Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 20, 2024, 5:31 p.m.	June 20, 2024, 5:33 p.m.

Size	525.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`555259d9ac1f9da27667485bfc3ab9af`
SHA256	`fa4491dbe5eb3d35c9f5884d746235769999d536d30033f4cf38633ce2343ede`
CRC32	`EF627C5A`
ssdeep	`12288:4MLTuJtddskY7k1dyXbRQESs/mFKXuiPK0Lv:4zJth1IxQShPK0L`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ June 20, 2024, 5:31 p.m.	stacktrace: exception.instruction_r: 81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75 exception.instruction: cmp dword ptr [esi], 0x64616f4c exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3401cb registers.esp: 7600384 registers.edi: 1973072088 registers.eax: 1972830208 registers.ebp: 629 registers.edx: 1973069536 registers.ebx: 0 registers.esi: 1973157892 registers.ecx: 3931244548	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 20, 2024, 5:31 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x0004ae00', u'virtual_address': u'0x00038000', u'entropy': 7.988440894576454, u'name': u'.data', u'virtual_size': u'0x0004be68'}

entropy

7.98844089458

description

A section with a high entropy has been found

entropy

0.571020019066

description

Overall entropy of this PE file is high

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Reline.i!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.hc
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Malware:Win32/km_24ad3.None
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.GYWE
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Keylogger.Lazy-10031941-0
Kaspersky	HEUR:Trojan-PSW.Win32.Reline.gen
BitDefender	Trojan.GenericKD.73181257
MicroWorld-eScan	Trojan.GenericKD.73181257
Rising	Backdoor.Agent!8.C5D (TFE:5:cc1urRePFHP)
Emsisoft	Trojan.GenericKD.73181257 (B)
F-Secure	Heuristic.HEUR/AGEN.1317017
McAfeeD	Real Protect-LS!555259D9AC1F
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.555259d9ac1f9da2
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Krypt
Webroot	W32.Stealerc
Google	Detected
Avira	HEUR/AGEN.1317017
Antiy-AVL	Trojan[PSW]/Win32.Reline
Kingsoft	Win32.Trojan-PSW.Reline.gen
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Generic.D45CA849
ZoneAlarm	HEUR:Trojan-PSW.Win32.Reline.gen
GData	Win32.Trojan.Kryptik.USJAHJ
Varist	W32/Kryptik.MHC.gen!Eldorado
AhnLab-V3	Trojan/Win.Stealerc.R654391
BitDefenderTheta	Gen:NN.ZexaF.36806.GqW@ailLxNh
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXEFSZ
MAX	malware (ai score=82)
Fortinet	W32/GenKryptik.GYWE!tr
Panda	Trj/Chgt.AD
CrowdStrike	win/malicious_confidence_100% (D)

lumma1906.exe