popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ZinTask.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 29, 2024, 7:31 a.m. May 29, 2024, 7:35 a.m.
Size 2.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dba7abdb1d2ada8cb51d1c258b1b3531
SHA256 3d0a544073fc4c02d5634bd33f76f9dae07d9a325340ed747bcfde51ea52e23f
CRC32 52F1D6D8
ssdeep 49152:CXN0e412pgwvidaFEILTDRFlseh5rcBTxSTtwvi:CXCe4QjMaWI/DRF9xcBTxST2v
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .bsS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x40778d9e

exception.instruction_r: ad ad ad ad 95 04 52 ad ad ad 04 57 ad ad ad 9c
exception.instruction: lodsd eax, dword ptr [esi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x210189
registers.esp: 15137816
registers.edi: 0
registers.eax: 1971270584
registers.ebp: 15137825
registers.edx: 2163080
registers.ebx: 9535552
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00210000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00258200', u'virtual_address': u'0x00028000', u'entropy': 7.9996994966996535, u'name': u'.data', u'virtual_size': u'0x002590a4'} entropy 7.9996994967 description A section with a high entropy has been found
entropy 0.939162754304 description Overall entropy of this PE file is high