popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

logo2.jpg

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 3, 2024, 7:24 a.m. June 3, 2024, 7:29 a.m.
Size 4.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 74330f4c8e412ee96b41d01561ed1873
SHA256 cb1b59490c7c73ca61e571db0fafd1e7dbd406285eeb47cf464045c3851846bf
CRC32 F9E7B127
ssdeep 98304:WO5Ko5AfwLVKn32NRPoB6RojYvPNcOFH2pxmNNyye:rKovJC3ZMvZWy
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .bsS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x30778d9e

exception.instruction_r: ad ad ad ad 95 04 52 ad ad ad 04 57 ad ad ad 9c
exception.instruction: lodsd eax, dword ptr [esi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x250189
registers.esp: 7667136
registers.edi: 0
registers.eax: 1971270584
registers.ebp: 7667145
registers.edx: 2425224
registers.ebx: 12877872
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00250000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0040c200', u'virtual_address': u'0x00028000', u'entropy': 7.999892323863846, u'name': u'.data', u'virtual_size': u'0x0040d124'} entropy 7.99989232386 description A section with a high entropy has been found
entropy 0.963837209302 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Fragtor.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Exnet
Skyhigh BehavesLike.Win32.Generic.rc
ALYac Gen:Variant.Fragtor.569356
Cylance Unsafe
VIPRE Gen:Variant.Fragtor.569356
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005b5c4b1 )
BitDefender Gen:Variant.Zusy.550804
K7GW Trojan ( 005b5c4b1 )
Arcabit Trojan.Zusy.D86794
Symantec Trojan.Whispergate
ESET-NOD32 a variant of Win32/GenKryptik.GXTC
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/GenKryptik.4c225419
MicroWorld-eScan Gen:Variant.Zusy.550804
Rising Trojan.Kryptik!8.8 (TFE:5:NKNOnXHWmNF)
Emsisoft Gen:Variant.Zusy.550804 (B)
F-Secure Trojan.TR/Kryptik.rzqzv
TrendMicro Trojan.Win32.SMOKELOADER.YXEFBZ
McAfeeD Real Protect-LS!74330F4C8E41
Trapmine malicious.high.ml.score
FireEye Generic.mg.74330f4c8e412ee9
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Krypt
Google Detected
Avira TR/Kryptik.rzqzv
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.GenKryptik
Kingsoft Win32.Trojan.GenericML.xnet
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/Casdet!rfn
ViRobot Trojan.Win.Z.Jaik.4404224
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan.PSE.15JK28C
Varist W32/Kryptik.MHG.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R650649
BitDefenderTheta Gen:NN.ZexaF.36806.@xW@aa0LQpo
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Sabsik.FL
Malwarebytes Trojan.Crypt.Generic
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.SMOKELOADER.YXEFBZ
Tencent Win32.Trojan.Genkryptik.Kcnw
SentinelOne Static AI - Malicious PE