popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

haspdinst_8_31+(2).exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer Anti_VM PE File OS Processor Check PE32 CAB DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 3, 2024, 10:17 p.m. June 3, 2024, 10:18 p.m.
Size 25.3MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 235623c73f1d0283860da85f75d41500
SHA256 1718be91005a0440dcb9502da39318295db19fede34d2528ddc4f0b4d5485cbd
CRC32 E6C3B2B0
ssdeep 786432:9NcVQMBtzAwI+pKvU6J5NUoPfb/Jrbp+N2dUbEqqX4d2O:9jMBVDpQxJ5NUoPj/JPRCExO
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3012
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741b2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3012
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74233000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9098153984
free_bytes_available: 9098153984
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Temp\haspds_windows.dll
file C:\Users\test22\AppData\Local\Temp\haspds_windows.dll
APEX Malicious
Trapmine suspicious.low.ml.score