800', u'virtual_address': u'0x0002d000', u'entropy': 7.93144964129835, u'name': u'.data', u'virtual_size': u'0x00018428'}
                                        
                                    
                                        
                                            entropy
                                            7.9314496413
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.345588235294
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    CAT-QuickHeal
                                    Trojan.Agent
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win32.Generic.dc
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Gen:Variant.Lazy.513828
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Gen:Variant.Lazy.513828
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Gen:Variant.Lazy.513828
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Lazy.D7D724
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Kryptik.HWWP
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!E795115169CC
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:PWSX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    HEUR:Trojan.Win32.Agent.gen
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    Trojan:Win32/Kryptik.6d549550
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Gen:Variant.Lazy.513828
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Generic@AI.100 (RDML:rejXUn2QiqbPDsxTUcWcnw)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Gen:Variant.Lazy.513828 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/AD.PhemedromeSteal.jftis
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.PWS.Stealer.37437
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    Mal_Locky-1
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.e795115169cc800d
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-S
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Win32.Outbreak
                                    
                                


                            

                        

                            

                                

                                    Webroot
                                    W32.Trojan.Gen
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/AD.PhemedromeSteal.jftis
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=88)
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan/Win32.Kryptik
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    Win32.Trojan.Agent.gen
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Malware.Win32.Gen.tr
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Redline.AMMH!MTB
                                    
                                


                            

                        

                            

                                

                                    ViRobot
                                    Trojan.Win.Z.Lazy.279552
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    HEUR:Trojan.Win32.Agent.gen
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Gen:Variant.Lazy.513828
                                    
                                


                            

                        

                            

                                

                                    Varist
                                    W32/Agent.ISX.gen!Eldorado
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Trojan/Win.Locky.R645634
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    Gen:NN.ZexaF.36804.ruW@aSgQAbb
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    Trojan.Agent
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Trojan.Crypt
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/GdSda.A
                                    
                                


                            

                        

                            

                                

                                    TrendMicro-HouseCall
                                    Mal_Locky-1
                                    
                                


                            

                        

                            

                                

                                    Tencent
                                    Malware.Win32.Gencirc.14096203
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Malicious PE
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Trojan.Malware.300983.susgen