popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dl.php

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 31, 2024, 10:03 a.m. May 31, 2024, 10:14 a.m.
Size 388.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 27818a4fe57d322127c3311959c5af69
SHA256 56c8dadefb7be471568c38f7c60c89220b3f1ec24f9899d7576ead45d817fce6
CRC32 57C9E2E9
ssdeep 6144:O5S9X2/BnftXOjXJWFkWZ+xKVU1V2ZEW7qJhvMTVXnd3:+S9G/BftXK5WF5koVksZET0Tdn
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 496
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 147456
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a1e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 496
region_size: 245760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_ICON language LANG_JAPANESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x024e8cf8 size 0x00000468
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024ee3f8 size 0x000002e8
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024ee3f8 size 0x000002e8
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024ee3f8 size 0x000002e8
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024ee3f8 size 0x000002e8
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024ee3f8 size 0x000002e8
name RT_ACCELERATOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024e91d8 size 0x00000048
name RT_GROUP_ICON language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024e2938 size 0x00000068
name RT_GROUP_ICON language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024e2938 size 0x00000068
name RT_GROUP_ICON language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x024e2938 size 0x00000068
section {u'size_of_data': u'0x00026800', u'virtual_address': u'0x00024000', u'entropy': 7.759934706061102, u'name': u'.data', u'virtual_size': u'0x024b1ae8'} entropy 7.75993470606 description A section with a high entropy has been found
entropy 0.397419354839 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Virus.Generic.AI.1!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Lockbit.fh
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Ransomware ( 0053d5971 )
K7GW Ransomware ( 0053d5971 )
VirIT Trojan.Win32.Tepfer.AD
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
APEX Malicious
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky VHO:Backdoor.Win32.Convagent.gen
Rising Trojan.SmokeLoader!1.F6B2 (CLASSIC)
F-Secure Trojan.TR/Crypt.XPACK.Gen4
TrendMicro Mal_HPGen-50
McAfeeD ti!56C8DADEFB7B
Trapmine malicious.high.ml.score
FireEye Generic.mg.27818a4fe57d3221
Sophos Troj/Krypt-VK
Google Detected
Avira TR/Crypt.XPACK.Gen4
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.tr!n
ZoneAlarm VHO:Backdoor.Win32.Convagent.gen
Varist W32/Kryptik.LVP.gen!Eldorado
AhnLab-V3 Infostealer/Win.SmokeLoader.R651058
BitDefenderTheta Gen:NN.ZexaE.36806.yq0@ay9U8qcG
DeepInstinct MALICIOUS
TrendMicro-HouseCall Mal_HPGen-50
Tencent Trojan.Win32.Obfuscated.gen
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GXVJ!tr
CrowdStrike win/malicious_confidence_100% (D)