popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

victor.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 1, 2024, 8:49 a.m. June 1, 2024, 8:51 a.m.
Size 312.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 01cff6fb725465d86284505028b42cfd
SHA256 3814ef98c5c16988df008a989038faf39943b32fb9687dc9347ac16df722e4cd
CRC32 108D5B1B
ssdeep 6144:dKiOduIntTEob6Cehx1m0kDLnbdyvtz+YrAYhsQa75/QXoe+Q7kh:dK9fntoNwLb0vtz+tYhta7KDzkh
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .bsS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x40778d9e

exception.instruction_r: ad ad ad ad 95 04 52 ad ad ad 04 57 ad ad ad 9c
exception.instruction: lodsd eax, dword ptr [esi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x320189
registers.esp: 13499236
registers.edi: 0
registers.eax: 1971270584
registers.ebp: 13499245
registers.edx: 3277192
registers.ebx: 11108416
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1000
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00320000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00026e00', u'virtual_address': u'0x00028000', u'entropy': 7.968210803549805, u'name': u'.data', u'virtual_size': u'0x00027ca4'} entropy 7.96821080355 description A section with a high entropy has been found
entropy 0.5 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.fc
ALYac Gen:Variant.Zusy.548714
Cylance Unsafe
VIPRE Gen:Variant.Zusy.548714
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Zusy.548714
K7GW Trojan ( 005b51cb1 )
Arcabit Trojan.Zusy.D85F6A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.GXGC
APEX Malicious
McAfee Artemis!01CFF6FB7254
Avast Win32:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/GenKryptik.d1d3e53a
MicroWorld-eScan Gen:Variant.Zusy.548714
Rising Trojan.Kryptik!8.8 (TFE:5:NKNOnXHWmNF)
Emsisoft Gen:Variant.Zusy.548714 (B)
F-Secure Trojan.TR/Kryptik.kkcfm
TrendMicro Trojan.Win32.AMADEY.YXEE5Z
McAfeeD Real Protect-LS!01CFF6FB7254
Trapmine malicious.high.ml.score
FireEye Generic.mg.01cff6fb725465d8
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Krypt
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Kryptik.kkcfm
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.GenKryptik
Kingsoft malware.kb.a.979
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/Multiverze
ViRobot Trojan.Win.Z.Zusy.319488.UJ
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan.PSE.15JK28C
Varist W32/Kryptik.MHG.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R650649
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.36806.tuW@aevu2Km
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Sabsik.FL
Malwarebytes Trojan.Crypt.Generic
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXEE5Z
Tencent Win32.Trojan.Genkryptik.Gdhl