popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ngrok.exe

Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 8, 2024, 7:46 a.m. May 8, 2024, 7:49 a.m.
Size 24.2MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 d028e35142a32bb77301ea582548c71a
SHA256 f7d772465d27fc379f08681b2ee532baad91c50a6bdd7ecd6faaf0d11adb77dc
CRC32 A55644E6
ssdeep 98304:vLZ74HDHivcYUQn6WfIZbIpf1S/509TyfP3dKLLwDac4oOA+f0qZBx/E+aX9vVDD:F7487dn6WfICy81GOBi+aNVDM1K
Yara
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .symtab
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        29102080
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        -1
        

      
        registers.rsi:
        2292481
        

      
        registers.r10:
        0
        

      
        registers.rbx:
        -10000
        

      
        registers.rsp:
        2292760
        

      
        registers.r11:
        582
        

      
        registers.r8:
        2292800
        

      
        registers.r9:
        2292528
        

      
        registers.rdx:
        0
        

      
        registers.r12:
        2293320
        

      
        registers.rbp:
        2292816
        

      
        registers.rdi:
        4461824
        

      
        registers.rax:
        0
        

      
        registers.r13:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.Common.070F7CC2
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of WinGo/Ngrok.B potentially unsafe
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Tool.Ngrok.1
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    Yandex
                                    Trojan.Igent.b1PDlF.1
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    Adware/Ngrok