popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

onecommander.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File dll OS Processor Check DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 14, 2024, 9:17 a.m. June 14, 2024, 9:26 a.m.
Size 6.5MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 55757364d854adc3fc1e5cb59532f1c3
SHA256 58ca3c309de385bb0a975f4b7c9d94cb0adf6feef9c75038bc997c8b0e638465
CRC32 8AE3D7B6
ssdeep 49152:RYY8ksnnhumByOZi/9YKpWBPA12a0rm4lKUYR+8ZduE2ak38upZjR5Es+WC7TCnN:H61BJIYKpjalKUk+8stpNEOfajHW2o
Yara
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • DllRegisterServer_Zero - execute regsvr32.exe
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
45.33.6.223 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        5364395360
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        -1
        

      
        registers.rsi:
        3666689
        

      
        registers.r10:
        3221225480
        

      
        registers.rbx:
        -10000
        

      
        registers.rsp:
        3666856
        

      
        registers.r11:
        514
        

      
        registers.r8:
        3666896
        

      
        registers.r9:
        350
        

      
        registers.rdx:
        0
        

      
        registers.r12:
        3667416
        

      
        registers.rbp:
        3666912
        

      
        registers.rdi:
        5358664736
        

      
        registers.rax:
        0
        

      
        registers.r13:
        3800784
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            45.33.6.223