popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.jpg

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 28, 2024, 9:31 a.m. May 28, 2024, 9:33 a.m.
Size 534.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d8ca3d5e5f0f8d22cb7230d2bc1d1050
SHA256 f506de1cd3eb9b26c5e663aac0951fc707201adcf32d0230a37b92bdae6c0ef4
CRC32 2123B86C
ssdeep 12288:geyXiiUL3hhwEVKE0tf+oxOtqqE6VDqqod1qi8azABR:geYFUL3cEsES+oolEWj4qVa6R
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name AFX_DIALOG_LAYOUT
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 393216
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03110000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 438272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02fb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x028dd0d0 size 0x00000468
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x028e3fa0 size 0x000001d2
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x028e3fa0 size 0x000001d2
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x028e3fa0 size 0x000001d2
name RT_GROUP_ICON language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x028dd538 size 0x00000068
section {u'size_of_data': u'0x00062c00', u'virtual_address': u'0x00018000', u'entropy': 7.943422834984676, u'name': u'.data', u'virtual_size': u'0x028be620'} entropy 7.94342283498 description A section with a high entropy has been found
entropy 0.740393626992 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stop.13!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Lockbit.hc
Cylance unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00516fdf1 )
K7GW Trojan ( 00516fdf1 )
VirIT Trojan.Win32.Tepfer.AD
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
APEX Malicious
McAfee Artemis!D8CA3D5E5F0F
Avast Win32:RansomX-gen [Ransom]
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky UDS:Trojan.Win32.DiskWriter.gen
Rising Trojan.SmokeLoader!1.F6B2 (CLASSIC)
McAfeeD Real Protect-LS!D8CA3D5E5F0F
Trapmine malicious.high.ml.score
FireEye Generic.mg.d8ca3d5e5f0f8d22
Sophos Mal/Generic-S
Google Detected
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.tr!n
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:Trojan.Win32.DiskWriter.gen
AhnLab-V3 Infostealer/Win.SmokeLoader.C5625795
BitDefenderTheta Gen:NN.ZexaF.36804.Hq0@aKdnIxaG
DeepInstinct MALICIOUS
Malwarebytes Generic.Malware/Suspicious
Tencent Trojan.Win32.Obfuscated.gen
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GXVJ!tr
AVG Win32:RansomX-gen [Ransom]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (D)